Principle of Least Privilege #

// Separate connections by the privileges required
type Database struct {
    writer   *sql.DB // app_writer — for write operations
    reader   *sql.DB // app_reader — for read operations
}

func NewDatabase(writerDSN, readerDSN string) (*Database, error) {
    writer, err := sql.Open("postgres", writerDSN)
    if err != nil {
        return nil, fmt.Errorf("open writer connection: %w", err)
    }

    reader, err := sql.Open("postgres", readerDSN)
    if err != nil {
        return nil, fmt.Errorf("open reader connection: %w", err)
    }

    return &Database{writer: writer, reader: reader}, nil
}

type OrderRepository struct {
    db *Database
}

// Write operations → use the writer connection
func (r *OrderRepository) Save(ctx context.Context, order Order) error {
    _, err := r.db.writer.ExecContext(ctx,
        "INSERT INTO orders (id, user_id, total, status) VALUES ($1, $2, $3, $4)",
        order.ID, order.UserID, order.Total, order.Status,
    )
    if err != nil {
        return fmt.Errorf("save order: %w", err)
    }
    return nil
}

// Read operations → use the reader connection (least privilege)
func (r *OrderRepository) ListByUserID(ctx context.Context, userID string) ([]Order, error) {
    rows, err := r.db.reader.QueryContext(ctx,
        "SELECT id, user_id, total, status, created_at FROM orders WHERE user_id = $1",
        userID,
    )
    if err != nil {
        return nil, fmt.Errorf("list orders: %w", err)
    }
    defer rows.Close()
    // ... scan rows
    return orders, nil
}

// In Go, use workload identity or a preconfigured service account
// Don't hardcode credentials in code — let the platform inject them automatically

// ANTI-PATTERN: hardcoded credentials or overly broad environment variables
func newStorageClient() (*storage.Client, error) {
    // A JSON key file on disk = a stealable credential, never auto-rotated
    return storage.NewClient(ctx,
        option.WithCredentialsFile("/path/to/service-account-key.json"),
    )
}

// CORRECT: Application Default Credentials — the platform injects identity automatically
// On GKE: Workload Identity → pods automatically get the SA identity
// On Cloud Run: the service account is bound at deploy time
// On VMs: the metadata server provides tokens automatically
func newStorageClient(ctx context.Context) (*storage.Client, error) {
    // No explicit credential — use ADC
    // The platform ensures this service only has the configured access
    client, err := storage.NewClient(ctx)
    if err != nil {
        return nil, fmt.Errorf("create storage client: %w", err)
    }
    return client, nil
}

// Access only the specific bucket — not all buckets
func (s *FileService) UploadOrderDocument(
    ctx context.Context,
    orderID string,
    data []byte,
) error {
    bucket := s.storage.Bucket(s.orderDocumentBucket) // specific bucket
    obj := bucket.Object(fmt.Sprintf("orders/%s/document.pdf", orderID))

    writer := obj.NewWriter(ctx)
    if _, err := writer.Write(data); err != nil {
        return fmt.Errorf("upload document %s: write: %w", orderID, err)
    }
    if err := writer.Close(); err != nil {
        return fmt.Errorf("upload document %s: close: %w", orderID, err)
    }
    return nil
    // No access to other buckets — PoLP at the code level
}

// ANTI-PATTERN: one API key for all operations
// If this token leaks → full access to every feature

const apiKey = "sk_live_example_never_use_this_in_production"
// Used for: read users, write users, read orders, write orders,
//           read reports, send notifications, admin panel access

// CORRECT: tokens with scopes limited to the caller's needs

// Defining the available scopes
type Scope string

const (
    ScopeOrderRead    Scope = "order:read"
    ScopeOrderWrite   Scope = "order:write"
    ScopeUserRead     Scope = "user:read"
    ScopeUserWrite    Scope = "user:write"
    ScopeReportRead   Scope = "report:read"
    ScopeAdminAccess  Scope = "admin:*"
)

// A token store with per-token scopes
type APIToken struct {
    ID        string
    Hash      string    // bcrypt hash of the token value
    OwnerID   string
    Scopes    []Scope
    ExpiresAt time.Time
    CreatedAt time.Time
    LastUsedAt *time.Time
}

// Tokens issued matching client needs:
// Mobile app → [order:read, order:write, user:read]
// Analytics dashboard → [order:read, report:read]
// Admin panel → [admin:*]
// Webhook receiver → [order:read] — only needs read for verification

