Autorización de Grano Fino

// Fine-grained authorization example
class FinegrainedAuthz {
  constructor() {
    this.policies = new Map()
  }

  // Field-level authorization
  canReadField(user, resource, fieldName) {
    const field = resource[fieldName]

    // Email: visible to owner or admin
    if (fieldName === 'email') {
      return user.id === resource.userId || user.roles.includes('admin')
    }

    // SSN: only for compliance officers from internal network
    if (fieldName === 'ssn') {
      return (
        user.roles.includes('compliance') &&
        user.network === 'internal' &&
        user.mfaVerified === true
      )
    }

    // Salary: HR or own record
    if (fieldName === 'salary') {
      return (
        user.department === 'hr' ||
        user.id === resource.userId
      )
    }

    // Default: public fields
    return true
  }

  // Operation-level authorization
  canPerformOperation(user, resource, operation) {
    // Delete: only owner or admin, not on locked resources
    if (operation === 'delete') {
      return (
        (user.id === resource.userId || user.roles.includes('admin')) &&
        !resource.isLocked
      )
    }

    // Approve: only managers of same department
    if (operation === 'approve') {
      return (
        user.roles.includes('manager') &&
        user.department === resource.department
      )
    }

    return false
  }

  // Filter response based on permissions
  filterFields(user, resource) {
    const filtered = {}

    for (const [key, value] of Object.entries(resource)) {
      if (this.canReadField(user, resource, key)) {
        filtered[key] = value
      } else {
        // Return masked or null for unauthorized fields
        filtered[key] = this.getMaskedValue(key, value)
      }
    }

    return filtered
  }

  getMaskedValue(fieldName, value) {
    if (fieldName === 'ssn') return '***-**-****'
    if (fieldName === 'email') return '***@***.***'
    if (fieldName === 'salary') return null
    return '[REDACTED]'
  }
}

// API endpoint with fine-grained authorization
app.get('/api/employees/:id', async (req, res) => {
  const authz = new FinegrainedAuthz()
  const user = req.user
  const employee = await db.employees.findById(req.params.id)

  if (!employee) {
    return res.status(404).json({ error: 'Not found' })
  }

  // Apply fine-grained filtering
  const filtered = authz.filterFields(user, employee)

  // Log what was filtered for audit
  const redactedFields = Object.keys(employee).filter(
    key => !(key in filtered) || filtered[key] === null
  )

  if (redactedFields.length > 0) {
    await auditLog.log({
      action: 'field_redaction',
      user: user.id,
      resource: employee.id,
      redactedFields
    })
  }

  res.json(filtered)
})

// Conditional field exposure in GraphQL
const resolvers = {
  Employee: {
    salary: (parent, args, context) => {
      const user = context.user
      const authz = new FinegrainedAuthz()

      if (authz.canReadField(user, parent, 'salary')) {
        return parent.salary
      }

      throw new ForbiddenError('Not authorized to view salary')
    }
  }
}