分布式权限设计#

public class HybridPermissionConfig {
    
    // 集中式权限服务
    @Value("${permission.service.url:http://permission-center:8080}")
    private String permissionServiceUrl;
    
    // 本地缓存配置
    @Value("${permission.local.cache.ttl:300}")
    private long localCacheTtlSeconds;
    
    @Value("${permission.local.cache.max-size:10000}")
    private int localCacheMaxSize;
    
    // 分布式缓存配置
    @Value("${permission.redis.url:redis://redis:6379}")
    private String redisUrl;
}

public class ConsistentHashSharding {
    
    private final TreeMap<Long, ShardNode> ring = new TreeMap<>();
    private final HashFunction hashFunction = Hashing.murmur3_128();
    
    public ConsistentHashSharding(List<ShardNode> nodes) {
        // 添加物理节点
        for (ShardNode node : nodes) {
            addNode(node);
            
            // 每个物理节点对应多个虚拟节点，实现负载均衡
            for (int i = 0; i < VIRTUAL_NODES; i++) {
                String virtualNodeName = node.getName() + "-VN" + i;
                addNode(virtualNodeName, node);
            }
        }
    }
    
    /**
     * 根据用户ID定位分片
     */
    public ShardNode locateShard(Long userId) {
        if (ring.isEmpty()) {
            throw new IllegalStateException("无可用分片");
        }
        
        // 计算用户ID的哈希值
        long hash = hashFunction.hashString(userId.toString(), StandardCharsets.UTF_8).asLong();
        
        // 找到顺时针方向的第一个节点
        Map.Entry<Long, ShardNode> entry = ring.ceilingEntry(hash);
        if (entry == null) {
            // 环绕到第一个节点
            entry = ring.firstEntry();
        }
        
        return entry.getValue().getRealNode();
    }
}

@Service
public class ShardedPermissionService {
    
    private final Map<ShardNode, PermissionRepository> repositories;
    private final ConsistentHashSharding sharding;
    
    public PermissionData getUserPermissions(Long userId) {
        // 1. 路由到正确分片
        ShardNode shard = sharding.locateShard(userId);
        PermissionRepository repo = repositories.get(shard);
        
        // 2. 从对应分片查询
        return repo.findByUserId(userId);
    }
    
    @Transactional
    public void updateUserPermissions(Long userId, PermissionData data) {
        ShardNode shard = sharding.locateShard(userId);
        PermissionRepository repo = repositories.get(shard);
        
        // 权限更新需要跨分片协调
        repo.update(data);
        
        // 发布变更事件，同步到缓存层
        eventPublisher.publish(new PermissionChangedEvent(userId));
    }
}

public class PermissionSet implements CmRDT<PermissionSet> {
    
    private final Set<String> permissions = new HashSet<>();
    private final VectorClock vectorClock;
    
    /**
     * 添加权限（可合并）
     */
    public void add(String permission) {
        permissions.add(permission);
        vectorClock.increment();
    }
    
    /**
     * 移除权限（可合并）
     */
    public void remove(String permission) {
        permissions.remove(permission);
        vectorClock.increment();
    }
    
    /**
     * 合并两个权限集
     * 使用 LWW（Last-Write-Wins）处理冲突
     */
    @Override
    public PermissionSet merge(PermissionSet other) {
        if (this.vectorClock.compareTo(other.vectorClock) > 0) {
            return this;
        } else if (other.vectorClock.compareTo(this.vectorClock) > 0) {
            return other;
        } else {
            // 相同时间戳时，合并权限集合
            PermissionSet merged = new PermissionSet();
            merged.permissions.addAll(this.permissions);
            merged.permissions.addAll(other.permissions);
            return merged;
        }
    }
}

public class PolicyMerger {
    
    /**
     * 合并多层策略
     * 优先级：本地 > 区域 > 全局
     * 但全局禁止策略具有最高优先级
     */
    public Policy mergePolicies(List<Policy> policies) {
        Policy merged = new Policy();
        
        // 1. 收集所有权限
        Set<String> allowedPermissions = new HashSet<>();
        Set<String> deniedPermissions = new HashSet<>();
        Set<String> globalDenied = new HashSet<>();  // 全局禁止，不可覆盖
        
        for (Policy policy : policies) {
            if (policy.isGlobal()) {
                globalDenied.addAll(policy.getDenied());
            } else {
                allowedPermissions.addAll(policy.getAllowed());
                deniedPermissions.addAll(policy.getDenied());
            }
        }
        
