Principle of Least Privilege #

-- ANTI-PATTERN: aplikasi menggunakan superuser atau user dengan hak berlebihan
-- Credential ini jika bocor → attacker bisa lakukan apa saja ke database

-- Jangan lakukan ini:
CREATE USER app_user WITH PASSWORD 'secret' SUPERUSER;
-- atau
GRANT ALL PRIVILEGES ON DATABASE myapp TO app_user;

-- BENAR: buat user terpisah per use case, dengan privilege minimal

-- 1. User untuk aplikasi utama (baca + tulis data)
CREATE USER app_writer WITH PASSWORD 'strong_random_password_here';
GRANT CONNECT ON DATABASE myapp TO app_writer;
GRANT USAGE ON SCHEMA public TO app_writer;
-- Hanya tabel yang dibutuhkan, hanya operasi yang dibutuhkan
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE
    users, orders, order_items, products, sessions
    TO app_writer;
-- Untuk sequence (auto increment ID)
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO app_writer;

-- 2. User untuk read-only (reporting, analytics, background job yang hanya baca)
CREATE USER app_reader WITH PASSWORD 'another_strong_password';
GRANT CONNECT ON DATABASE myapp TO app_reader;
GRANT USAGE ON SCHEMA public TO app_reader;
GRANT SELECT ON TABLE
    users, orders, order_items, products
    TO app_reader;
-- Tidak bisa INSERT, UPDATE, DELETE, DROP — sama sekali tidak bisa

-- 3. User untuk migration (hanya dipakai saat deploy, bukan saat runtime)
CREATE USER app_migrator WITH PASSWORD 'migration_password';
GRANT CONNECT ON DATABASE myapp TO app_migrator;
GRANT USAGE, CREATE ON SCHEMA public TO app_migrator;
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO app_migrator;
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO app_migrator;
-- User ini hanya dipakai oleh migration tool, tidak oleh aplikasi runtime
-- Credential-nya dirotasi setelah setiap deployment

-- 4. Pastikan privilege default untuk tabel baru juga terbatas
ALTER DEFAULT PRIVILEGES IN SCHEMA public
    GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO app_writer;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
    GRANT SELECT ON TABLES TO app_reader;

// Pisahkan koneksi berdasarkan privilege yang diperlukan
type Database struct {
    writer   *sql.DB // app_writer — untuk operasi tulis
    reader   *sql.DB // app_reader — untuk operasi baca
}

func NewDatabase(writerDSN, readerDSN string) (*Database, error) {
    writer, err := sql.Open("postgres", writerDSN)
    if err != nil {
        return nil, fmt.Errorf("open writer connection: %w", err)
    }

    reader, err := sql.Open("postgres", readerDSN)
    if err != nil {
        return nil, fmt.Errorf("open reader connection: %w", err)
    }

    return &Database{writer: writer, reader: reader}, nil
}

type OrderRepository struct {
    db *Database
}

// Operasi tulis → gunakan writer connection
func (r *OrderRepository) Save(ctx context.Context, order Order) error {
    _, err := r.db.writer.ExecContext(ctx,
        "INSERT INTO orders (id, user_id, total, status) VALUES ($1, $2, $3, $4)",
        order.ID, order.UserID, order.Total, order.Status,
    )
    if err != nil {
        return fmt.Errorf("save order: %w", err)
    }
    return nil
}

// Operasi baca → gunakan reader connection (least privilege)
func (r *OrderRepository) ListByUserID(ctx context.Context, userID string) ([]Order, error) {
    rows, err := r.db.reader.QueryContext(ctx,
        "SELECT id, user_id, total, status, created_at FROM orders WHERE user_id = $1",
        userID,
    )
    if err != nil {
        return nil, fmt.Errorf("list orders: %w", err)
    }
    defer rows.Close()
    // ... scan rows
    return orders, nil
}

// Di Go, gunakan workload identity atau service account yang sudah terkonfigurasi
// Jangan hardcode credential di kode — biarkan platform inject otomatis

// ANTI-PATTERN: credential hardcoded atau di environment variable yang terlalu broad
func newStorageClient() (*storage.Client, error) {
    // JSON key file di disk = credential yang bisa dicuri, tidak pernah dirotasi otomatis
    return storage.NewClient(ctx,
        option.WithCredentialsFile("/path/to/service-account-key.json"),
    )
}

