Authorization #

// A clean, extensible RBAC implementation
type Permission string

const (
    ArticlesRead      Permission = "articles:read"
    ArticlesCreate    Permission = "articles:create"
    ArticlesEditOwn   Permission = "articles:edit_own"
    ArticlesEditAny   Permission = "articles:edit_any"
    ArticlesDeleteOwn Permission = "articles:delete_own"
    ArticlesDeleteAny Permission = "articles:delete_any"
    ArticlesPublish   Permission = "articles:publish"

    UsersRead   Permission = "users:read"
    UsersManage Permission = "users:manage"

    AdminAccess Permission = "admin:access"
)

// Role definitions — single source of truth
var rolePermissions = map[string]map[Permission]bool{
    "viewer": {
        ArticlesRead: true,
        UsersRead:    true,
    },
    "author": {
        ArticlesRead:      true,
        ArticlesCreate:    true,
        ArticlesEditOwn:   true,
        ArticlesDeleteOwn: true,
        UsersRead:         true,
    },
    "editor": {
        ArticlesRead:      true,
        ArticlesCreate:    true,
        ArticlesEditOwn:   true,
        ArticlesEditAny:   true,
        ArticlesDeleteOwn: true,
        ArticlesPublish:   true,
        UsersRead:         true,
    },
    "admin": allPermissions(), // all permissions
}

// allPermissions: every known permission (equivalent of "p for p in Permission")
func allPermissions() map[Permission]bool {
    return map[Permission]bool{
        ArticlesRead: true, ArticlesCreate: true, ArticlesEditOwn: true,
        ArticlesEditAny: true, ArticlesDeleteOwn: true, ArticlesDeleteAny: true,
        ArticlesPublish: true, UsersRead: true, UsersManage: true, AdminAccess: true,
    }
}

func getUserPermissions(user User) map[Permission]bool {
    // Collect all permissions from all of the user's roles
    permissions := map[Permission]bool{}
    for _, role := range user.Roles {
        for p := range rolePermissions[role] {
            permissions[p] = true
        }
    }
    return permissions
}

func hasPermission(user User, permission Permission) bool {
    return getUserPermissions(user)[permission]
}

// Middleware for endpoints
func requirePermission(permission Permission) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            if !currentUser(r).IsAuthenticated {
                writeJSON(w, http.StatusUnauthorized,
                    map[string]string{"error": "Authentication required"})
                return
            }
            if !hasPermission(currentUser(r), permission) {
                writeJSON(w, http.StatusForbidden,
                    map[string]string{"error": "Insufficient permissions"})
                return
            }
            next.ServeHTTP(w, r)
        })
    }
}

// Usage on endpoints
http.Handle("/admin/users", requirePermission(UsersManage)(http.HandlerFunc(
    func(w http.ResponseWriter, r *http.Request) {
        writeJSON(w, http.StatusOK, listUsers())
    })))

http.Handle("/articles", requirePermission(ArticlesCreate)(http.HandlerFunc(
    func(w http.ResponseWriter, r *http.Request) {
        // ...
    })))

// ABAC — decisions based on attributes, not just roles
func canAccessDocument(user User, doc Document, action string, ctx map[string]any) (bool, string) {
    // Evaluate whether the user can perform the action on the document
    // based on attribute combinations.
    if ctx == nil {
        ctx = map[string]any{}
    }

    // Policy: confidential documents can only be read by
    // users from the same department or manager level and above
    if doc.Classification == "confidential" && action == "read" {
        if user.Department != doc.Department {
            if user.Level < "manager" {
                return false, "Confidential documents are restricted to the department"
            }
        }
    }

    // Policy: documents can only be edited by owners or editors
    if action == "edit" {
        if user.ID != doc.OwnerID {
            if !contains(user.Roles, "editor") {
                return false, "Only owners or editors can edit"
            }
        }
    }

