Opaqu brandierte Authentifizierungs-Token mit typbasiertem Privilegien-Schutz

declare const BrandSymbol: unique symbol;
type Brand<T, B extends string> = T & { readonly [BrandSymbol]: B };
 
type UnauthenticatedToken = Brand<string, "UNAUTH">;
type AdminToken = Brand<string, "ADMIN">;
 
function elevateToken(token: UnauthenticatedToken, secret: string): AdminToken {
  if (secret !== "SUPER_SECRET") throw new Error("Unauthorized");
  return token as unknown as AdminToken;
}
 
function executeAdminAction(token: AdminToken, command: string): void {
  console.log(`Executing ${command} with token ${token}`);
}