// Middleware that enforces scopes
func RequireScope(required Scope) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            token, ok := tokenFromContext(r.Context())
            if !ok {
                http.Error(w, "unauthorized", http.StatusUnauthorized)
                return
            }

            if !token.HasScope(required) {
                // Log access attempts without the right scope — could be an anomaly
                slog.Warn("scope violation attempt",
                    "token_id", token.ID,
                    "required_scope", required,
                    "token_scopes", token.Scopes,
                    "path", r.URL.Path,
                )
                http.Error(w, "insufficient scope", http.StatusForbidden)
                return
            }

            next.ServeHTTP(w, r)
        })
    }
}

func (t APIToken) HasScope(required Scope) bool {
    for _, s := range t.Scopes {
        if s == required || s == ScopeAdminAccess {
            return true
        }
        // Wildcard scope matching: "order:*" covers "order:read" and "order:write"
        if strings.HasSuffix(string(s), ":*") {
            prefix := strings.TrimSuffix(string(s), ":*")
            if strings.HasPrefix(string(required), prefix+":") {
                return true
            }
        }
    }
    return false
}

// Routing with scope enforcement
router.Get("/api/v1/orders", RequireScope(ScopeOrderRead)(listOrdersHandler))
router.Post("/api/v1/orders", RequireScope(ScopeOrderWrite)(createOrderHandler))
router.Get("/api/v1/reports/revenue", RequireScope(ScopeReportRead)(revenueReportHandler))
router.Get("/api/v1/admin/users", RequireScope(ScopeAdminAccess)(adminUserListHandler))

// Defining roles and permissions in the domain
type Role string
type Permission string

const (
    RoleCustomer Role = "customer"
    RoleMerchant Role = "merchant"
    RoleSupport  Role = "support"
    RoleAdmin    Role = "admin"
)

const (
    PermViewOwnOrders    Permission = "order:view:own"
    PermViewAllOrders    Permission = "order:view:all"
    PermCreateOrder      Permission = "order:create"
    PermCancelOwnOrder   Permission = "order:cancel:own"
    PermCancelAnyOrder   Permission = "order:cancel:any"
    PermViewProducts     Permission = "product:view"
    PermManageProducts   Permission = "product:manage"
    PermViewUsers        Permission = "user:view"
    PermManageUsers      Permission = "user:manage"
    PermViewReports      Permission = "report:view"
    PermRefundOrder      Permission = "order:refund"
)

// Permission matrix — the SSOT for per-role access definitions
var rolePermissions = map[Role][]Permission{
    RoleCustomer: {
        PermViewOwnOrders,
        PermCreateOrder,
        PermCancelOwnOrder,
        PermViewProducts,
    },
    RoleMerchant: {
        PermViewOwnOrders,
        PermViewAllOrders,  // merchants can see all orders in their store
        PermManageProducts,
        PermViewReports,
    },
    RoleSupport: {
        PermViewAllOrders,
        PermCancelAnyOrder,
        PermRefundOrder,
        PermViewUsers,
        PermViewProducts,
    },
    RoleAdmin: {
        PermViewAllOrders,
        PermCancelAnyOrder,
        PermRefundOrder,
        PermViewUsers,
        PermManageUsers,
        PermManageProducts,
        PermViewReports,
    },
    // Admin doesn't implicitly get every permission —
    // it has explicitly defined permissions
    // This matters: if a new permission is added, admin doesn't
    // automatically get it until explicitly added — an intentional security decision
}

type Authorizer struct {
    rolePerms map[Role][]Permission
}

func NewAuthorizer() *Authorizer {
    return &Authorizer{rolePerms: rolePermissions}
}

func (a *Authorizer) Can(role Role, perm Permission) bool {
    perms, ok := a.rolePerms[role]
    if !ok {
        return false
    }
    for _, p := range perms {
        if p == perm {
            return true
        }
    }
    return false
}

