BFLA: Role-Action Allowlist Check

Challenge

Broken Function Level Authorization (BFLA) happens when an API decides who you are but forgets to check whether your role is allowed to perform this specific action. A low-privileged user (role 1) who can only read sends a crafted request asking to delete, and a fail-open endpoint happily performs it because it never consulted an authorization policy.

The protected asset here is a fixed permission policy baked into the grading harness. Your job is to be the server-side authorization gate. Implement action_allowed(role, action) so it consults a fixed allowlist and returns 1 only when that exact role is granted that exact action, and 0 otherwise.

The policy the harness enforces:

• role 1 -> read
• role 2 -> read, write
• role 3 -> read, write, delete

Deny by default. Any unknown role, any action not granted to that role, and any invalid input (a NULL or empty action string) must return 0. Do not dereference the action pointer before checking it for NULL, and do exact string matching only (READ is not read).

Example

• action_allowed(1, "read") -> 1
• action_allowed(1, "delete") -> 0
• action_allowed(3, "delete") -> 1
• action_allowed(9, "read") -> 0

Input format

Two arguments: int role (an integer role id; only 1, 2, 3 are known roles) and const char *action (a NUL-terminated string naming the requested action, e.g. "read", "write", "delete"; may be NULL or empty).

Output format

Return int 1 if the given role is explicitly granted the given action by the fixed allowlist, otherwise return 0.

Constraints

role is integer role level; action is string operation name.

Starter code

int action_allowed(int role, const char *action){
    /* TODO: consult a FIXED allowlist and return 1 only when this exact
       role is granted this exact action; return 0 for everything else
       (unknown role, ungranted action, NULL/empty action).
       This stub fails open and is INSECURE — replace it. */
    (void)role; (void)action;
    return -1;
}

Common mistakes

Missing NULL check on action before calling strcmp.

Edge cases to handle

action == NULL, unknown role, action permitted for higher role only.

Background lessons

• Broken Function Level Authorization (BFLA)