Паттерны авторизации

@Configuration
@EnableRedisHttpSession(maxInactiveIntervalInSeconds = 86400)
public class SessionConfig {

    @Bean
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer s = new DefaultCookieSerializer();
        s.setCookieName("SESSION");
        s.setCookiePath("/");
        s.setUseHttpOnlyCookie(true);
        s.setUseSecureCookie(true);
        s.setSameSite("Lax");
        return s;
    }
}

// go.sum: github.com/gorilla/sessions, github.com/rbcervilla/redisstore/v9

var store *redisstore.RedisStore

func initSessionStore(rdb *redis.Client) {
    var err error
    store, err = redisstore.NewRedisStore(context.Background(), rdb)
    if err != nil {
        log.Fatal(err)
    }
    store.Options(sessions.Options{
        Path:     "/",
        MaxAge:   86400,
        HttpOnly: true,
        Secure:   true,
        SameSite: http.SameSiteLaxMode,
    })
}

func loginHandler(w http.ResponseWriter, r *http.Request) {
    session, _ := store.Get(r, "SESSION")
    session.Values["userId"] = 42
    session.Values["roles"] = []string{"ADMIN"}
    session.Save(r, w)
    w.WriteHeader(http.StatusOK)
}

// npm: express-session, connect-redis, ioredis

import session from "express-session";
import RedisStore from "connect-redis";
import { Redis } from "ioredis";

const redisClient = new Redis(process.env.REDIS_URL);

app.use(
  session({
    store: new RedisStore({ client: redisClient }),
    name: "SESSION",
    secret: process.env.SESSION_SECRET!,
    resave: false,
    saveUninitialized: false,
    cookie: {
      httpOnly: true,
      secure: true,
      sameSite: "lax",
      maxAge: 86_400_000,
      path: "/",
    },
  })
);

app.post("/login", (req, res) => {
  req.session.userId = 42;
  req.session.roles = ["ADMIN"];
  res.sendStatus(200);
});

# pip: fastapi, redis, itsdangerous (через starlette SessionMiddleware)

from starlette.middleware.sessions import SessionMiddleware
from starlette.requests import Request
import redis.asyncio as aioredis

# SessionMiddleware хранит сессию в подписанной cookie;
# для Redis-бэкенда используют starsessions или подобное.
app.add_middleware(
    SessionMiddleware,
    secret_key=settings.SESSION_SECRET,
    session_cookie="SESSION",
    max_age=86_400,
    https_only=True,
    same_site="lax",
)

@app.post("/login")
async def login(request: Request):
    request.session["userId"] = 42
    request.session["roles"] = ["ADMIN"]
    return {"ok": True}

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .csrf(AbstractHttpConfigurer::disable)
            .oauth2Login(oauth2 -> oauth2
                .authorizationEndpoint(auth -> auth
                    .authorizationRequestResolver(pkceResolver()))
                .successHandler(new RedirectToSpaHandler("/dashboard")))
            .logout(logout -> logout
                .logoutUrl("/logout")
                .logoutSuccessHandler(new RedirectToSpaHandler("/")))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/**").permitAll()
                .anyRequest().authenticated())
            .build();
    }

    private OAuth2AuthorizationRequestResolver pkceResolver() {
        var resolver = new DefaultOAuth2AuthorizationRequestResolver(
            clientRegistrationRepository, "/oauth2/authorization");
        resolver.setAuthorizationRequestCustomizer(
            OAuth2AuthorizationRequestCustomizers.withPkce());
        return resolver;
    }
}