// Authorization middleware with resource ownership checks
func (a *Authorizer) RequirePermission(perm Permission) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            user, ok := userFromContext(r.Context())
            if !ok {
                http.Error(w, "unauthorized", http.StatusUnauthorized)
                return
            }

            if !a.Can(user.Role, perm) {
                slog.Warn("authorization denied",
                    "user_id", user.ID,
                    "role", user.Role,
                    "permission", perm,
                    "path", r.URL.Path,
                )
                http.Error(w, "forbidden", http.StatusForbidden)
                return
            }

            next.ServeHTTP(w, r)
        })
    }
}

// Ownership check — customers can only access their own resources
func (h *OrderHandler) GetOrder(w http.ResponseWriter, r *http.Request) {
    currentUser := userFromContext(r.Context())
    orderID := r.PathValue("id")

    order, err := h.service.GetOrder(r.Context(), orderID)
    if err != nil {
        if errors.Is(err, order.ErrNotFound) {
            http.Error(w, "order not found", http.StatusNotFound)
        } else {
            http.Error(w, "internal error", http.StatusInternalServerError)
        }
        return
    }

    // Ownership check: customers may only view their own orders
    // Support and Admin may view all (already checked in middleware)
    if currentUser.Role == RoleCustomer && order.UserID != currentUser.ID {
        // Don't expose that the order exists — return 404 not 403
        // to avoid information leakage
        http.Error(w, "order not found", http.StatusNotFound)
        return
    }

    writeSuccess(w, http.StatusOK, order)
}

// Router setup with RBAC
auth := NewAuthorizer()

router.Get("/api/v1/orders",
    auth.RequirePermission(PermViewAllOrders)(listAllOrdersHandler))
router.Get("/api/v1/orders/my",
    auth.RequirePermission(PermViewOwnOrders)(listMyOrdersHandler))
router.Post("/api/v1/orders",
    auth.RequirePermission(PermCreateOrder)(createOrderHandler))
router.Post("/api/v1/orders/{id}/refund",
    auth.RequirePermission(PermRefundOrder)(refundOrderHandler))
router.Get("/api/v1/admin/users",
    auth.RequirePermission(PermManageUsers)(adminUserListHandler))

// ANTI-PATTERN: secrets in environment variables readable by every process
// or in config files committed to the repository

// ✗ Hardcoded secrets
const paymentAPIKey = "sk_live_example_never_use_this_in_production" // in git history forever

// ✗ Secrets in env vars without encryption or rotation
// DATABASE_URL=postgres://user:***@host/db
// copied to all servers without an audit trail

// ✗ One secret for every environment
// The same key for development, staging, and production

// CORRECT: secret management following PoLP

// Each service can only access its own secrets
// GCP Secret Manager with per-secret IAM bindings:
//
// secret: payment-api-key
//   accessor: [email protected] (roles/secretmanager.secretAccessor)
//
// secret: database-dsn
//   accessor: [email protected] (roles/secretmanager.secretAccessor)
//
// secret: smtp-password
//   accessor: [email protected]
//
// The Order Service CANNOT access smtp-password — no IAM binding

type SecretManager struct {
    client    *secretmanager.Client
    projectID string
}

func (sm *SecretManager) GetSecret(ctx context.Context, name string) (string, error) {
    // Format: projects/{project}/secrets/{secret}/versions/latest
    secretName := fmt.Sprintf("projects/%s/secrets/%s/versions/latest", sm.projectID, name)

    result, err := sm.client.AccessSecretVersion(ctx,
        &secretmanagerpb.AccessSecretVersionRequest{Name: secretName},
    )
    if err != nil {
        return "", fmt.Errorf("get secret %q: %w", name, err)
    }

    return string(result.Payload.Data), nil
}

// Startup: fetch all required secrets once
func initSecrets(ctx context.Context, sm *SecretManager) (*Secrets, error) {
    paymentKey, err := sm.GetSecret(ctx, "payment-api-key")
    if err != nil {
        return nil, fmt.Errorf("init secrets: payment key: %w", err)
    }

    dbDSN, err := sm.GetSecret(ctx, "database-dsn")
    if err != nil {
        return nil, fmt.Errorf("init secrets: database dsn: %w", err)
    }

    return &Secrets{
        PaymentAPIKey: paymentKey,
        DatabaseDSN:   dbDSN,
    }, nil
}

// Secrets are never logged or exposed in responses
type Secrets struct {
    PaymentAPIKey string
    DatabaseDSN   string
}

// A safe Stringer — won't expose secrets if accidentally printed
func (s Secrets) String() string {
    return "Secrets{PaymentAPIKey: *** DatabaseDSN: [REDACTED]}"
}

// ANTI-PATTERN: service communication without authentication
// Every service on the internal network can call every other service
// "If it's already inside the network, it must be safe"

func callUserService(userID string) (*User, error) {
    resp, err := http.Get("http://user-service/users/" + userID)
    // No authentication — anyone on the network can call this
    if err != nil {
        return nil, err
    }
    // ...
}