        // 2. 应用合并规则
        // 全局禁止策略优先级最高
        deniedPermissions.addAll(globalDenied);
        
        // 允许 = 允许集合 - 禁止集合
        Set<String> finalAllowed = new HashSet<>(allowedPermissions);
        finalAllowed.removeAll(deniedPermissions);
        
        merged.setPermissions(finalAllowed);
        
        return merged;
    }
}

@Service
public class PermissionServiceWithCircuitBreaker {
    
    private final CircuitBreaker circuitBreaker;
    private final PermissionRepository repository;
    
    public PermissionServiceWithCircuitBreaker() {
        this.circuitBreaker = CircuitBreaker.of("permissionService",
            CircuitBreakerConfig.custom()
                .failureRateThreshold(50)          // 50% 失败率触发熔断
                .slidingWindowSize(10)             // 滑动窗口 10 次请求
                .slidingWindowType(CircuitBreakerConfig.SlidingWindowType.COUNT_BASED)
                .minimumNumberOfCalls(5)           // 最少 5 次请求才开始计算
                .waitDurationInOpenState(Duration.ofSeconds(30))  // 熔断 30 秒后进入半开
                .permittedNumberOfCallsInHalfOpenState(3)  // 半开状态允许 3 次试探
                .build()
        );
    }
    
    public PermissionData getUserPermissions(Long userId) {
        return circuitBreaker.executeSupplier(() -> {
            return repository.findByUserId(userId);
        });
    }
}

@Service
public class PermissionServiceWithDegradation {
    
    private final DistributedCache distributedCache;
    private final LocalCache localCache;
    private final PermissionRepository repository;
    
    public PermissionResult authorize(Long userId, String action) {
        // L0: 正常路径
        try {
            return checkWithCache(userId, action);
        } catch (Exception e) {
            log.warn("缓存检查失败，尝试降级", e);
        }
        
        // L1: 分布式缓存
        try {
            return checkWithDistributedCache(userId, action);
        } catch (Exception e) {
            log.error("分布式缓存不可用，尝试本地降级", e);
        }
        
        // L2: 本地缓存或默认策略
        return checkWithLocalOrDefault(userId, action);
    }
}

@Service
public class PermissionContextPropagator {
    
    private static final String PERMISSION_HEADER = "X-Permission-Context";
    
    /**
     * 提取权限上下文
     */
    public PermissionContext extract(HttpRequest request) {
        String header = request.getHeader(PERMISSION_HEADER);
        if (header == null) {
            return null;
        }
        
        return JsonSerializer.deserialize(header, PermissionContext.class);
    }
    
    /**
     * 注入权限上下文到下游请求
     */
    public void inject(HttpRequest request, PermissionContext context) {
        String serialized = JsonSerializer.serialize(context);
        request.setHeader(PERMISSION_HEADER, serialized);
    }
    
    /**
     * 验证下游服务权限
     */
    public boolean validateDownstream(PermissionContext context, 
                                       String requiredPermission) {
        if (context == null) {
            return false;
        }
        
        Set<String> permissions = context.getPermissions();
        return permissions.contains(requiredPermission);
    }
}

@Service
public class DataCenterFailover {
    
    private volatile String currentDataCenter = "BJ";
    private final Map<String, DataCenterClient> clients;
    
    /**
     * 健康检查
     */
    @Scheduled(fixedRate = 5000)
    public void healthCheck() {
        for (Map.Entry<String, DataCenterClient> entry : clients.entrySet()) {
            String dc = entry.getKey();
            boolean healthy = entry.getValue().isHealthy();
            
            if (!healthy && dc.equals(currentDataCenter)) {
                // 当前数据中心故障，切换
                String target = selectHealthyDataCenter();
                if (target != null) {
                    switchToDataCenter(target);
                }
            }
        }
    }
    
    private void switchToDataCenter(String target) {
        log.warn("切换数据中心: {} -> {}", currentDataCenter, target);
        this.currentDataCenter = target;
        metrics.record("datacenter.switch", 1);
    }
}