// BENAR: Application Default Credentials — platform inject identity secara otomatis
// Di GKE: Workload Identity → pod dapat identity SA secara otomatis
// Di Cloud Run: service account di-bind saat deploy
// Di VM: metadata server menyediakan token secara otomatis
func newStorageClient(ctx context.Context) (*storage.Client, error) {
    // Tidak ada credential eksplisit — gunakan ADC
    // Platform yang memastikan service ini hanya punya akses yang dikonfigurasi
    client, err := storage.NewClient(ctx)
    if err != nil {
        return nil, fmt.Errorf("create storage client: %w", err)
    }
    return client, nil
}

// Akses hanya bucket yang spesifik — bukan semua bucket
func (s *FileService) UploadOrderDocument(
    ctx context.Context,
    orderID string,
    data []byte,
) error {
    bucket := s.storage.Bucket(s.orderDocumentBucket) // bucket spesifik
    obj := bucket.Object(fmt.Sprintf("orders/%s/document.pdf", orderID))

    writer := obj.NewWriter(ctx)
    if _, err := writer.Write(data); err != nil {
        return fmt.Errorf("upload document %s: write: %w", orderID, err)
    }
    if err := writer.Close(); err != nil {
        return fmt.Errorf("upload document %s: close: %w", orderID, err)
    }
    return nil
    // Tidak ada akses ke bucket lain — PoLP di level kode
}

// ANTI-PATTERN: satu API key untuk semua operasi
// Token ini jika bocor → akses penuh ke semua fitur

const apiKey = "sk_live_everything_full_access"
// Digunakan untuk: baca user, tulis user, baca order, tulis order,
//                 baca laporan, kirim notifikasi, akses admin panel

// BENAR: token dengan scope yang terbatas sesuai kebutuhan caller

// Definisi scope yang tersedia
type Scope string

const (
    ScopeOrderRead    Scope = "order:read"
    ScopeOrderWrite   Scope = "order:write"
    ScopeUserRead     Scope = "user:read"
    ScopeUserWrite    Scope = "user:write"
    ScopeReportRead   Scope = "report:read"
    ScopeAdminAccess  Scope = "admin:*"
)

// Token store dengan scope per token
type APIToken struct {
    ID        string
    Hash      string    // bcrypt hash dari token value
    OwnerID   string
    Scopes    []Scope
    ExpiresAt time.Time
    CreatedAt time.Time
    LastUsedAt *time.Time
}

// Token yang diterbitkan sesuai kebutuhan client:
// Mobile app → [order:read, order:write, user:read]
// Analytics dashboard → [order:read, report:read]
// Admin panel → [admin:*]
// Webhook receiver → [order:read] — hanya perlu baca untuk verifikasi

// Middleware yang enforce scope
func RequireScope(required Scope) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            token, ok := tokenFromContext(r.Context())
            if !ok {
                http.Error(w, "unauthorized", http.StatusUnauthorized)
                return
            }

            if !token.HasScope(required) {
                // Log upaya akses tanpa scope yang benar — bisa jadi anomali
                slog.Warn("scope violation attempt",
                    "token_id", token.ID,
                    "required_scope", required,
                    "token_scopes", token.Scopes,
                    "path", r.URL.Path,
                )
                http.Error(w, "insufficient scope", http.StatusForbidden)
                return
            }

            next.ServeHTTP(w, r)
        })
    }
}

func (t APIToken) HasScope(required Scope) bool {
    for _, s := range t.Scopes {
        if s == required || s == ScopeAdminAccess {
            return true
        }
        // Wildcard scope matching: "order:*" mencakup "order:read" dan "order:write"
        if strings.HasSuffix(string(s), ":*") {
            prefix := strings.TrimSuffix(string(s), ":*")
            if strings.HasPrefix(string(required), prefix+":") {
                return true
            }
        }
    }
    return false
}

