check method

  1. @override
Future<SecurityResult> check(
  1. RequestContext context
)
override

Inspects context and returns a SecurityResult.

Implementations should be side-effect-light with respect to context.body (avoid destructive mutation) but may freely read/write context.metadata to communicate with later layers.

Implementation

@override
Future<SecurityResult> check(RequestContext context) async {
  final userId = context.userId;

  if (userId == null || !knownUserIds.contains(userId)) {
    return SecurityResult.block(
      message: 'User does not exist or is not recognized',
      flags: const ['unknown_user'],
      riskScore: 0.9,
    );
  }

  final body = context.getMeta<dynamic>('sanitizedBody') ?? context.body;
  final action = body is Map ? body['action']?.toString() : null;

  if (Validators.isRestrictedAction(action, restrictedActions)) {
    return SecurityResult.block(
      message: 'Action "$action" is restricted for this user',
      flags: const ['restricted_action'],
      riskScore: 0.95,
    );
  }

  final amount = context.getMeta<double>('sandboxAmount') ??
      Validators.extractAmount(body);
  final limit = userLimits[userId] ?? defaultUserLimit;

  if (amount != null && amount > limit) {
    return SecurityResult.block(
      message: 'Transaction exceeds authorized limit for user',
      flags: const ['limit_exceeded'],
      riskScore: 0.85,
    );
  }

  return SecurityResult.allow(message: 'Authorization checks passed');
}