Backend Authorization — Implementing Authorization and Access Control

// ACL-based authorization
class AccessControlList {
  constructor() {
    this.permissions = new Map();
  }

  grant(role, resource, actions) {
    const key = `${role}:${resource}`;
    this.permissions.set(key, new Set([
      ...(this.permissions.get(key) || []),
      ...actions
    ]));
  }

  check(role, resource, action) {
    const key = `${role}:${resource}`;
    const allowed = this.permissions.get(key);
    return allowed?.has(action) || allowed?.has('*') || false;
  }
}

// RBAC implementation
const acl = new AccessControlList();

acl.grant('admin', 'scan', ['create', 'read', 'update', 'delete', '*']);
acl.grant('operator', 'scan', ['create', 'read']);
acl.grant('viewer', 'scan', ['read']);
acl.grant('admin', 'user', ['create', 'read', 'update', 'delete']);

function authorize(resource, action) {
  return (req, res, next) => {
    if (!req.user?.role) {
      return res.status(401).json({ error: 'Not authenticated' });
    }

    if (!acl.check(req.user.role, resource, action)) {
      return res.status(403).json({
        error: 'FORBIDDEN',
        message: `Missing ${action} permission on ${resource}`
      });
    }

    next();
  };
}

// Usage
app.post('/api/scans', authorize('scan', 'create'), scanHandler);
app.get('/api/scans', authorize('scan', 'read'), listScansHandler);
app.delete('/api/admin/users/:id', authorize('user', 'delete'), deleteUserHandler);

// Resource-based authorization
function authorizeResource(resourceFn) {
  return async (req, res, next) => {
    const resource = await resourceFn(req);
    if (!resource) return res.status(404).json({ error: 'Resource not found' });

    if (resource.userId !== req.user.id && req.user.role !== 'admin') {
      return res.status(403).json({ error: 'Not authorized for this resource' });
    }

    req.resource = resource;
    next();
  };
}

app.get('/api/scans/:id',
  authorizeResource(async (req) => scanService.findById(req.params.id)),
  scanDetailHandler
);