Casbin 权限框架#

import org.casbin.jcasbin.main.Enforcer;
import org.casbin.jcasbin.model.Model;
import org.casbin.jcasbin.adapter.FileAdapter;

public class BasicExample {
    public static void main(String[] args) throws Exception {
        // 1. 创建执行器
        Enforcer e = new Enforcer(
            "path/to/basic_model.conf",  // 模型文件
            "path/to/basic_policy.csv"    // 策略文件
        );
        
        // 2. 权限检查
        boolean allowed = e.enforce("alice", "data1", "read");
        System.out.println("alice can read data1: " + allowed);
        
        // 3. 修改策略（文件模式）
        e.addPolicy("bob", "data2", "write");
        e.removePolicy("alice", "data1", "read");
    }
}

public class RBACExample {
    public static void main(String[] args) throws Exception {
        Enforcer e = new Enforcer(
            "path/to/rbac_model.conf",
            "path/to/rbac_policy.csv"
        );
        
        // 权限检查（会自动检查角色继承）
        boolean allowed = e.enforce("alice", "data", "read");
        System.out.println("alice can read data: " + allowed);
        
        // 获取用户的所有角色
        List<String> roles = e.getRolesForUser("alice");
        System.out.println("alice's roles: " + roles);
        
        // 获取角色拥有的权限
        List<String> permissions = e.getPermissionsForUser("alice");
        System.out.println("alice's permissions: " + permissions);
        
        // 添加角色继承关系
        e.addRoleForUser("alice", "admin");
        
        // 检查角色成员
        List<String> members = e.getUsersForRole("admin");
        System.out.println("admin members: " + members);
    }
}

public class DatabaseExample {
    public static void main(String[] args) throws Exception {
        // 1. 使用 MySQL 适配器
        DbAdapter adapter = new DbAdapter(
            "mysql",
            "jdbc:mysql://localhost:3306/casbin",
            "root",
            "password"
        );
        
        // 2. 自动创建表
        adapter.createTable("casbin_rule");
        
        // 3. 创建执行器
        Enforcer e = new Enforcer(
            "path/to/rbac_model.conf",
            adapter
        );
        
        // 4. 从数据库加载策略
        // 策略会在首次加载时自动从数据库读取
        
        // 5. 修改策略（持久化到数据库）
        e.addPolicy("charlie", "data3", "read");
        e.removePolicy("alice", "data1", "read");
        
        // 6. 清除缓存并重新加载
        e.clearCache();
        e.loadPolicy();
    }
}

@Configuration
public class CasbinConfig {
    
    @Value("${casbin.model.path}")
    private String modelPath;
    
    @Value("${casbin.policy.adapter}")
    private String adapterType;
    
    @Bean
    public Enforcer casbinEnforcer() throws Exception {
        Enforcer e;
        
        if ("database".equals(adapterType)) {
            // 使用数据库适配器
            DataSourceAdapter adapter = new DataSourceAdapter(dataSource);
            e = new Enforcer(modelPath, adapter);
        } else {
            // 使用文件适配器
            FileAdapter adapter = new FileAdapter(modelPath.replace(".conf", "_policy.csv"));
            e = new Enforcer(modelPath, adapter);
        }
        
        return e;
    }
}

@Service
@Slf4j
public class CasbinService {
    
    private final Enforcer enforcer;
    
    public CasbinService(Enforcer enforcer) {
        this.enforcer = enforcer;
    }
    
    /**
     * 权限检查
     */
    public boolean checkPermission(String user, String resource, String action) {
        try {
            return enforcer.enforce(user, resource, action);
        } catch (Exception e) {
            log.error("Casbin check failed", e);
            return false;
        }
    }
    
    /**
     * 批量权限检查
     */
    public Map<String, Boolean> batchCheck(String user, 
            List<ResourceAction> resourceActions) {
        Map<String, Boolean> results = new HashMap<>();
        
        for (ResourceAction ra : resourceActions) {
            boolean allowed = checkPermission(user, ra.getResource(), ra.getAction());
            results.put(ra.getResource() + ":" + ra.getAction(), allowed);
        }
        
        return results;
    }
    
    /**
     * 授予角色
     */
    public boolean grantRole(String user, String role) {
        return enforcer.addRoleForUser(user, role);
    }
    
    /**
     * 撤销角色
     */
    public boolean revokeRole(String user, String role) {
        return enforcer.deleteRoleForUser(user, role);
    }
}

public class RedisAdapter extends Adapter {
    
    private JedisPool jedisPool;
    private String keyPrefix = "casbin:policy:";
    
    public RedisAdapter(JedisPool jedisPool) {
        this.jedisPool = jedisPool;
    }
    
    @Override
    public void loadPolicy(Model model) {
        try (Jedis jedis = jedisPool.getResource()) {
            Set<String> keys = jedis.keys(keyPrefix + "*");
            
            for (String key : keys) {
                String value = jedis.get(key);
                String[] parts = value.split(",");
                
                // 解析并加载策略
                if (parts.length >= 2) {
                    model.addPolicy(parts[0], "p", Arrays.copyOfRange(parts, 1, parts.length));
                }
            }
        }
    }
    
    @Override
    public void savePolicy(String ptype, String... rules) {
        // 实现保存逻辑
    }
}

@Service
public class HybridAuthorizationService {
    
    private final Enforcer casbin;
    private final OPAClient opaClient;
    
    /**
     * Casbin 处理常规 RBAC
     * OPA 处理特殊 ABAC 规则
     */
    public AuthorizationResult authorize(AccessRequest request) {
        // 1. Casbin 快速判断（简单 RBAC）
        if (casbin.enforce(request.getUserId(), 
                request.getResourceType(), 
                request.getAction())) {
            return AuthorizationResult.permit("casbin");
        }
        
        // 2. OPA 判断（复杂规则）
        if (opaClient.evaluate(buildOPAInput(request)).isAllowed()) {
            return AuthorizationResult.permit("opa");
        }
        
        return AuthorizationResult.deny();
    }
}