Integration-test `GET` and `PUT /api/practice/{id}` for owner, non-owner, and privileged-support access.

• Seed at least two identities.
• Exercise both read and write routes.
• Assert stored state after denied writes.
• Keep support access explicit and narrow.

I test object authorization through HTTP because route binding, current-user resolution, query filters, and policies all participate. The most important assertion after a denied PUT is that the owner record did not change.

[Fact]
public async Task Non_owner_cannot_read_or_update_private_practice()
{
    await using var factory = await ApiTestFactory.CreateWithPracticeAsync(
        ownerId: "user-a",
        practiceId: PracticeIds.PrivateOne);

    var client = factory.CreateAuthenticatedClient("user-b", "practice.write.own");

    var read = await client.GetAsync($"/api/practice/{PracticeIds.PrivateOne}");
    Assert.Equal(HttpStatusCode.NotFound, read.StatusCode);

    var write = await client.PutAsJsonAsync(
        $"/api/practice/{PracticeIds.PrivateOne}",
        new { Notes = "overwritten" });
    Assert.Equal(HttpStatusCode.NotFound, write.StatusCode);

    var stored = await factory.ReadPracticeAsync(PracticeIds.PrivateOne);
    Assert.NotEqual("overwritten", stored.Notes);
    Assert.Equal("user-a", stored.UserId);
}

This test needs isolated multi-user state. An in-memory repository is acceptable for policy orchestration; use a disposable relational database when ownership is enforced by EF filters or query shape that must be verified.

• The record id does not exist.
• The caller owns a different record.
• A privileged user lacks the exact recovery capability.
• A denied update partially changes tracked state.

• Swap route ids between users.
• Assert data remains unchanged after denial.
• Test background or raw-SQL paths separately when they bypass normal filters.

• Testing endpoint-level authentication without object ownership.
• Using only one seeded user.
• Asserting status but not persisted state.
• Trusting a client-supplied user id.