// go.sum: golang.org/x/oauth2, github.com/gorilla/sessions

import (
    "crypto/rand"
    "crypto/sha256"
    "encoding/base64"
    "golang.org/x/oauth2"
)

var oauthConfig = &oauth2.Config{
    ClientID:     os.Getenv("CLIENT_ID"),
    ClientSecret: os.Getenv("CLIENT_SECRET"),
    Scopes:       []string{"openid", "profile", "email", "offline_access"},
    Endpoint: oauth2.Endpoint{
        AuthURL:  "https://keycloak.example.com/realms/my-realm/protocol/openid-connect/auth",
        TokenURL: "https://keycloak.example.com/realms/my-realm/protocol/openid-connect/token",
    },
    RedirectURL: "https://app.example.com/callback",
}

func loginHandler(w http.ResponseWriter, r *http.Request) {
    verifier := generateVerifier()
    challenge := s256Challenge(verifier)
    session, _ := store.Get(r, "SESSION")
    session.Values["pkce_verifier"] = verifier
    session.Save(r, w)
    url := oauthConfig.AuthCodeURL("state",
        oauth2.SetAuthURLParam("code_challenge", challenge),
        oauth2.SetAuthURLParam("code_challenge_method", "S256"),
    )
    http.Redirect(w, r, url, http.StatusFound)
}

func callbackHandler(w http.ResponseWriter, r *http.Request) {
    session, _ := store.Get(r, "SESSION")
    verifier := session.Values["pkce_verifier"].(string)
    token, _ := oauthConfig.Exchange(r.Context(), r.URL.Query().Get("code"),
        oauth2.SetAuthURLParam("code_verifier", verifier))
    session.Values["access_token"] = token.AccessToken
    session.Values["refresh_token"] = token.RefreshToken
    session.Save(r, w)
    http.Redirect(w, r, "/dashboard", http.StatusFound)
}

func generateVerifier() string {
    b := make([]byte, 32)
    rand.Read(b)
    return base64.RawURLEncoding.EncodeToString(b)
}

func s256Challenge(verifier string) string {
    h := sha256.Sum256([]byte(verifier))
    return base64.RawURLEncoding.EncodeToString(h[:])
}

// npm: openid-client@6, express-session

import {
  discovery,
  buildAuthorizationUrl,
  authorizationCodeGrant,
  randomPKCECodeVerifier,
  calculatePKCECodeChallenge,
  randomState,
  type Configuration,
} from "openid-client";
import { Router } from "express";

const router = Router();
let oidcConfig: Configuration;

async function initOidcClient() {
  oidcConfig = await discovery(
    new URL("https://keycloak.example.com/realms/my-realm"),
    process.env.CLIENT_ID!,
    process.env.CLIENT_SECRET!
  );
}

router.get("/oauth2/login", async (req, res) => {
  const codeVerifier = randomPKCECodeVerifier();
  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);
  const state = randomState();
  req.session.codeVerifier = codeVerifier;
  req.session.state = state;
  const url = buildAuthorizationUrl(oidcConfig, {
    redirect_uri: "https://app.example.com/callback",
    scope: "openid profile email offline_access",
    code_challenge: codeChallenge,
    code_challenge_method: "S256",
    state,
  });
  res.redirect(url.href);
});

router.get("/callback", async (req, res) => {
  const tokens = await authorizationCodeGrant(
    oidcConfig,
    new URL(`https://app.example.com${req.url}`),
    { pkceCodeVerifier: req.session.codeVerifier, expectedState: req.session.state }
  );
  req.session.accessToken = tokens.access_token;
  req.session.refreshToken = tokens.refresh_token;
  res.redirect("/dashboard");
});

# pip: authlib, httpx, fastapi, itsdangerous

from authlib.integrations.starlette_client import OAuth
from starlette.requests import Request
from starlette.responses import RedirectResponse

oauth = OAuth()
oauth.register(
    name="keycloak",
    client_id=settings.CLIENT_ID,
    client_secret=settings.CLIENT_SECRET,
    server_metadata_url=(
        "https://keycloak.example.com/realms/my-realm"
        "/.well-known/openid-configuration"
    ),
    client_kwargs={"scope": "openid profile email offline_access"},
)