    // Policy: no one can delete published documents
    // except admins
    if action == "delete" && doc.Status == "published" {
        if !contains(user.Roles, "admin") {
            return false, "Published documents can't be deleted"
        }
    }

    // Policy: access outside working hours is only for non-sensitive documents
    if hour, ok := ctx["hour"].(int); ok && (hour < 8 || hour > 18) {
        if doc.Classification == "confidential" || doc.Classification == "restricted" {
            return false, "Sensitive documents can't be accessed outside working hours"
        }
    }

    return true, ""
}

// ANTI-PATTERN: allow by default (allow unless something forbids)
func canAccess(user User, resource Resource) bool {
    if user.IsBanned {
        return false
    }
    if resource.IsPrivate && user.ID != resource.OwnerID {
        return false
    }
    return true // default: allow
}

// Problem: if a new condition isn't handled (new resource,
// new role, new status), the default is to ALLOW.
// A new bug → a new security hole

// CORRECT: deny by default
func canAccessSafe(user User, resource Resource) bool {
    // Only allow if an explicit condition permits it
    if resource.IsPublic {
        return true
    }
    if user.ID == resource.OwnerID {
        return true
    }
    if contains(user.Roles, "admin") {
        return true
    }
    if resource.SharedWith != nil && contains(resource.SharedWith, user.ID) {
        return true
    }
    return false // default: DENY
}

// With deny by default:
// New resources without rules → automatically denied
// New unconfigured roles → no access at all
// New bugs → fail secure, not fail open

// ANTI-PATTERN: no ownership validation
// GET /orders/{orderID}
func getOrder(w http.ResponseWriter, r *http.Request) {
    orderID := parseID(r)
    order := findOrderByID(orderID)
    writeJSON(w, http.StatusOK, order)
    // Users can access anyone's orders just by changing order_id:
    // GET /orders/1001 → GET /orders/1002 → GET /orders/1003
}

// A subtler ANTI-PATTERN: only checking roles, not ownership
// PUT /orders/{orderID}
func updateOrder(w http.ResponseWriter, r *http.Request) {
    orderID := parseID(r)
    order := findOrderByID(orderID)
    // The EDIT_OWN permission exists, but no check whether this is THEIR order!
    applyOrderUpdate(order, r)
    writeJSON(w, http.StatusOK, order)
}

// CORRECT: explicitly validate ownership
func getOrderSafe(w http.ResponseWriter, r *http.Request) {
    orderID := parseID(r)
    order := findOrderByID(orderID)

    // Check ownership BEFORE returning data
    if order.UserID != currentUser(r).ID {
        // Admins can see everything — check whether the user is an admin
        if !hasPermission(currentUser(r), PermissionOrdersReadAny) {
            http.Error(w, "Forbidden — this isn't yours", http.StatusForbidden)
            return
        }
    }
    writeJSON(w, http.StatusOK, order)
}

// A cleaner pattern: scoped queries
func getOrderScoped(w http.ResponseWriter, r *http.Request) {
    orderID := parseID(r)
    var order *Order
    if hasPermission(currentUser(r), PermissionOrdersReadAny) {
        order = findOrderByID(orderID)
    } else {
        // The query is already scoped by user_id — getting someone else's order is impossible
        order = findOrderByIDAndUser(orderID, currentUser(r).ID)
    }
    writeJSON(w, http.StatusOK, order)
}

// Scoped API key implementation
type APIKey struct {
    ID         int
    KeyHash    string
    Name       string
    UserID     int
    Scopes     []string // ["read:orders", "write:orders"]
    ExpiresAt  time.Time
    LastUsedAt time.Time
    CreatedAt  time.Time
}

func validateAPIKeyScope(apiKey APIKey, requiredScope string) bool {
    // Check whether the API key has the required scope.
    if !apiKey.ExpiresAt.IsZero() && apiKey.ExpiresAt.Before(time.Now()) {
        return false
    }