// Routing dengan scope enforcement
router.Get("/api/v1/orders", RequireScope(ScopeOrderRead)(listOrdersHandler))
router.Post("/api/v1/orders", RequireScope(ScopeOrderWrite)(createOrderHandler))
router.Get("/api/v1/reports/revenue", RequireScope(ScopeReportRead)(revenueReportHandler))
router.Get("/api/v1/admin/users", RequireScope(ScopeAdminAccess)(adminUserListHandler))

// Definisi role dan permission di domain
type Role string
type Permission string

const (
    RoleCustomer Role = "customer"
    RoleMerchant Role = "merchant"
    RoleSupport  Role = "support"
    RoleAdmin    Role = "admin"
)

const (
    PermViewOwnOrders    Permission = "order:view:own"
    PermViewAllOrders    Permission = "order:view:all"
    PermCreateOrder      Permission = "order:create"
    PermCancelOwnOrder   Permission = "order:cancel:own"
    PermCancelAnyOrder   Permission = "order:cancel:any"
    PermViewProducts     Permission = "product:view"
    PermManageProducts   Permission = "product:manage"
    PermViewUsers        Permission = "user:view"
    PermManageUsers      Permission = "user:manage"
    PermViewReports      Permission = "report:view"
    PermRefundOrder      Permission = "order:refund"
)

// Permission matrix — SSOT untuk definisi akses per role
var rolePermissions = map[Role][]Permission{
    RoleCustomer: {
        PermViewOwnOrders,
        PermCreateOrder,
        PermCancelOwnOrder,
        PermViewProducts,
    },
    RoleMerchant: {
        PermViewOwnOrders,
        PermViewAllOrders,  // merchant bisa lihat semua order di toko mereka
        PermManageProducts,
        PermViewReports,
    },
    RoleSupport: {
        PermViewAllOrders,
        PermCancelAnyOrder,
        PermRefundOrder,
        PermViewUsers,
        PermViewProducts,
    },
    RoleAdmin: {
        PermViewAllOrders,
        PermCancelAnyOrder,
        PermRefundOrder,
        PermViewUsers,
        PermManageUsers,
        PermManageProducts,
        PermViewReports,
    },
    // Admin tidak dapat semua permission secara implisit —
    // ia punya permission yang terdefinisi secara eksplisit
    // Ini penting: jika ada permission baru, admin tidak otomatis mendapatkannya
    // sampai ditambahkan secara eksplisit — intentional security decision
}

type Authorizer struct {
    rolePerms map[Role][]Permission
}

func NewAuthorizer() *Authorizer {
    return &Authorizer{rolePerms: rolePermissions}
}

func (a *Authorizer) Can(role Role, perm Permission) bool {
    perms, ok := a.rolePerms[role]
    if !ok {
        return false
    }
    for _, p := range perms {
        if p == perm {
            return true
        }
    }
    return false
}

// Middleware authorization dengan resource ownership check
func (a *Authorizer) RequirePermission(perm Permission) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            user, ok := userFromContext(r.Context())
            if !ok {
                http.Error(w, "unauthorized", http.StatusUnauthorized)
                return
            }

            if !a.Can(user.Role, perm) {
                slog.Warn("authorization denied",
                    "user_id", user.ID,
                    "role", user.Role,
                    "permission", perm,
                    "path", r.URL.Path,
                )
                http.Error(w, "forbidden", http.StatusForbidden)
                return
            }

            next.ServeHTTP(w, r)
        })
    }
}

// Ownership check — customer hanya bisa akses resource miliknya
func (h *OrderHandler) GetOrder(w http.ResponseWriter, r *http.Request) {
    currentUser := userFromContext(r.Context())
    orderID := r.PathValue("id")

    order, err := h.service.GetOrder(r.Context(), orderID)
    if err != nil {
        if errors.Is(err, order.ErrNotFound) {
            http.Error(w, "order not found", http.StatusNotFound)
        } else {
            http.Error(w, "internal error", http.StatusInternalServerError)
        }
        return
    }

