Authorization: roles, permissions and server-side access checks

import type { NextFunction, Request, Response } from "express";
import type { Role, User } from "./users.ts";

export type Permission = "lead:read" | "lead:update" | "lead:delete" | "lead:all";

// Матрица доступа. Чего здесь нет — запрещено (deny by default).
// lead:all снимает ограничение «только назначенные мне заявки».
const ROLE_PERMISSIONS: Record<Role, readonly Permission[]> = {
  admin: ["lead:read", "lead:update", "lead:delete", "lead:all"],
  analyst: ["lead:read", "lead:all"],
  manager: ["lead:read", "lead:update"],
};

export function can(user: User, permission: Permission): boolean {
  return ROLE_PERMISSIONS[user.role]?.includes(permission) ?? false;
}

// Проверка на уровне функции: разрешено ли это действие вообще.
// Request<Record<string, string>> — чтобы после middleware req.params.id оставался string
export function requirePermission(permission: Permission) {
  return (req: Request<Record<string, string>>, res: Response, next: NextFunction) => {
    const user = res.locals.user;
    if (!user) {
      res.status(401).json({ error: "unauthenticated" });
      return;
    }
    if (!can(user, permission)) {
      res.status(403).json({ error: "forbidden" });
      return;
    }
    next();
  };
}

import { Router } from "express";
import { deleteLead, findLeadFor, LEAD_STATUSES, listLeadsFor, type LeadStatus } from "./leads.ts";
import { requirePermission } from "./permissions.ts";

export const leadsRouter = Router();

leadsRouter.get("/", requirePermission("lead:read"), (req, res) => {
  res.json(listLeadsFor(res.locals.user!));
});

leadsRouter.get("/:id", requirePermission("lead:read"), (req, res) => {
  const lead = findLeadFor(res.locals.user!, req.params.id);
  if (!lead) {
    res.status(404).json({ error: "not_found" });
    return;
  }
  res.json(lead);
});

leadsRouter.patch("/:id", requirePermission("lead:update"), (req, res) => {
  const lead = findLeadFor(res.locals.user!, req.params.id);
  if (!lead) {
    res.status(404).json({ error: "not_found" });
    return;
  }
  const status = req.body?.status;
  if (!LEAD_STATUSES.includes(status)) {
    res.status(400).json({ error: "invalid_status" });
    return;
  }
  // Меняем только разрешённое поле: assigneeId и прочее из тела запроса игнорируются
  lead.status = status as LeadStatus;
  res.json(lead);
});

leadsRouter.delete("/:id", requirePermission("lead:delete"), (req, res) => {
  const lead = findLeadFor(res.locals.user!, req.params.id);
  if (!lead) {
    res.status(404).json({ error: "not_found" });
    return;
  }
  deleteLead(lead.id);
  res.status(204).end();
});

--- a/src/app.ts
+++ b/src/app.ts
@@ -1,5 +1,6 @@
 import express, { type NextFunction, type Request, type Response } from "express";
 import session from "express-session";
+import { leadsRouter } from "./leads-routes.ts";
 import { findUserById, verifyCredentials, type User } from "./users.ts";
 
 declare module "express-session" {
@@ -108,5 +109,8 @@
     });
   });
 
+  // Все маршруты заявок — только для вошедших; права проверяет сам роутер
+  app.use("/leads", requireAuth, leadsRouter);
+
   return app;
 }

import { randomUUID } from "node:crypto";
import { can } from "./permissions.ts";
import type { User } from "./users.ts";

export const LEAD_STATUSES = ["new", "in_progress", "done"] as const;
export type LeadStatus = (typeof LEAD_STATUSES)[number];

export type Lead = {
  id: string;
  name: string;
  phone: string;
  status: LeadStatus;
  assigneeId: string;
};

// Учебное хранилище в памяти. В реальном проекте — таблица в базе данных.
const leads = new Map<string, Lead>();

export function addLead(data: Omit<Lead, "id">): Lead {
  const lead: Lead = { id: randomUUID(), ...data };
  leads.set(lead.id, lead);
  return lead;
}

// Единственное место, где решается, чьи заявки видит пользователь.
// В SQL это условие WHERE в самом запросе, а не фильтр после выборки.
function isVisibleTo(user: User, lead: Lead): boolean {
  return can(user, "lead:all") || lead.assigneeId === user.id;
}

export function listLeadsFor(user: User): Lead[] {
  return [...leads.values()].filter((lead) => isVisibleTo(user, lead));
}

// Поиск сразу в границах доступного: чужая заявка неотличима от несуществующей
export function findLeadFor(user: User, id: string): Lead | undefined {
  const lead = leads.get(id);
  return lead && isVisibleTo(user, lead) ? lead : undefined;
}

export function deleteLead(id: string): void {
  leads.delete(id);
}

import { randomBytes } from "node:crypto";
import request from "supertest";
import { beforeAll, describe, expect, it } from "vitest";
import { createApp } from "../src/app.ts";
import { addLead, type Lead } from "../src/leads.ts";
import { can, type Permission } from "../src/permissions.ts";
import { createUser, type Role, type User } from "../src/users.ts";
import { login, SAME_ORIGIN } from "./helpers.ts";

const app = createApp({
  sessionSecret: randomBytes(32).toString("hex"),
  appOrigin: "https://app.example.com",
});
const PASSWORD = "long-and-unique-passphrase";
type Who = "admin" | "analyst" | "anna" | "boris";
const cookies = {} as Record<Who, string>;
let anna: User;
let boris: User;
let annaLead: Lead;
let borisLead: Lead;

