صلاحية المورد ونطاق المستأجر

def may_edit(actor, document):
    return bool(actor and (actor["role"] == "admin" or actor["id"] == document["owner_id"]))
document = {"owner_id": 7}
print(may_edit(None, document))
print(may_edit({"id": 7, "role": "user"}, document))
print(may_edit({"id": 8, "role": "user"}, document))
print(may_edit({"id": 8, "role": "admin"}, document))

False
True
False
True

النتائج منع وسماح ومنع وسماح بمدخل موثوق اصطناعي لا طلب غير موثق.

from typing import Annotated
from fastapi import Depends, FastAPI, HTTPException
from fastapi.testclient import TestClient
def current_user(): return {"id": 7}
def authorized_document(document_id: int, user: Annotated[dict, Depends(current_user)]):
    document = {1: {"id": 1, "owner_id": 7, "text": "public lab text"}}.get(document_id)
    if document is None: raise HTTPException(status_code=404, detail="Missing")
    if document["owner_id"] != user["id"]: raise HTTPException(status_code=403, detail="Forbidden")
    return document
app = FastAPI()
@app.get("/documents/{document_id}")
def document(value: Annotated[dict, Depends(authorized_document)]): return {"id": value["id"]}
with TestClient(app) as client:
    print(client.get("/documents/1").status_code)
    app.dependency_overrides[current_user] = lambda: {"id": 8}
    try:
        print(client.get("/documents/1").status_code)
    finally:
        app.dependency_overrides.clear()

200
403

ينجح المالك ويمنع الآخر مع بقاء البحث والسياسة، والمزود للمختبر لا مصادقة فعلية.