Vulnerable code sample

import collections.abc

# Simplified representation of user permissions for demonstration.
# In a real system, this would be a database or a more complex auth service.
PERMISSIONS = {
    "tenant_A": {
        "database_1": {
            "authorized_user": ["get_collection"]
        }
    }
}

def _check_authorization(user: str, action: str, tenant: str, database: str) -> bool:
    """
    A simplified authorization function.
    This function contains the flawed logic that can be exploited.
    """
    # THE ROOT CAUSE OF THE VULNERABILITY:
    # If the tenant or database is None, the authorization check is incorrectly
    # bypassed, and access is granted by default. This might have been
    # intended for an internal or single-tenant context but is insecure
    # when exposed via an endpoint.
    if tenant is None or database is None:
        print(f"[AUTH-BYPASS] Access granted to user '{user}' because tenant/database was None.")
        return True

    # The correct, intended authorization logic for a multi-tenant system.
    tenant_permissions = PERMISSIONS.get(tenant, {})
    db_permissions = tenant_permissions.get(database, {})
    user_permissions = db_permissions.get(user, [])

    if action in user_permissions:
        print(f"[AUTH-OK] User '{user}' has '{action}' permission on '{tenant}/{database}'.")
        return True
    
    print(f"[AUTH-FAIL] User '{user}' denied '{action}' on '{tenant}/{database}'.")
    return False

def get_collection(name: str, user: str, tenant: str, database: str):
    """
    Represents the internal logic to retrieve a collection after an auth check.
    """
    if _check_authorization(user=user, action="get_collection", tenant=tenant, database=database):
        return f"Returning data for collection '{name}'."
    else:
        raise PermissionError("Access Denied.")

# This function represents a V1 collection-level API endpoint handler.
def v1_api_get_collection(request_data: collections.abc.Mapping):
    """
    This is the vulnerable V1 endpoint handler. It represents the state
    of the code BEFORE the fix was applied.
    """
    user_id = request_data.get("user_id")
    collection_name = request_data.get("collection_name")
    
    # THE FLAW:
    # The V1 endpoint handler calls the internal `get_collection` function
    # but hardcodes `None` for the tenant and database parameters. This
    # triggers the bypass logic in the `_check_authorization` function.
    return get_collection(
        name=collection_name,
        user=user_id,
        tenant=None,    # <-- VULNERABLE CODE
        database=None   # <-- VULNERABLE CODE
    )