Restful Authorization

# Scope-based authorization
from functools import wraps

def require_scope(scope):
    def decorator(f):
        @wraps(f)
        def wrapper(*args, **kwargs):
            if scope not in getattr(request, 'token_scopes', []):
                return jsonify({"error": "Insufficient permissions"}), 403
            return f(*args, **kwargs)
        return wrapper
    return decorator

SCOPES = {
    'users:read': 'View user information',
    'users:write': 'Create and update users',
    'users:delete': 'Delete users',
    'orders:read': 'View orders',
    'orders:write': 'Create orders',
}

@app.route('/users')
@require_scope('users:read')
def list_users():
    return jsonify([u.to_dict() for u in db.get_users()])

@app.route('/users', methods=['POST'])
@require_scope('users:write')
def create_user():
    return jsonify(db.create_user(request.json)), 201

# Role-based access control
class RBAC:
    ROLES = {
        'admin': ['users:read', 'users:write', 'users:delete', 'orders:read', 'orders:write'],
        'manager': ['users:read', 'orders:read', 'orders:write'],
        'user': ['orders:read', 'orders:write'],
    }

    @staticmethod
    def check_permission(role, permission):
        return permission in RBAC.ROLES.get(role, [])

# Resource-level authorization
@app.route('/orders/<int:id>')
def get_order(id):
    order = db.get_order(id)
    if not order:
        return jsonify({"error": "Order not found"}), 404

    # Check resource ownership
    user_id = getattr(request, 'user_id', None)
    if order.user_id != user_id and not RBAC.check_permission(request.user_role, 'orders:read'):
        return jsonify({"error": "Access denied"}), 403

    return jsonify(order.to_dict())

// Scope middleware
function requireScope(scope) {
  return (req, res, next) => {
    if (!req.user || !req.user.scopes.includes(scope)) {
      return res.status(403).json({
        error: 'Insufficient permissions',
        required: scope
      });
    }
    next();
  };
}

app.get('/api/users', requireScope('users:read'), (req, res) => {
  res.json(db.getUsers());
});

app.post('/api/users', requireScope('users:write'), (req, res) => {
  res.status(201).json(db.createUser(req.body));
});