// CORRECT: mutual TLS or service tokens for service-to-service auth

// Approach 1: JWT service tokens with audience claims
type ServiceToken struct {
    Issuer   string   // "order-service"
    Audience string   // "user-service" — the token is only valid for this service
    Scopes   []string // ["user:read"] — the minimal permissions needed
    IssuedAt time.Time
    Expiry   time.Time
}

// The Order Service calls the User Service with a specific token
type UserServiceClient struct {
    baseURL    string
    httpClient *http.Client
    tokenSrc   TokenSource // gets tokens for calling user-service
}

func (c *UserServiceClient) GetUser(ctx context.Context, userID string) (*User, error) {
    // Get a token with audience "user-service" and minimal scopes
    token, err := c.tokenSrc.Token(ctx, TokenRequest{
        Audience: "user-service",
        Scopes:   []string{"user:read"}, // read only, no write needed
    })
    if err != nil {
        return nil, fmt.Errorf("get service token: %w", err)
    }

    req, err := http.NewRequestWithContext(ctx,
        http.MethodGet,
        fmt.Sprintf("%s/internal/users/%s", c.baseURL, userID),
        nil,
    )
    if err != nil {
        return nil, err
    }

    req.Header.Set("Authorization", "Bearer "+token.Value)
    req.Header.Set("X-Service-Name", "order-service") // for audit logs

    resp, err := c.httpClient.Do(req)
    if err != nil {
        return nil, fmt.Errorf("call user service: %w", err)
    }
    defer resp.Body.Close()

    if resp.StatusCode == http.StatusForbidden {
        return nil, ErrServiceNotAuthorized
    }
    // ...
}

// The User Service validates that the caller is an allowed service
func ServiceAuthMiddleware(allowedServices []string) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            token := extractBearerToken(r)
            claims, err := validateServiceToken(token)
            if err != nil {
                http.Error(w, "unauthorized", http.StatusUnauthorized)
                return
            }

            // Check whether the issuer (calling service) is allowed
            allowed := false
            for _, svc := range allowedServices {
                if claims.Issuer == svc {
                    allowed = true
                    break
                }
            }

            if !allowed {
                slog.Warn("unauthorized service call",
                    "issuer", claims.Issuer,
                    "allowed", allowedServices,
                    "path", r.URL.Path,
                )
                http.Error(w, "forbidden", http.StatusForbidden)
                return
            }

            next.ServeHTTP(w, r)
        })
    }
}

// Internal endpoints are only for service-to-service
router.Get("/internal/users/{id}",
    ServiceAuthMiddleware([]string{"order-service", "notification-service"})(
        internalGetUserHandler,
    ),
)

// Audit middleware — every access to sensitive resources is recorded
type AuditEvent struct {
    Timestamp  time.Time `json:"timestamp"`
    ActorID    string    `json:"actor_id"`
    ActorRole  string    `json:"actor_role"`
    Action     string    `json:"action"`
    Resource   string    `json:"resource"`
    ResourceID string    `json:"resource_id"`
    Allowed    bool      `json:"allowed"`
    IPAddress  string    `json:"ip_address"`
    TraceID    string    `json:"trace_id"`
}

type AuditLogger struct {
    logger *slog.Logger
}

func (a *AuditLogger) Log(ctx context.Context, event AuditEvent) {
    event.Timestamp = time.Now()
    a.logger.InfoContext(ctx, "audit",
        "actor_id", event.ActorID,
        "actor_role", event.ActorRole,
        "action", event.Action,
        "resource", event.Resource,
        "resource_id", event.ResourceID,
        "allowed", event.Allowed,
        "ip_address", event.IPAddress,
        "trace_id", event.TraceID,
    )
}

func AuditMiddleware(audit *AuditLogger, action, resource string) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            user, _ := userFromContext(r.Context())

            rec := &statusRecorder{ResponseWriter: w, status: http.StatusOK}
            next.ServeHTTP(rec, r)

            audit.Log(r.Context(), AuditEvent{
                ActorID:    user.ID,
                ActorRole:  string(user.Role),
                Action:     action,
                Resource:   resource,
                ResourceID: r.PathValue("id"),
                Allowed:    rec.status != http.StatusForbidden,
                IPAddress:  r.RemoteAddr,
                TraceID:    traceIDFromContext(r.Context()),
            })
        })
    }
}

