Authorization y protección real en Next.js

Authorization y protección real en Next.js | Nicolás Garzón

TypeScript

const order = await db.order.findFirst({
  where: {
    id: orderId,
    organizationId: session.organizationId,
    organization: {
      members: { some: { userId: session.userId } },
    },
  },
});

TypeScript

type OrderAction = "read" | "update" | "cancel" | "refund";

function can(action: OrderAction, context: PolicyContext): boolean {
  switch (action) {
    case "read":
      return context.isMember;
    case "cancel":
      return context.isMember && context.order.status === "pending";
    case "refund":
      return context.role === "owner" && context.order.status === "paid";
    default:
      return false;
  }
}

TypeScript

"use server";

export async function cancelOrderAction(orderId: string) {
  const session = await requireSession();

  const result = await db.$transaction(async (tx) => {
    const order = await tx.order.findFirst({
      where: {
        id: orderId,
        organizationId: session.organizationId,
      },
    });

    if (!order) return { status: "notFound" as const };

    if (!canCancelOrder(session, order)) {
      return { status: "forbidden" as const };
    }

    if (order.status !== "pending") {
      return { status: "conflict" as const };
    }

    await tx.order.update({
      where: { id: order.id },
      data: { status: "cancelled" },
    });

    return { status: "success" as const };
  });

  if (result.status === "success") {
    updateTag(`order:${orderId}`);
  }

  return result;
}

TypeScript

export function canManageMembers(
  principal: Principal,
  organization: OrganizationPolicyView,
): boolean {
  return principal.organizationId === organization.id && principal.role === "owner";
}

Texto

same tenant + right role → allow
same tenant + wrong role → deny
other tenant + right role → deny
owner resource → expected
resource state changed → conflict/deny
revoked session → deny