M6: Insecure Authorization

Poor authorization allows users to access resources or perform actions beyond their privileges.
// Android - Secure authorization implementation
class AuthorizationManager(private val context: Context) {
    
    // VULNERABLE: Common authorization flaws
    class InsecureAuthorization {
        // Bad: Client-side authorization checks only
        fun canAccessAdminPanel(userRole: String): Boolean {
            return userRole == "admin" // Easily bypassed
        }
        
        // Bad: Predictable resource IDs
        fun getUserData(userId: Int): UserData {
            // Direct access without authorization check
            return database.getUser(userId)
        }
    }
    
    // SECURE: Robust authorization system
    class SecureAuthorization(private val apiClient: ApiClient) {
        
        // Server-side authorization with signed requests
        suspend fun accessResource(
            resourceId: String,
            action: Action,
            userToken: String
        ): AccessResult {
            
            // Create signed request
            val request = AuthorizationRequest(
                resourceId = resourceId,
                action = action,
                timestamp = System.currentTimeMillis(),
                nonce = generateNonce()
            )
            
            val signature = signRequest(request, userToken)
            
            return try {
                val response = apiClient.post(
                    "/auth/authorize",
                    body = request,
                    headers = mapOf(
                        "Authorization" to "Bearer $userToken",
                        "X-Signature" to signature
                    )
                )
                
                when (response.code) {
                    200 -> AccessResult.Granted(response.data)
                    403 -> AccessResult.Denied("Insufficient privileges")
                    404 -> AccessResult.ResourceNotFound
                    else -> AccessResult.Error("Authorization failed")
                }
            } catch (e: Exception) {
                AccessResult.Error(e.message ?: "Unknown error")
            }
        }
        
        // Implement role-based access control (RBAC)
        class RBACManager {
            private val rolePermissions = mapOf(
                "user" to setOf(
                    Permission.READ_OWN_PROFILE,
                    Permission.UPDATE_OWN_PROFILE
                ),
                "moderator" to setOf(
                    Permission.READ_OWN_PROFILE,
                    Permission.UPDATE_OWN_PROFILE,
                    Permission.READ_ALL_PROFILES,
                    Permission.MODERATE_CONTENT
                ),
                "admin" to Permission.values().toSet()
            )
            
            fun hasPermission(
                userRole: String,
                requiredPermission: Permission
            ): Boolean {
                return rolePermissions[userRole]?.contains(requiredPermission) ?: false
            }
            
            // Attribute-based access control (ABAC)
            fun evaluateAccess(
                subject: Subject,
                resource: Resource,
                action: Action,
                environment: Environment
            ): Boolean {
                // Complex policy evaluation
                val policies = loadPolicies()
                
                return policies.any { policy ->
                    policy.evaluate(subject, resource, action, environment)
                }
            }
        }
        
        enum class Permission {
            READ_OWN_PROFILE,
            UPDATE_OWN_PROFILE,
            READ_ALL_PROFILES,
            UPDATE_ALL_PROFILES,
            DELETE_PROFILES,
            MODERATE_CONTENT,
            MANAGE_USERS,
            SYSTEM_ADMIN
        }
    }
}