API … 🔒 privée

import express from 'express';
const app = express();

app.get('/api/data/items', (req, res) => {
    const tenantId   = parseInt(req.header('X-Apim-Tenant-Id'),   10);
    const tenantSlug = req.header('X-Apim-Tenant-Slug');
    const userId     = parseInt(req.header('X-Apim-User-Id'),     10);
    const scopes     = (req.header('X-Apim-Scopes') || '').split(',');
    const requestId  = req.header('X-Apim-Request-Id');

    if (!scopes.includes('api:data:read') && !scopes.includes('api:data:*')) {
        return res.status(403).json({ error: 'forbidden' });
    }
    res.json(itemsForTenant(tenantId));
});

from fastapi import FastAPI, Header, HTTPException
app = FastAPI()

@app.get("/api/data/items")
def list_items(
    x_apim_tenant_id:   int = Header(..., alias="X-Apim-Tenant-Id"),
    x_apim_tenant_slug: str = Header(..., alias="X-Apim-Tenant-Slug"),
    x_apim_user_id:     int = Header(..., alias="X-Apim-User-Id"),
    x_apim_scopes:      str = Header("",  alias="X-Apim-Scopes"),
    x_apim_request_id:  str = Header("",  alias="X-Apim-Request-Id"),
):
    scopes = x_apim_scopes.split(",")
    if "api:data:read" not in scopes and "api:data:*" not in scopes:
        raise HTTPException(403, "forbidden")
    return items_for_tenant(x_apim_tenant_id)

package main

import (
    "net/http"
    "strconv"
    "strings"
    "github.com/gin-gonic/gin"
)

func main() {
    r := gin.Default()
    r.GET("/api/data/items", func(c *gin.Context) {
        tenantId, _ := strconv.Atoi(c.GetHeader("X-Apim-Tenant-Id"))
        scopes := strings.Split(c.GetHeader("X-Apim-Scopes"), ",")
        hasRead := false
        for _, s := range scopes {
            if s == "api:data:read" || s == "api:data:*" {
                hasRead = true
                break
            }
        }
        if !hasRead {
            c.JSON(403, gin.H{"error": "forbidden"})
            return
        }
        c.JSON(200, itemsForTenant(tenantId))
    })
    r.Run(":8080")
}