如何限制某些用户访问我的应用程序中的特定功能？

// 示例代码：Node.js + Express
const express = require('express');
const app = express();

const users = [
    { id: 1, name: 'Alice', role: 'admin' },
    { id: 2, name: 'Bob', role: 'user' }
];

app.use((req, res, next) => {
    const user = users.find(u => u.id === req.session.userId);
    if (!user) {
        return res.status(401).send('Unauthorized');
    }
    req.user = user;
    next();
});

app.get('/admin', (req, res) => {
    if (req.user.role !== 'admin') {
        return res.status(403).send('Forbidden');
    }
    res.send('Welcome Admin!');
});

app.get('/user', (req, res) => {
    res.send('Welcome User!');
});

app.listen(3000, () => {
    console.log('Server is running on port 3000');
});

# 示例代码：Python + Flask
from flask import Flask, request, abort

app = Flask(__name__)

users = [
    {'id': 1, 'name': 'Alice', 'department': 'HR'},
    {'id': 2, 'name': 'Bob', 'department': 'Finance'}
]

@app.route('/data')
def get_data():
    user_id = request.args.get('user_id')
    user = next((u for u in users if u['id'] == int(user_id)), None)
    if not user:
        abort(401)
    if user['department'] != 'HR':
        abort(403)
    return 'HR Data'

if __name__ == '__main__':
    app.run(debug=True)