    // Ownership check: customer hanya boleh lihat order miliknya
    // Support dan Admin boleh lihat semua (sudah dicek di middleware)
    if currentUser.Role == RoleCustomer && order.UserID != currentUser.ID {
        // Jangan expose bahwa order ada — return 404 bukan 403
        // untuk menghindari information leakage
        http.Error(w, "order not found", http.StatusNotFound)
        return
    }

    writeSuccess(w, http.StatusOK, order)
}

// Router setup dengan RBAC
auth := NewAuthorizer()

router.Get("/api/v1/orders",
    auth.RequirePermission(PermViewAllOrders)(listAllOrdersHandler))
router.Get("/api/v1/orders/my",
    auth.RequirePermission(PermViewOwnOrders)(listMyOrdersHandler))
router.Post("/api/v1/orders",
    auth.RequirePermission(PermCreateOrder)(createOrderHandler))
router.Post("/api/v1/orders/{id}/refund",
    auth.RequirePermission(PermRefundOrder)(refundOrderHandler))
router.Get("/api/v1/admin/users",
    auth.RequirePermission(PermManageUsers)(adminUserListHandler))

// ANTI-PATTERN: secret di environment variable yang bisa diakses semua proses
// atau di config file yang di-commit ke repository

// ✗ Secret hardcoded
const paymentAPIKey = "sk_live_abc123xyz" // masuk ke git history selamanya

// ✗ Secret di env var tanpa enkripsi atau rotation
// DATABASE_URL=postgres://user:plaintext_password@host/db
// di-copy ke semua server tanpa audit trail

// ✗ Satu secret untuk semua environment
// Key yang sama untuk development, staging, dan production

// BENAR: secret management yang mengikuti PoLP

// Setiap service hanya bisa akses secret miliknya sendiri
// GCP Secret Manager dengan IAM binding per secret:
//
// secret: payment-api-key
//   accessor: [email protected] (roles/secretmanager.secretAccessor)
//
// secret: database-dsn
//   accessor: [email protected] (roles/secretmanager.secretAccessor)
//
// secret: smtp-password
//   accessor: [email protected]
//
// Order Service TIDAK bisa akses smtp-password — tidak ada binding IAM

type SecretManager struct {
    client    *secretmanager.Client
    projectID string
}

func (sm *SecretManager) GetSecret(ctx context.Context, name string) (string, error) {
    // Format: projects/{project}/secrets/{secret}/versions/latest
    secretName := fmt.Sprintf("projects/%s/secrets/%s/versions/latest", sm.projectID, name)

    result, err := sm.client.AccessSecretVersion(ctx,
        &secretmanagerpb.AccessSecretVersionRequest{Name: secretName},
    )
    if err != nil {
        return "", fmt.Errorf("get secret %q: %w", name, err)
    }

    return string(result.Payload.Data), nil
}

// Startup: ambil semua secret yang diperlukan satu kali
func initSecrets(ctx context.Context, sm *SecretManager) (*Secrets, error) {
    paymentKey, err := sm.GetSecret(ctx, "payment-api-key")
    if err != nil {
        return nil, fmt.Errorf("init secrets: payment key: %w", err)
    }

    dbDSN, err := sm.GetSecret(ctx, "database-dsn")
    if err != nil {
        return nil, fmt.Errorf("init secrets: database dsn: %w", err)
    }

    return &Secrets{
        PaymentAPIKey: paymentKey,
        DatabaseDSN:   dbDSN,
    }, nil
}

// Secret tidak pernah di-log atau di-expose di response
type Secrets struct {
    PaymentAPIKey string
    DatabaseDSN   string
}

// Stringer yang aman — tidak akan expose secret jika di-print secara tidak sengaja
func (s Secrets) String() string {
    return "Secrets{PaymentAPIKey: [REDACTED], DatabaseDSN: [REDACTED]}"
}

// ANTI-PATTERN: service communication tanpa autentikasi
// Semua service di internal network bisa panggil semua service lain
// "Kalau sudah di dalam network, pasti aman"

func callUserService(userID string) (*User, error) {
    resp, err := http.Get("http://user-service/users/" + userID)
    // Tidak ada autentikasi — siapapun di network bisa panggil ini
    if err != nil {
        return nil, err
    }
    // ...
}

// BENAR: mutual TLS atau service token untuk service-to-service auth

// Pendekatan 1: JWT service token dengan audience claim
type ServiceToken struct {
    Issuer   string   // "order-service"
    Audience string   // "user-service" — token hanya valid untuk service ini
    Scopes   []string // ["user:read"] — permission minimal yang diperlukan
    IssuedAt time.Time
    Expiry   time.Time
}