@app.get("/oauth2/login")
async def login(request: Request):
    redirect_uri = request.url_for("callback")
    return await oauth.keycloak.authorize_redirect(
        request, redirect_uri, code_challenge_method="S256"
    )

@app.get("/callback")
async def callback(request: Request):
    token = await oauth.keycloak.authorize_access_token(request)
    request.session["access_token"] = token["access_token"]
    request.session["refresh_token"] = token.get("refresh_token")
    return RedirectResponse("/dashboard")

@Component
@RequiredArgsConstructor
public class JwtCookieFilter extends OncePerRequestFilter {

    private final JwtDecoder jwtDecoder;

    @Override
    protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain)
            throws ServletException, IOException {

        String token = extractTokenFromCookie(req, "TOKEN");
        if (token != null) {
            try {
                Jwt jwt = jwtDecoder.decode(token);
                List<GrantedAuthority> authorities = jwt.getClaimAsStringList("roles").stream()
                    .map(role -> new SimpleGrantedAuthority("ROLE_" + role))
                    .toList();
                var auth = new JwtAuthenticationToken(jwt, authorities);
                SecurityContextHolder.getContext().setAuthentication(auth);
            } catch (JwtException e) {
                SecurityContextHolder.clearContext();
            }
        }
        chain.doFilter(req, res);
    }

    private String extractTokenFromCookie(HttpServletRequest req, String name) {
        if (req.getCookies() == null) return null;
        return Arrays.stream(req.getCookies())
            .filter(c -> name.equals(c.getName()))
            .findFirst()
            .map(Cookie::getValue)
            .orElse(null);
    }
}

// go.sum: github.com/golang-jwt/jwt/v5

import (
    "net/http"
    "github.com/golang-jwt/jwt/v5"
)

type Claims struct {
    Sub   string   `json:"sub"`
    Roles []string `json:"roles"`
    jwt.RegisteredClaims
}

func JwtCookieMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        cookie, err := r.Cookie("TOKEN")
        if err != nil {
            next.ServeHTTP(w, r)
            return
        }
        claims := &Claims{}
        _, err = jwt.ParseWithClaims(cookie.Value, claims, func(t *jwt.Token) (any, error) {
            return jwtPublicKey, nil
        })
        if err != nil {
            next.ServeHTTP(w, r)
            return
        }
        ctx := context.WithValue(r.Context(), principalKey{}, claims)
        next.ServeHTTP(w, r.WithContext(ctx))
    })
}

// npm: jsonwebtoken, @types/jsonwebtoken

import { RequestHandler } from "express";
import jwt from "jsonwebtoken";

interface JwtPayload {
  sub: string;
  roles: string[];
}

export const jwtCookieMiddleware: RequestHandler = (req, res, next) => {
  const token: string | undefined = req.cookies?.TOKEN;
  if (!token) return next();

  try {
    const payload = jwt.verify(token, process.env.JWT_PUBLIC_KEY!, {
      algorithms: ["RS256"],
    }) as JwtPayload;
    (req as any).principal = { userId: payload.sub, roles: payload.roles };
  } catch {
    // невалидный токен — продолжаем без авторизации
  }
  next();
};

# pip: python-jose[cryptography], fastapi

from jose import jwt, JWTError
from fastapi import Request
from dataclasses import dataclass

@dataclass
class Principal:
    user_id: str
    roles: list[str]

async def jwt_cookie_middleware(request: Request, call_next):
    token = request.cookies.get("TOKEN")
    if token:
        try:
            payload = jwt.decode(
                token,
                settings.JWT_PUBLIC_KEY,
                algorithms=["RS256"],
            )
            request.state.principal = Principal(
                user_id=payload["sub"],
                roles=payload.get("roles", []),
            )
        except JWTError:
            pass
    return await call_next(request)

@Component
@RequiredArgsConstructor
public class OpaqueTokenAuthProvider implements AuthenticationProvider {

    private final AuthServerClient authClient;

