Advanced API Security: Implementing Zero Trust Architecture

// Dynamic authorization middleware
const authorize = (resource, action) => {
  return async (req, res, next) => {
    const context = {
      user: req.user,
      resource: resource,
      action: action,
      timestamp: new Date(),
      ipAddress: req.ip,
      userAgent: req.get('User-Agent')
    };
    
    const decision = await policyEngine.evaluate(context);
    
    if (decision.allow) {
      // Log authorized access
      auditLogger.log('ACCESS_GRANTED', context);
      next();
    } else {
      // Log denied access attempt
      auditLogger.log('ACCESS_DENIED', context);
      res.status(403).json({ error: 'Access denied' });
    }
  };
};