← Lesson
Identity and the Confused Deputy
Joeven
Run
Reset
Python loads on first run
USERS = { "ada": {"refund_limit_cents": 5000}, "guest": {"refund_limit_cents": 0}, } BOT_KEY_CAN_REFUND = 10000000 def refund(actor, amount_cents): user = USERS.get(actor) if user is None: return {"error": "unknown_user"} if amount_cents > user["refund_limit_cents"]: return { "error": "denied", "reason": "user_limit", "limit": user["refund_limit_cents"], "bot_key_would_allow": amount_cents <= BOT_KEY_CAN_REFUND, } return {"ok": True, "amount_cents": amount_cents, "actor": actor} print("ada small", refund("ada", 4000)) print("ada huge", refund("ada", 9000)) print("guest", refund("guest", 1)) print("unknown", refund("nobody", 1))
Run to execute this in your browser. Nothing is sent to a server.