    @Override
    public Authentication authenticate(Authentication authentication) {
        String token = (String) authentication.getCredentials();
        UserInfo userInfo = authClient.getUserInfo(token);

        if (userInfo == null || userInfo.getSub() == null) {
            throw new BadCredentialsException("Invalid token");
        }

        UserPrincipal principal = UserPrincipal.builder()
            .userId(userInfo.getSub())
            .email(userInfo.getEmail())
            .name(userInfo.getName())
            .build();

        return new OpaqueAuthenticationToken(principal, token, Collections.emptyList());
    }
}

// go.sum: net/http (stdlib)

type UserInfo struct {
    Sub   string `json:"sub"`
    Email string `json:"email"`
    Name  string `json:"name"`
}

type UserPrincipal struct {
    UserID string
    Email  string
    Name   string
}

func AuthenticateOpaqueToken(ctx context.Context, token string, authServerURL string) (*UserPrincipal, error) {
    req, _ := http.NewRequestWithContext(ctx, http.MethodGet, authServerURL+"/userinfo", nil)
    req.Header.Set("Authorization", "Bearer "+token)
    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        return nil, err
    }
    defer resp.Body.Close()
    if resp.StatusCode != http.StatusOK {
        return nil, errors.New("invalid token")
    }
    var info UserInfo
    if err := json.NewDecoder(resp.Body).Decode(&info); err != nil {
        return nil, err
    }
    if info.Sub == "" {
        return nil, errors.New("missing sub claim")
    }
    return &UserPrincipal{UserID: info.Sub, Email: info.Email, Name: info.Name}, nil
}

// npm: node-fetch или встроенный fetch (Node 18+)

interface UserInfo {
  sub: string;
  email: string;
  name: string;
}

interface UserPrincipal {
  userId: string;
  email: string;
  name: string;
}

async function authenticateOpaqueToken(
  token: string,
  authServerUrl: string
): Promise<UserPrincipal> {
  const res = await fetch(`${authServerUrl}/userinfo`, {
    headers: { Authorization: `Bearer ${token}` },
  });
  if (!res.ok) throw new Error("Invalid token");
  const info: UserInfo = await res.json();
  if (!info.sub) throw new Error("Missing sub claim");
  return { userId: info.sub, email: info.email, name: info.name };
}

// Middleware
export const opaqueTokenMiddleware: RequestHandler = async (req, res, next) => {
  const token = req.headers.authorization?.replace("Bearer ", "");
  if (!token) return res.sendStatus(401);
  try {
    (req as any).principal = await authenticateOpaqueToken(
      token,
      process.env.AUTH_SERVER_URL!
    );
    next();
  } catch {
    res.sendStatus(401);
  }
};

# pip: httpx, fastapi

import httpx
from dataclasses import dataclass
from fastapi import Request, HTTPException, status
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials

@dataclass
class UserPrincipal:
    user_id: str
    email: str
    name: str

bearer = HTTPBearer()

async def authenticate_opaque_token(
    credentials: HTTPAuthorizationCredentials = Depends(bearer),
) -> UserPrincipal:
    async with httpx.AsyncClient() as client:
        resp = await client.get(
            f"{settings.AUTH_SERVER_URL}/userinfo",
            headers={"Authorization": f"Bearer {credentials.credentials}"},
        )
    if resp.status_code != 200:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED)
    info = resp.json()
    if not info.get("sub"):
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED)
    return UserPrincipal(
        user_id=info["sub"], email=info["email"], name=info["name"]
    )

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .csrf(AbstractHttpConfigurer::disable)
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .oauth2ResourceServer(oauth2 ->
                oauth2.jwt(jwt -> jwt.jwtAuthenticationConverter(jwtAuthConverter())))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/**").permitAll()
                .anyRequest().authenticated())
            .build();
    }

    private JwtAuthenticationConverter jwtAuthConverter() {
        JwtGrantedAuthoritiesConverter rolesConverter = new JwtGrantedAuthoritiesConverter();
        rolesConverter.setAuthoritiesClaimName("realm_access.roles");
        rolesConverter.setAuthorityPrefix("ROLE_");
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(rolesConverter);
        return converter;
    }
}