// Sensitive endpoints with audit
router.Post("/api/v1/orders/{id}/refund",
    auth.RequirePermission(PermRefundOrder)(
        AuditMiddleware(auditLogger, "refund", "order")(
            refundHandler,
        ),
    ),
)

// ANTI-PATTERN: requesting every permission when the app first opens
class MainActivity extends AppCompatActivity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        // Request all permissions at once — the user doesn't know why
        requestPermissions(new String[]{
                Manifest.permission.CAMERA,
                Manifest.permission.RECORD_AUDIO,
                Manifest.permission.ACCESS_FINE_LOCATION,
                Manifest.permission.READ_CONTACTS,
                Manifest.permission.READ_EXTERNAL_STORAGE,
                Manifest.permission.POST_NOTIFICATIONS,
        }, REQUEST_CODE_ALL_PERMISSIONS);
        // The user is immediately suspicious: "Why does a shopping app need my microphone?"
    }
}

// CORRECT: request permissions only when truly needed,
// with contextual explanation

class OrderService {
    private final Activity activity;

    OrderService(Activity activity) {
        this.activity = activity;
    }

    // Camera permission only requested when the user wants to scan a barcode
    void scanBarcode() {
        if (ContextCompat.checkSelfPermission(activity, Manifest.permission.CAMERA)
                != PackageManager.PERMISSION_GRANTED) {
            // Explain why before requesting
            showPermissionRationale(
                    "Camera Access",
                    "The camera is needed to scan product barcodes.",
                    this::requestCameraPermission);
        } else {
            // Only scan the barcode after permission is granted
            doScanBarcode();
        }
    }

    private void requestCameraPermission() {
        // Pseudo-callback: invoked when the OS resolves the permission dialog
        onCameraPermissionResult(granted -> {
            if (!granted) {
                throw new SecurityException(
                        "Camera permission is required for barcode scanning");
            }
            // Only scan the barcode after permission is granted
            doScanBarcode();
        });
        activity.requestPermissions(new String[]{Manifest.permission.CAMERA}, REQUEST_CAMERA);
    }
}

// ANTI-PATTERN: storing an access token with no expiry in local storage
// getSharedPreferences("auth", MODE_PRIVATE).edit()
//     .putString("auth_token", fullAccessToken).apply()
// The token never expires, stored as plain text

// CORRECT: tokens with minimal scopes, short expiry, and secure storage
class TokenStorage {
    // Encrypted on the Android Keystore via EncryptedSharedPreferences
    private final SharedPreferences prefs;

    TokenStorage(Context context) {
        MasterKey masterKey = new MasterKey.Builder(context)
                .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
                .build();
        prefs = EncryptedSharedPreferences.create(
                context,
                "secure_prefs",
                masterKey,
                EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
                EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM);
    }

    // Store the access token (short-lived) and refresh token (long-lived)
    // separately, with automatic refresh mechanisms
    void saveTokens(String accessToken, String refreshToken) {
        prefs.edit()
                .putString("access_token", accessToken)   // expires in 15 minutes
                .putString("refresh_token", refreshToken) // expires in 30 days
                .apply();
    }

    String getAccessToken() {
        return prefs.getString("access_token", null);
    }

    void clearTokens() {
        prefs.edit()
                .remove("access_token")
                .remove("refresh_token")
                .apply();
    }
}

// ✗ Database users with every privilege
GRANT ALL PRIVILEGES ON DATABASE myapp TO app_user;

// ✗ Service accounts with Editor/Owner roles
// roles/editor → can access and modify nearly every resource

// ✗ Tokens without scopes or expiry
token := jwt.New(jwt.SigningMethodHS256)
// No exp claim, no scope — valid forever for everything

// ✗ Admin roles implicitly getting every permission including new ones
// "Admin can do everything" — new permissions automatically enter admin without review

// ✗ Secrets in environment variables readable by every process
os.Getenv("DATABASE_PASSWORD") // available to all code in this process

// ✗ Service-to-service without authentication
http.Get("http://user-service/users/" + id) // no auth header

// ✗ Missed ownership checks — a customer can read another user's orders
func getOrder(w http.ResponseWriter, r *http.Request) {
    orderID := r.PathValue("id")
    order, _ := repo.FindByID(orderID)
    // No check whether order.UserID == currentUser.ID
    writeSuccess(w, 200, order) // information leakage!
}

// ✗ Device permissions requested before there's context
// Requesting the camera when the app first opens, not when scanning is needed