Bank filialida HAR BIR xodim KIRIB kela oladi (bino ichiga — bu autentifikatsiya, "sen kimligingni isbotladingmi"), lekin FAQAT kassa mudiri seyfни ocha oladi (bu — avtorizatsiya, "senga BU ANIQ amalga ruxsat bormi"). Oldingi ikki darsda "kimligini isbotlash"ni (autentifikatsiya) ko'rdik; endi "nima qilishga HAQLI"ni (avtorizatsiya) ko'ramiz — Role-Based Access Control (RBAC): har bir foydalanuvchiga ROL (admin, viewer va h.k.) beriladi, va har bir amal MA'LUM rolni TALAB qiladi.

package main

import (
	"fmt"
	"net/http"
	"net/http/httptest"
)

var userRoles = map[string]string{
	"shohruh": "admin",
	"aziza":   "viewer",
}

// requireRole — so'rovni yuborgan foydalanuvchi (avvalgi autentifikatsiya
// bosqichida aniqlangan, "X-Authenticated-User" orqali uzatilgan) KERAKLI
// rolga ega bo'lmasa, 403 qaytaradi
func requireRole(role string, next http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		username := r.Header.Get("X-Authenticated-User")
		if userRoles[username] != role {
			w.WriteHeader(http.StatusForbidden)
			fmt.Fprint(w, "bu amal uchun ruxsat yo'q")
			return
		}
		next(w, r)
	}
}

func main() {
	mux := http.NewServeMux()
	mux.HandleFunc("DELETE /books/{id}", requireRole("admin", func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusNoContent)
	}))

	req := httptest.NewRequest("DELETE", "/books/1", nil)
	req.Header.Set("X-Authenticated-User", "shohruh")
	rec := httptest.NewRecorder()
	mux.ServeHTTP(rec, req)
	fmt.Println(rec.Code)
}

X-Authenticated-User sarlavhasi — bu darsda SODDALASHTIRISH uchun ishlatilgan; HAQIQIY tizimda bu qiymat oldingi darsdagi requireAuth middleware TOMONIDAN, token ICHIDAN olinadi ("Authentication: Token-Based Sessions" darsini eslang) va navbatdagi handler'ga UZATILADI. requireRole("admin", ...) — "faqat admin ROLIGA ega foydalanuvchi BU handler'ga yeta oladi" degan QOIDANI, HAR BIR yo'l ro'yxatga olinganda ANIQ ko'rsatadi.

Diqqat qiling: 403 Forbidden (ruxsat YO'Q) — 401 Unauthorized (kim EKANLIGI noaniq) dan FARQLI status: 401 — "sen KIM ekaningni bilmaymiz", 403 — "sen KIM ekaningni bilamiz, lekin senga BU ishga ruxsat YO'Q". Bu ikkovini ARALASHTIRISH — ko'p API'larda uchraydigan keng tarqalgan XATO.