GET /api/transactions/{transactionId}

// 示例：Node.js中的RBAC中间件
function checkPermission(requiredRole) {
  return (req, res, next) => {
    if (req.user.roles.includes(requiredRole)) {
      return next();
    }
    return res.status(403).json({ error: 'Forbidden' });
  };
}

// 使用示例
app.get('/api/transactions/:id', 
  authenticate, 
  checkPermission('transaction_viewer'),
  getTransactionDetails
);

# Python Flask示例
@app.route('/transactions/<transaction_id>', methods=['GET'])
@jwt_required()
def get_transaction(transaction_id):
    transaction = Transaction.query.get_or_404(transaction_id)
    if transaction.user_id != current_user.id:
        return jsonify({"error": "Unauthorized"}), 403
    return jsonify(transaction.to_dict())

// Java示例：使用DTO过滤敏感字段
public class TransactionDTO {
    private Long id;
    private BigDecimal amount;
    private LocalDateTime date;
    // 不包含敏感字段如cardNumber等
    
    // getters and setters
}

// 电商平台交易详情端点示例
router.get('/transactions/:id', 
  authenticateWithJWT,
  checkScopes(['transactions:read']),
  async (req: Request, res: Response) => {
    // 验证用户是否有权查看此交易
    const transaction = await TransactionService.getById(req.params.id);
    if (!transaction.isOwner(req.user.id) && !req.user.isAdmin()) {
      return res.status(403).json({ error: 'Access denied' });
    }
    
    // 根据用户角色返回不同级别的详情
    const dto = transaction.toDTO(req.user.role);
    res.json(dto);
  }
);