ラボ / Security
SecurityWorking~5h
Role-Based Access Control, Enforced at the Boundary
A small API with at least three roles (e.g. viewer, editor, admin) and a permission model that maps roles to allowed actions on protected resources. Authorization is enforced centrally at the request boundary — not scattered as ad-hoc if-checks inside handlers — so adding a new protected route can't accidentally skip the check.
これが証明すること
面接で守れる一言。
履歴書の一言
Designed and implemented a role-based access control layer with centralized middleware enforcement across 8+ protected endpoints, closing a privilege-escalation gap where lower-role users could previously call admin-only mutations directly.
- can design a real permission model, not just 'if user.isAdmin'
- understands enforcement-at-the-boundary vs scattered checks
- can write tests that prove denial, not just allowance
概要
ステップごとに作るもの。
- 01Role/permission model with at least 3 roles and a resource-action matrix (e.g. viewer: read; editor: read+write; admin: read+write+delete+manage-users), stored in a table or config, not hardcoded per-route
- 02Centralized authorization middleware/decorator that every protected route must pass through — no route may implement its own bespoke privilege check
- 03At least 8 protected endpoints spanning read, write, and destructive/admin-only actions, each declaring its required permission explicitly
- 04A deliberate negative-privilege test: a viewer-role user attempts an editor-only write and an admin-only delete, both must return 403 with no side effects (verify the resource is unchanged in the DB)
- 05Audit log entry emitted on every authorization denial (who, what action, what resource, when)
- 06A documented threat model note: what this RBAC layer does NOT protect against (e.g. row-level ownership checks, IDOR) so scope is honest
証明
これらが合格したら完了。
Automated test suite proves a viewer-role token is denied on every editor/admin-only route with 403 and unchanged DB state
automated test
Automated test suite proves an admin-role token succeeds on the same routes
automated test
Adding a new protected route without the authorization decorator fails a lint/CI check (route-audit script) rather than silently shipping unprotected
automated test
Denial audit log entries are produced and inspectable for every 403
checked output
技術スタック
Node.js/Express or FastAPIJWT or session-based authPostgreSQL or SQLite for role/permission storagea test client (supertest or httpx)
Sage Method
frame → decide → prove
あなたが得るもの
API source + permission matrix doc + automated test suite (positive and negative cases) + audit log sample output