// go.sum: github.com/golang-jwt/jwt/v5, net/http (stdlib для JWKS)

import (
    "github.com/golang-jwt/jwt/v5"
    "github.com/MicahParks/keyfunc/v3"
)

var jwks *keyfunc.JWKS

func initJwks(jwksURL string) {
    var err error
    jwks, err = keyfunc.NewDefault([]string{jwksURL})
    if err != nil {
        log.Fatal(err)
    }
}

type Claims struct {
    Sub         string   `json:"sub"`
    RealmAccess struct {
        Roles []string `json:"roles"`
    } `json:"realm_access"`
    jwt.RegisteredClaims
}

func JwtBearerMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        header := r.Header.Get("Authorization")
        if !strings.HasPrefix(header, "Bearer ") {
            http.Error(w, "Unauthorized", http.StatusUnauthorized)
            return
        }
        tokenStr := strings.TrimPrefix(header, "Bearer ")
        claims := &Claims{}
        _, err := jwt.ParseWithClaims(tokenStr, claims, jwks.Keyfunc)
        if err != nil {
            http.Error(w, "Unauthorized", http.StatusUnauthorized)
            return
        }
        ctx := context.WithValue(r.Context(), principalKey{}, claims)
        next.ServeHTTP(w, r.WithContext(ctx))
    })
}

// npm: jose

import { createRemoteJWKSet, jwtVerify } from "jose";
import { RequestHandler } from "express";

const JWKS = createRemoteJWKSet(
  new URL(
    "https://keycloak.example.com/realms/my-realm/protocol/openid-connect/certs"
  )
);

export const jwtBearerMiddleware: RequestHandler = async (req, res, next) => {
  const header = req.headers.authorization;
  if (!header?.startsWith("Bearer ")) return res.sendStatus(401);
  try {
    const { payload } = await jwtVerify(header.slice(7), JWKS, {
      issuer: "https://keycloak.example.com/realms/my-realm",
    });
    (req as any).principal = {
      userId: payload.sub,
      roles: (payload as any).realm_access?.roles ?? [],
    };
    next();
  } catch {
    res.sendStatus(401);
  }
};

# pip: PyJWT[crypto], fastapi

import jwt
from jwt import PyJWKClient, PyJWTError
from functools import lru_cache

JWKS_URL = (
    "https://keycloak.example.com/realms/my-realm"
    "/protocol/openid-connect/certs"
)

@lru_cache
def jwks_client() -> PyJWKClient:
    return PyJWKClient(JWKS_URL)

async def jwt_bearer(request: Request) -> UserPrincipal:
    header = request.headers.get("Authorization", "")
    if not header.startswith("Bearer "):
        raise HTTPException(status_code=401)
    token = header[7:]
    try:
        signing_key = jwks_client().get_signing_key_from_jwt(token)
        payload = jwt.decode(
            token,
            signing_key.key,
            algorithms=["RS256"],
            audience="account",
        )
    except PyJWTError:
        raise HTTPException(status_code=401)
    roles = payload.get("realm_access", {}).get("roles", [])
    return UserPrincipal(
        user_id=payload["sub"],
        email=payload.get("email", ""),
        roles=roles,
    )

@RestController
public class ArticleController {

    @PreAuthorize("hasRole('ADMIN')")
    @DeleteMapping("/articles/{id}")
    public void delete(@PathVariable Long id) {
        articleService.delete(id);
    }

    @PreAuthorize("hasAnyRole('ADMIN', 'EDITOR')")
    @PutMapping("/articles/{id}")
    public ArticleDto update(@PathVariable Long id, @RequestBody UpdateRequest body) {
        return articleService.update(id, body);
    }

