Symptom

GET /courses?status=published returns ALL courses instead of only published ones. The InMemoryCourseRepository alone works correctly, so the bug is in the layer on top.

Expected: Only courses matching the requested status should be returned.

Context

The API wraps InMemoryCourseRepository with AuditedRepository (a decorator). The decorator should delegate each method to the inner repository. findAll() returns everything; findByCategory(category) filters by status.