Authorization you can read, test, and trust

# Lambda builds resource from route params and JWT secrets
@pre_enforce(
    action="exportData",
    resource=lambda ctx: {
        "pilotId": ctx.params.get("pilot_id", ""),
        "sequenceId": ctx.params.get("sequence_id", ""),
    },
    secrets=lambda ctx: {"jwt": ctx.request.state.token},
)
async def get_export_data(pilot_id: str, sequence_id: str):
    return {"pilotId": pilot_id, "data": "export-payload"}

// Arrow function accesses return value after execution
@PostEnforce({
    action: 'readRecord',
    resource: (ctx) => ({
        type: 'record',
        data: ctx.returnValue,
    }),
})
@Get('record/:id')
getRecord(@Param('id') id: string) {
    return this.records.find(r => r.id === id);
}

// ISubscriptionCustomizer builds the subscription programmatically
[HttpGet("exportData/{pilotId}/{sequenceId}")]
[PreEnforce(Action = "exportData", Customizer = typeof(ExportCustomizer))]
public IActionResult GetExportData(string pilotId, string sequenceId)
{
    return Ok(new { pilotId, sequenceId, data = "export-payload" });
}

# Lambda builds resource from route params, with JWT secrets
@pre_enforce(
    action="exportData",
    resource=lambda ctx: {
        "pilotId": ctx.params.get("pilot_id", ""),
        "sequenceId": ctx.params.get("sequence_id", ""),
    },
    secrets=lambda ctx: {"jwt": getattr(ctx.request, "sapl_token", None)},
)
async def get_export_data(request, pilot_id: str, sequence_id: str):
    return JsonResponse({"pilotId": pilot_id, "data": "export-payload"})