401 أو 403 أومورد مخفي: تتبع الهوية والسياسة

from typing import Annotated
from fastapi import Depends, FastAPI, HTTPException
from fastapi.testclient import TestClient
def principal():
    raise HTTPException(status_code=401, detail="No lab identity", headers={"WWW-Authenticate": "Bearer"})
app = FastAPI()
@app.get("/record")
def record(actor: Annotated[dict, Depends(principal)]):
    value = {"tenant": "red", "text": "public lab data"}
    if actor["tenant"] != value["tenant"]: raise HTTPException(status_code=404, detail="Missing")
    return {"text": value["text"]}
with TestClient(app) as client:
    print(client.get("/record").status_code)
    try:
        app.dependency_overrides[principal] = lambda: {"tenant": "red"}
        print(client.get("/record").status_code)
        app.dependency_overrides[principal] = lambda: {"tenant": "blue"}
        print(client.get("/record").status_code)
    finally:
        app.dependency_overrides.clear()
    print(client.get("/record").status_code)

401
200
404
401

التسلسل غياب وسماح وإخفاء ثم غياب؛ ويتغير المدخل الاصطناعي فقط وتبقى السياسة.

def allowed(actor, target):
    return bool(actor and actor["tenant"] == target["tenant"] and "read" in actor["permissions"])
target = {"tenant": "red"}
print(allowed({"tenant": "red", "permissions": {"read"}}, target))
print(allowed({"tenant": "blue", "permissions": {"read"}}, target))
print(allowed({"tenant": "red", "permissions": set()}, target))

True
False
False

يلزم النطاق والإذن معا، ولا تجعل بيانات طلب غير موثق فاعلا موثوقا.