독립 합성 교육용 예제 / Independent synthetic teaching example
실제 업체 자료·자격정보·외부 의존성은 없습니다. No client records, credentials or external dependencies.
Run node test.mjs in Node.js with global Web Crypto support. Open demo-ko.html or demo-en.html in a modern browser. Demos inline the same module source. No network or persistent storage.
코드·테스트·한영 데모와 범위 문서가 포함됩니다. 수정·재배포·상업적 사용을 허용하며 무보증으로 제공합니다.
You may use, modify and redistribute these original synthetic files, including commercially. Provided as-is without warranty.
Import {decideAccess,projectOrder,editableOrderFields,syntheticAccess} from './access-policy.mjs'.
TRUST BOUNDARY: principal must come from server-verified authentication, never a browser select, body or arbitrary header. A client can forge this local model. This package is a policy decision example, NOT a complete authentication/authorization service. Recheck persisted record scope and current state server-side for every action.
Policy: same company required. Staff can read own assigned records and edit draft quantity. Coordinators can read company records and edit/approve drafts. Owners can read/export company records but cannot edit/approve. Nobody has restore authority in this example. Unknown roles/actions/inactive users deny by default. Projection explicitly includes id/status/quantity and owner-only amount, never internalNote or extra input fields. editableOrderFields lists quantity only; callers must enforce that whitelist and validate patches, not just hide UI controls.
Real bulk export must scope queries and check records; do not merely allow one example row then export everything. Add real identity, permission revocation, transaction/state checks, tests, logging policy and separate restore authority before adoption. Do not deploy the demo as a security boundary.
역할 선택은 화면 예시이며 로그인·실제 서버 권한과 다릅니다. 특정 회사 정책으로 일반화하지 않습니다.