    @PreAuthorize("hasAnyRole('ADMIN', 'EDITOR', 'VIEWER')")
    @GetMapping("/articles/{id}")
    public ArticleDto get(@PathVariable Long id) {
        return articleService.get(id);
    }
}

func RequireRole(roles ...string) func(http.Handler) http.Handler {
    set := make(map[string]struct{}, len(roles))
    for _, r := range roles {
        set[r] = struct{}{}
    }
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            principal, ok := r.Context().Value(principalKey{}).(*Claims)
            if !ok {
                http.Error(w, "Unauthorized", http.StatusUnauthorized)
                return
            }
            for _, role := range principal.RealmAccess.Roles {
                if _, found := set[role]; found {
                    next.ServeHTTP(w, r)
                    return
                }
            }
            http.Error(w, "Forbidden", http.StatusForbidden)
        })
    }
}

// Подключение:
// router.With(RequireRole("ADMIN")).Delete("/articles/{id}", deleteHandler)
// router.With(RequireRole("ADMIN", "EDITOR")).Put("/articles/{id}", updateHandler)
// router.With(RequireRole("ADMIN", "EDITOR", "VIEWER")).Get("/articles/{id}", getHandler)

import { RequestHandler } from "express";

function requireRole(...roles: string[]): RequestHandler {
  const allowed = new Set(roles);
  return (req, res, next) => {
    const principal = (req as any).principal;
    if (!principal) return res.sendStatus(401);
    const hasRole = (principal.roles as string[]).some((r) => allowed.has(r));
    if (!hasRole) return res.sendStatus(403);
    next();
  };
}

// router.delete("/articles/:id", requireRole("ADMIN"), deleteHandler);
// router.put("/articles/:id", requireRole("ADMIN", "EDITOR"), updateHandler);
// router.get("/articles/:id", requireRole("ADMIN", "EDITOR", "VIEWER"), getHandler);

from fastapi import Depends, HTTPException, status
from functools import wraps

def require_role(*roles: str):
    allowed = set(roles)
    def dependency(principal: UserPrincipal = Depends(jwt_bearer)) -> UserPrincipal:
        if not allowed.intersection(principal.roles):
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
        return principal
    return dependency

# Подключение:
# @app.delete("/articles/{article_id}")
# async def delete_article(
#     article_id: int,
#     principal: UserPrincipal = Depends(require_role("ADMIN")),
# ): ...

@Component("access")
@RequiredArgsConstructor
public class AccessPolicy {

    private final ArticleRepository articleRepository;

    public boolean canEditArticle(Long articleId, UserPrincipal user) {
        Article article = articleRepository.findById(articleId).orElse(null);
        if (article == null) return false;

        return user.hasRole("EDITOR")
            && article.getDepartment().equals(user.getDepartment())
            && article.getStatus() == ArticleStatus.DRAFT;
    }

    public boolean canDeleteArticle(Long articleId, UserPrincipal user) {
        Article article = articleRepository.findById(articleId).orElse(null);
        if (article == null) return false;

        return user.hasRole("ADMIN")
            || article.getAuthorId().equals(user.getId());
    }
}

// Использование:
// @PreAuthorize("@access.canEditArticle(#id, authentication.principal)")
// @PutMapping("/articles/{id}")
// public ArticleDto update(@PathVariable Long id, @RequestBody UpdateRequest body) { ... }

type ArticlePolicy struct {
    repo ArticleRepository
}

func (p *ArticlePolicy) CanEdit(ctx context.Context, articleID int64, user *Claims) (bool, error) {
    article, err := p.repo.FindByID(ctx, articleID)
    if err != nil {
        return false, err
    }
    hasRole := slices.Contains(user.RealmAccess.Roles, "EDITOR")
    return hasRole &&
        article.Department == user.Department &&
        article.Status == StatusDraft, nil
}

