The long answer.

async def get_for_user(
    self,
    resource_id: uuid.UUID,
    *,
    user_id: uuid.UUID,
) -> Project | None:
    """Fetch by id WITH ownership check. Returns None for foreign rows.

    This is the ONLY way the router should fetch a single row.
    Calling `session.get(Project, id)` directly skips
    the ownership filter — a classic IDOR slip.
    """
    stmt = select(Project).where(
        Project.id == resource_id,
        Project.user_id == user_id,
    )
    return (await self.session.execute(stmt)).scalar_one_or_none()

async def test_get_foreign_row_returns_404(
    authed_client: AsyncClient,
    other_user_client: AsyncClient,
) -> None:
    """Another user's row must look like it doesn't exist.

    REGRESSION GUARD: this is the IDOR test. If someone removes the
    user_id filter in the repository, this test fails immediately
    because the other user's GET would return 200 instead of 404.
    """
    create_resp = await other_user_client.post(
        "/api/v1/projects", json={"title": "Test"},
    )
    foreign_id = create_resp.json()["id"]

    get_resp = await authed_client.get(f"/api/v1/projects/{foreign_id}")

    assert get_resp.status_code == 404, (
        f"IDOR REGRESSION: user got status {get_resp.status_code} "
        f"for foreign row {foreign_id}. Must be 404 (not 403 — don't "
        f"leak existence)."
    )