// Order Service memanggil User Service dengan token yang spesifik
type UserServiceClient struct {
    baseURL    string
    httpClient *http.Client
    tokenSrc   TokenSource // mendapat token untuk memanggil user-service
}

func (c *UserServiceClient) GetUser(ctx context.Context, userID string) (*User, error) {
    // Dapatkan token dengan audience "user-service" dan scope minimal
    token, err := c.tokenSrc.Token(ctx, TokenRequest{
        Audience: "user-service",
        Scopes:   []string{"user:read"}, // hanya read, tidak butuh write
    })
    if err != nil {
        return nil, fmt.Errorf("get service token: %w", err)
    }

    req, err := http.NewRequestWithContext(ctx,
        http.MethodGet,
        fmt.Sprintf("%s/internal/users/%s", c.baseURL, userID),
        nil,
    )
    if err != nil {
        return nil, err
    }

    req.Header.Set("Authorization", "Bearer "+token.Value)
    req.Header.Set("X-Service-Name", "order-service") // untuk audit log

    resp, err := c.httpClient.Do(req)
    if err != nil {
        return nil, fmt.Errorf("call user service: %w", err)
    }
    defer resp.Body.Close()

    if resp.StatusCode == http.StatusForbidden {
        return nil, ErrServiceNotAuthorized
    }
    // ...
}

// User Service memvalidasi bahwa caller adalah service yang diizinkan
func ServiceAuthMiddleware(allowedServices []string) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            token := extractBearerToken(r)
            claims, err := validateServiceToken(token)
            if err != nil {
                http.Error(w, "unauthorized", http.StatusUnauthorized)
                return
            }

            // Cek apakah issuer (caller service) diizinkan
            allowed := false
            for _, svc := range allowedServices {
                if claims.Issuer == svc {
                    allowed = true
                    break
                }
            }

            if !allowed {
                slog.Warn("unauthorized service call",
                    "issuer", claims.Issuer,
                    "allowed", allowedServices,
                    "path", r.URL.Path,
                )
                http.Error(w, "forbidden", http.StatusForbidden)
                return
            }

            next.ServeHTTP(w, r)
        })
    }
}

// Internal endpoint hanya untuk service-to-service
router.Get("/internal/users/{id}",
    ServiceAuthMiddleware([]string{"order-service", "notification-service"})(
        internalGetUserHandler,
    ),
)

// Audit middleware — setiap akses ke resource sensitif dicatat
type AuditEvent struct {
    Timestamp  time.Time `json:"timestamp"`
    ActorID    string    `json:"actor_id"`
    ActorRole  string    `json:"actor_role"`
    Action     string    `json:"action"`
    Resource   string    `json:"resource"`
    ResourceID string    `json:"resource_id"`
    Allowed    bool      `json:"allowed"`
    IPAddress  string    `json:"ip_address"`
    TraceID    string    `json:"trace_id"`
}

type AuditLogger struct {
    logger *slog.Logger
}

func (a *AuditLogger) Log(ctx context.Context, event AuditEvent) {
    event.Timestamp = time.Now()
    a.logger.InfoContext(ctx, "audit",
        "actor_id", event.ActorID,
        "actor_role", event.ActorRole,
        "action", event.Action,
        "resource", event.Resource,
        "resource_id", event.ResourceID,
        "allowed", event.Allowed,
        "ip_address", event.IPAddress,
        "trace_id", event.TraceID,
    )
}

func AuditMiddleware(audit *AuditLogger, action, resource string) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            user, _ := userFromContext(r.Context())

            rec := &statusRecorder{ResponseWriter: w, status: http.StatusOK}
            next.ServeHTTP(rec, r)

            audit.Log(r.Context(), AuditEvent{
                ActorID:    user.ID,
                ActorRole:  string(user.Role),
                Action:     action,
                Resource:   resource,
                ResourceID: r.PathValue("id"),
                Allowed:    rec.status != http.StatusForbidden,
                IPAddress:  r.RemoteAddr,
                TraceID:    traceIDFromContext(r.Context()),
            })
        })
    }
}

