code/solutions/security_lab.py

"""C17.05: authorization policy and escaped display, not authentication."""
from html import escape

def may_read(actor: str | None, owner: str, role: str) -> bool:
    if actor is None or not actor:
        return False
    if role not in {"member", "admin"}:
        return False
    return role == "admin" or actor == owner

def render_note(actor: str | None, owner: str, role: str, text: str) -> str:
    if not may_read(actor, owner, role):
        raise PermissionError("access denied")
    # html.escape is for HTML text context, not JavaScript or SQL contexts.
    return "<p>" + escape(text, quote=True) + "</p>"

if __name__ == "__main__":
    print(render_note("learner", "learner", "member", "x < y"))