TypeScript / Tested teaching helper
Separate identity from resource authorization
A client or attestation verdict cannot grant access to someone else's object.
TypeScript
interface Decision { authenticated: boolean; authorized: boolean; integrityOk: boolean }
export function canMutateResource(input: Decision): boolean {
return input.authenticated && input.authorized && input.integrityOk;
}What matters
This tiny gate assumes authentication, per-object authorization, and integrity are independently verified by trusted server code. Do not accept these booleans from an untrusted client.
Test these cases
- Authenticated, wrong owner → deny
- Valid integrity, revoked session → deny
- All independently verified → allow
Sources and limits
This is a reference snippet, not a substitute for reviewing the full vendor API contract, concurrency rules or production threat model. Do not paste secrets into sample code.
This pure helper has runnable Node.js tests in the downloadable educational bundle. Those tests do not verify a full production security system.