    // Exact match or wildcard
    prefix := strings.Split(requiredScope, ":")[0] + ":*"
    for _, scope := range apiKey.Scopes {
        if scope == requiredScope || scope == "*" || scope == prefix {
            return true
        }
    }
    return false
}

// Middleware for endpoints requiring a specific scope
func requireAPIScope(scope string) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            apiKey := getCurrentAPIKey(r)
            if apiKey == nil {
                writeJSON(w, http.StatusUnauthorized,
                    map[string]string{"error": "API key required"})
                return
            }
            if !validateAPIKeyScope(*apiKey, scope) {
                writeJSON(w, http.StatusForbidden,
                    map[string]string{"error": "Missing required scope: " + scope})
                return
            }
            next.ServeHTTP(w, r)
        })
    }
}

// Usage on endpoints
// http.Handle("/api/orders", requireAPIScope("read:orders")(http.HandlerFunc(
//     func(w http.ResponseWriter, r *http.Request) {
//         // Only API keys with the "read:orders" or "read:*" scope can access
//     })))

// A reusable ownership validation abstraction
type ResourceAccessPolicy interface {
    CanRead(user User, resource any) bool
    CanEdit(user User, resource any) bool
    CanDelete(user User, resource any) bool
}

type ArticleAccessPolicy struct{}

func (ArticleAccessPolicy) CanRead(user User, article *Article) bool {
    if article.Status == "published" {
        return true // published articles are readable by anyone
    }
    return article.AuthorID == user.ID || hasPermission(user, PermissionArticlesEditAny)
}

func (ArticleAccessPolicy) CanEdit(user User, article *Article) bool {
    if hasPermission(user, PermissionArticlesEditAny) {
        return true
    }
    if hasPermission(user, PermissionArticlesEditOwn) {
        return article.AuthorID == user.ID
    }
    return false
}

func (ArticleAccessPolicy) CanDelete(user User, article *Article) bool {
    if hasPermission(user, PermissionArticlesDeleteAny) {
        return true
    }
    if hasPermission(user, PermissionArticlesDeleteOwn) {
        return article.AuthorID == user.ID
    }
    return false
}

func (ArticleAccessPolicy) CanPublish(user User, article *Article) bool {
    return hasPermission(user, PermissionArticlesPublish)
}

// Policy registry
var policies = map[reflect.Type]ResourceAccessPolicy{
    reflect.TypeOf(Article{}): ArticleAccessPolicy{},
}

func authorize(user User, resource any, action string) bool {
    // Check whether the user can perform the action on the resource.
    policy, ok := policies[reflect.TypeOf(resource)]
    if !ok {
        return false // Deny by default if no policy exists
    }

    switch action {
    case "read":
        return policy.CanRead(user, resource)
    case "edit":
        return policy.CanEdit(user, resource)
    case "delete":
        return policy.CanDelete(user, resource)
    default:
        return false // Unknown action → deny
    }
}

// Usage on endpoints
// PUT /articles/{articleID}
func updateArticle(w http.ResponseWriter, r *http.Request) {
    article := findArticleByID(parseID(r))

    if !authorize(currentUser(r), article, "edit") {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }

    applyArticleUpdate(article, r)
    writeJSON(w, http.StatusOK, article)
}

// ANTI-PATTERN: an endpoint letting users change their own roles
// PUT /users/{userID}
func updateUser(w http.ResponseWriter, r *http.Request) {
    userID := parseID(r)
    if userID != currentUser(r).ID {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }

    user := findUserByID(userID)
    applyUserUpdate(user, r) // ← users can send {"roles": ["admin"]}!
    saveUser(user)
    writeJSON(w, http.StatusOK, user)
}

// CORRECT: explicitly restrict which fields users can change
func updateUserSafe(w http.ResponseWriter, r *http.Request) {
    userID := parseID(r)
    if userID != currentUser(r).ID {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }

    user := findUserByID(userID)

    // Whitelist the fields regular users may change
    allowedFields := map[string]bool{"name": true, "bio": true,
        "avatar_url": true, "preferences": true}
    updateData := filterFields(body(r), allowedFields)

