Node.js - Beginner -- What am I missing?

That didn't seem to help either. In the post above all the code existed except lines 2-5 and line 12 was moved from basically line 2 without my additions. The addition of author to line 13 should only pull back the drafts associated to the author. This seems to be the correct implementation based upon the requirements. Every test of the code returns insecure though.

Am I still reading too much into it?

1.) Identify the forced browsing vulnerability.
2.) Add an appropriate authorization check and send a 401 for unauthorized users in the getDraft function.