func (p *ArticlePolicy) CanDelete(ctx context.Context, articleID int64, user *Claims) (bool, error) {
    article, err := p.repo.FindByID(ctx, articleID)
    if err != nil {
        return false, err
    }
    isAdmin := slices.Contains(user.RealmAccess.Roles, "ADMIN")
    return isAdmin || article.AuthorID == user.Sub, nil
}

func (h *ArticleHandler) Update(w http.ResponseWriter, r *http.Request) {
    id := pathParamInt64(r, "id")
    user := principalFromCtx(r.Context())
    ok, err := h.policy.CanEdit(r.Context(), id, user)
    if err != nil || !ok {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    // ... бизнес-логика
}

import { ArticleRepository } from "../repository/article.repository";

class ArticlePolicy {
  constructor(private readonly repo: ArticleRepository) {}

  async canEdit(articleId: number, user: Principal): Promise<boolean> {
    const article = await this.repo.findById(articleId);
    if (!article) return false;
    return (
      user.roles.includes("EDITOR") &&
      article.department === user.department &&
      article.status === "DRAFT"
    );
  }

  async canDelete(articleId: number, user: Principal): Promise<boolean> {
    const article = await this.repo.findById(articleId);
    if (!article) return false;
    return user.roles.includes("ADMIN") || article.authorId === user.userId;
  }
}

// В обработчике:
// const ok = await policy.canEdit(+req.params.id, req.principal);
// if (!ok) return res.sendStatus(403);

from dataclasses import dataclass

@dataclass
class ArticlePolicy:
    repo: ArticleRepository

    async def can_edit(self, article_id: int, user: UserPrincipal) -> bool:
        article = await self.repo.find_by_id(article_id)
        if not article:
            return False
        return (
            "EDITOR" in user.roles
            and article.department == user.department
            and article.status == "DRAFT"
        )

    async def can_delete(self, article_id: int, user: UserPrincipal) -> bool:
        article = await self.repo.find_by_id(article_id)
        if not article:
            return False
        return "ADMIN" in user.roles or article.author_id == user.user_id

# В обработчике:
# if not await policy.can_edit(article_id, principal):
#     raise HTTPException(status_code=403)

@RestController
@RequiredArgsConstructor
public class OrderController {

    private final OrderRepository orderRepository;

    @GetMapping("/orders/{id}")
    public OrderDto getOrder(@PathVariable Long id, Authentication auth) {
        Order order = orderRepository.findById(id)
            .orElseThrow(() -> new NotFoundException("Order not found"));

        Long currentUserId = ((UserPrincipal) auth.getPrincipal()).getId();
        if (!order.getUserId().equals(currentUserId)) {
            throw new AccessDeniedException("Not your order");
        }

        return orderMapper.toDto(order);
    }
}

func (h *OrderHandler) GetOrder(w http.ResponseWriter, r *http.Request) {
    orderID := pathParamInt64(r, "id")
    user := principalFromCtx(r.Context())

    order, err := h.repo.FindByID(r.Context(), orderID)
    if errors.Is(err, ErrNotFound) {
        http.Error(w, "Not found", http.StatusNotFound)
        return
    }
    if order.CustomerID != user.Sub {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    writeJSON(w, toOrderDTO(order))
}

app.get("/orders/:id", jwtBearerMiddleware, async (req, res) => {
  const order = await orderRepository.findById(Number(req.params.id));
  if (!order) return res.sendStatus(404);

  const principal: Principal = (req as any).principal;
  if (order.customerId !== principal.userId) return res.sendStatus(403);

  res.json(toOrderDTO(order));
});

@app.get("/orders/{order_id}")
async def get_order(
    order_id: int,
    principal: UserPrincipal = Depends(jwt_bearer),
    repo: OrderRepository = Depends(get_order_repo),
) -> OrderDTO:
    order = await repo.find_by_id(order_id)
    if order is None:
        raise HTTPException(status_code=404)
    if order.customer_id != principal.user_id:
        raise HTTPException(status_code=403)
    return to_order_dto(order)