    // Sensitive fields can only be changed by admins
    if hasPermission(currentUser(r), PermissionUsersManage) {
        sensitiveFields := map[string]bool{"roles": true,
            "is_active": true, "email_verified": true}
        updateData = merge(updateData, filterFields(body(r), sensitiveFields))
    }

    applyUserUpdate(user, updateData)
    saveUser(user)
    writeJSON(w, http.StatusOK, user)
}

import "log/slog"

var securityLogger = slog.Default().With("logger", "security.authorization")

func logAuthorizationDecision(
    userID int,
    action, resourceType, resourceID string,
    granted bool,
    reason string,
) {
    // Log every authorization decision.
    securityLogger.Info("Authorization decision",
        "user_id", userID,
        "action", action,
        "resource_type", resourceType,
        "resource_id", resourceID,
        "granted", granted,
        "reason", reason,
        "timestamp", time.Now().UTC().Format(time.RFC3339),
        "request_id", gRequestID,
        "ip", remoteIP,
    )
}

// Example usage in a policy
func (ArticleAccessPolicy) CanDelete(user User, article *Article) bool {
    if hasPermission(user, PermissionArticlesDeleteAny) {
        logAuthorizationDecision(user.ID, "delete", "article", article.ID, true,
            "has articles:delete_any permission")
        return true
    }

    if hasPermission(user, PermissionArticlesDeleteOwn) && article.AuthorID == user.ID {
        logAuthorizationDecision(user.ID, "delete", "article", article.ID, true,
            "owner with articles:delete_own permission")
        return true
    }

    logAuthorizationDecision(user.ID, "delete", "article", article.ID, false,
        "insufficient permission")
    return false
}

// ✗ Anti-pattern 1: authorization only in the frontend
// A frontend-only role check (e.g. hiding buttons or routes) can be
// bypassed by manipulating the client.
// JavaScript can be manipulated → change the role in the console → access the admin panel
// Backends must ALWAYS validate authorization, not just frontends

// ✗ Anti-pattern 2: guessable IDs without ownership checks
// GET /invoices/{invoiceID}/pdf
func downloadInvoice(w http.ResponseWriter, r *http.Request) {
    invoice := findInvoiceByID(parseID(r))
    sendFile(w, invoice.PDFPath)
    // Users can try /invoices/1, /invoices/2, /invoices/3 to download every invoice
}

// ✓ Solution: validate ownership OR use signed URLs
func downloadInvoiceSafe(w http.ResponseWriter, r *http.Request) {
    // only this user's invoices
    invoice := findInvoiceByIDAndUser(parseID(r), currentUser(r).ID)
    sendFile(w, invoice.PDFPath)
}

// ────────────────────────────────────────────────────────────────────────────

// ✗ Anti-pattern 3: inconsistent permission checks across places
// In controller A: check whether the user is the owner
// In controller B (different endpoint, same resource): forgot the check
// → IDOR in controller B

// ✓ Solution: centralize authorization in policy objects or services
// Authorization logic lives in ONE place — every endpoint uses it

// ────────────────────────────────────────────────────────────────────────────

// ✗ Anti-pattern 4: soft deletes not filtered in authorization
// GET /articles/{articleID}
func getArticle(w http.ResponseWriter, r *http.Request) {
    article := findArticleByID(parseID(r))
    // Deleted articles (soft delete) are still accessible!
    writeJSON(w, http.StatusOK, article)
}

// ✓ Solution: filter soft-deleted records
// article := findArticleByIDAndDeletedAt(parseID(r), nil) // only non-deleted articles

// ────────────────────────────────────────────────────────────────────────────

// ✗ Anti-pattern 5: no rate limiting on authorization-failing endpoints
// Attackers can mass-probe IDOR without detection:
// for i in range(1, 1000000): GET /orders/{i}

// ✓ Solution: log and rate limit based on the number of 403 responses per user