Simple Authorization REST API for Document Access (Go)

This project demonstrates basic authorization logic implemented as a REST API using Go’s standard net/http package.

It simulates how a backend service checks whether a user is authorized to access a protected resource, without using a database, authentication, or external frameworks.

Overview

The API exposes a single endpoint that accepts user details and a document ID, then determines whether access should be granted based on role-based and ownership-based authorization rules.

Data Models

Document Schema

type Document struct {
	ID      int
	Owner   string
	Content string
}

Documents are stored in memory:

var documents = []Document{
	{ID: 1, Owner: "sahil", Content: "doc sahil"},
	{ID: 2, Owner: "cheemx", Content: "doc cheemx"},
	{ID: 3, Owner: "jagdish", Content: "doc jagdish"},
}

User Schema

type User struct {
	Username string
	Role     string
}

API Contract

Endpoint

POST /access

Request Body

{
  "username": "sahil",
  "role": "user",
  "doc_id": 1
}

Response (Access Granted)

{
  "message": "Access Granted",
  "content": "doc sahil"
}

Response (Access Denied)

{
  "message": "Access Denied"
}

Response (Document Not Found)

{
  "message": "Document not found"
}

Running the Server

go run .