// Endpoint sensitif dengan audit
router.Post("/api/v1/orders/{id}/refund",
    auth.RequirePermission(PermRefundOrder)(
        AuditMiddleware(auditLogger, "refund", "order")(
            refundHandler,
        ),
    ),
)

// ANTI-PATTERN: minta semua permission saat app pertama kali dibuka
class App extends StatefulWidget {
    @override
    void initState() {
        super.initState();
        // Minta semua permission sekaligus — user tidak tahu untuk apa
        _requestAllPermissions();
    }

    Future<void> _requestAllPermissions() async {
        await [
            Permission.camera,
            Permission.microphone,
            Permission.location,
            Permission.contacts,
            Permission.storage,
            Permission.notification,
        ].request();
        // User langsung skeptis: "Kenapa butuh mikrofon untuk app belanja?"
    }
}

// BENAR: minta permission hanya saat benar-benar dibutuhkan,
// dengan penjelasan yang kontekstual

class OrderService {
    // Permission kamera hanya diminta saat user mau scan barcode
    Future<void> scanBarcode() async {
        final status = await Permission.camera.status;
        if (status.isDenied) {
            // Jelaskan mengapa sebelum minta
            final shouldRequest = await _showPermissionRationale(
                title: 'Akses Kamera',
                message: 'Kamera diperlukan untuk memindai barcode produk.',
            );
            if (!shouldRequest) return;

            final result = await Permission.camera.request();
            if (!result.isGranted) {
                throw PermissionDeniedException('Camera permission is required for barcode scanning');
            }
        }
        // Baru scan barcode setelah permission diberikan
        await _doScanBarcode();
    }
}

// ANTI-PATTERN: simpan token akses tanpa expiry di local storage
// SharedPreferences.setString('auth_token', fullAccessToken)
// Token tidak pernah expired, disimpan sebagai plain text

// BENAR: token dengan scope minimal, expiry yang singkat, dan penyimpanan aman
class TokenStorage {
    static const _storage = FlutterSecureStorage(
        // Enkripsi di iOS Keychain dan Android Keystore
        aOptions: AndroidOptions(encryptedSharedPreferences: true),
    );

    // Simpan access token (short-lived) dan refresh token (long-lived)
    // terpisah, dengan mekanisme refresh yang otomatis
    Future<void> saveTokens({
        required String accessToken,  // expires in 15 minutes
        required String refreshToken, // expires in 30 days
    }) async {
        await Future.wait([
            _storage.write(key: 'access_token', value: accessToken),
            _storage.write(key: 'refresh_token', value: refreshToken),
        ]);
    }

    Future<String?> getAccessToken() async {
        return _storage.read(key: 'access_token');
    }

    Future<void> clearTokens() async {
        await Future.wait([
            _storage.delete(key: 'access_token'),
            _storage.delete(key: 'refresh_token'),
        ]);
    }
}

// ✗ Database user dengan semua privilege
GRANT ALL PRIVILEGES ON DATABASE myapp TO app_user;

// ✗ Service account dengan Editor/Owner role
// roles/editor → bisa akses dan modifikasi hampir semua resource

// ✗ Token tanpa scope atau expiry
token := jwt.New(jwt.SigningMethodHS256)
// Tidak ada exp claim, tidak ada scope — valid selamanya untuk segalanya

// ✗ Admin role yang implisit mendapat semua permission termasuk yang baru
// "Admin bisa segalanya" — permission baru otomatis masuk ke admin tanpa review

// ✗ Secret di environment variable yang bisa dibaca semua proses
os.Getenv("DATABASE_PASSWORD") // tersedia untuk semua kode di proses ini

// ✗ Service-to-service tanpa autentikasi
http.Get("http://user-service/users/" + id) // tidak ada auth header

// ✗ Ownership check yang terlewat — customer bisa baca order user lain
func getOrder(w http.ResponseWriter, r *http.Request) {
    orderID := r.PathValue("id")
    order, _ := repo.FindByID(orderID)
    // Tidak cek apakah order.UserID == currentUser.ID
    writeSuccess(w, 200, order) // information leakage!
}

// ✗ Permission device diminta sebelum ada konteks
// Minta kamera saat app pertama dibuka, bukan saat butuh scan