// Заголовки запроса от имени конкретного пользователя
const as = (who: Who) => ({ ...SAME_ORIGIN, Cookie: cookies[who] });

beforeAll(async () => {
  await createUser("admin@example.com", PASSWORD, "admin");
  await createUser("analyst@example.com", PASSWORD, "analyst");
  anna = await createUser("anna@example.com", PASSWORD, "manager");
  boris = await createUser("boris@example.com", PASSWORD, "manager");
  annaLead = addLead({ name: "Кофейня", phone: "+7 700 000 00 01", status: "new", assigneeId: anna.id });
  borisLead = addLead({ name: "Салон", phone: "+7 700 000 00 02", status: "new", assigneeId: boris.id });
  for (const who of ["admin", "analyst", "anna", "boris"] as const) {
    cookies[who] = (await login(app, `${who}@example.com`, PASSWORD)).cookie!;
  }
});

describe("матрица прав", () => {
  it.each<[Role, Permission, boolean]>([
    ["admin", "lead:delete", true],
    ["manager", "lead:update", true],
    ["manager", "lead:delete", false],
    ["manager", "lead:all", false],
    ["analyst", "lead:all", true],
    ["analyst", "lead:update", false],
  ])("%s → %s: %s", (role, permission, expected) => {
    expect(can({ role } as User, permission)).toBe(expected);
  });
});

describe("401: пользователь не вошёл", () => {
  it("список заявок без cookie", async () => {
    const res = await request(app).get("/leads").set(SAME_ORIGIN);
    expect(res.status).toBe(401);
  });

  it("удаление без cookie", async () => {
    const res = await request(app).delete(`/leads/${annaLead.id}`).set(SAME_ORIGIN);
    expect(res.status).toBe(401);
  });
});

describe("403: роль не разрешает действие", () => {
  it("аналитик не меняет статус", async () => {
    const res = await request(app).patch(`/leads/${annaLead.id}`).set(as("analyst")).send({ status: "done" });
    expect(res.status).toBe(403);
  });

  it("менеджер не удаляет даже свою заявку", async () => {
    const res = await request(app).delete(`/leads/${annaLead.id}`).set(as("anna"));
    expect(res.status).toBe(403);
  });

  it("понижение роли действует со следующего запроса", async () => {
    const vera = await createUser("vera@example.com", PASSWORD, "admin");
    const { cookie } = await login(app, "vera@example.com", PASSWORD);
    vera.role = "manager"; // роль читается из хранилища при каждом запросе
    const res = await request(app).delete(`/leads/${borisLead.id}`).set({ ...SAME_ORIGIN, Cookie: cookie! });
    expect(res.status).toBe(403);
  });
});

describe("IDOR: чужие заявки", () => {
  it("менеджер видит в списке только свои", async () => {
    const res = await request(app).get("/leads").set(as("anna"));
    expect(res.status).toBe(200);
    expect(res.body.map((l: Lead) => l.id)).toEqual([annaLead.id]);
  });

  it("чужая заявка по ID — 404, как несуществующая", async () => {
    const foreign = await request(app).get(`/leads/${borisLead.id}`).set(as("anna"));
    const missing = await request(app).get("/leads/no-such-id").set(as("anna"));
    expect(foreign.status).toBe(404);
    expect(foreign.body).toEqual(missing.body);
  });

  it("чужую заявку нельзя изменить, подставив её ID", async () => {
    const res = await request(app).patch(`/leads/${borisLead.id}`).set(as("anna")).send({ status: "done" });
    expect(res.status).toBe(404);
    const check = await request(app).get(`/leads/${borisLead.id}`).set(as("admin"));
    expect(check.body.status).toBe("new");
  });

  it("assigneeId в теле запроса игнорируется", async () => {
    const res = await request(app)
      .patch(`/leads/${annaLead.id}`).set(as("anna"))
      .send({ status: "in_progress", assigneeId: boris.id });
    expect(res.status).toBe(200);
    expect(res.body).toMatchObject({ status: "in_progress", assigneeId: anna.id });
  });
});

describe("разрешённые действия", () => {
  it("аналитик читает любую заявку", async () => {
    const res = await request(app).get(`/leads/${borisLead.id}`).set(as("analyst"));
    expect(res.status).toBe(200);
  });

  it("администратор удаляет заявку", async () => {
    const lead = addLead({ name: "Студия", phone: "+7 700 000 00 03", status: "done", assigneeId: boris.id });
    const res = await request(app).delete(`/leads/${lead.id}`).set(as("admin"));
    expect(res.status).toBe(204);
    const after = await request(app).get(`/leads/${lead.id}`).set(as("admin"));
    expect(after.status).toBe(404);
  });
});

$ npx vitest run test/leads.test.ts
 RUN  v5.0.3 ~/auth-demo

 Test Files  1 passed (1)
      Tests  17 passed (17)