OPA 集成实战#

@Configuration
public class OPAConfig {
    
    @Value("${opa.server.url:http://localhost:8181}")
    private String opaServerUrl;
    
    @Bean
    public OPAClient opaClient() {
        return OPAClient.builder()
            .serverUrl(opaServerUrl)
            .timeout(5, TimeUnit.SECONDS)
            .retry(3)  // 重试次数
            .build();
    }
}

@Service
@Slf4j
public class AuthorizationService {
    
    private final OPAClient opaClient;
    private final Cache<String, Boolean> permissionCache;
    
    public AuthorizationService(OPAClient opaClient) {
        this.opaClient = opaClient;
        this.permissionCache = Caffeine.newBuilder()
            .maximumSize(10000)
            .expireAfterWrite(30, TimeUnit.SECONDS)
            .build();
    }
    
    /**
     * 权限���查
     */
    public AuthorizationResult authorize(AccessRequest request) {
        String cacheKey = buildCacheKey(request);
        
        // 尝试从缓存获取
        Boolean cached = permissionCache.getIfPresent(cacheKey);
        if (cached != null) {
            return AuthorizationResult.builder()
                .allowed(cached)
                .fromCache(true)
                .build();
        }
        
        // 调用 OPA
        long startTime = System.currentTimeMillis();
        
        try {
            OPARequest opaRequest = OPARequest.builder()
                .path("app/authz/allow")
                .input(buildOPAInput(request))
                .build();
            
            OPAResponse response = opaClient.evaluate(opaRequest);
            
            boolean allowed = response.getBoolean("result").orElse(false);
            
            // 缓存结果
            permissionCache.put(cacheKey, allowed);
            
            return AuthorizationResult.builder()
                .allowed(allowed)
                .fromCache(false)
                .latencyMs(System.currentTimeMillis() - startTime)
                .build();
                
        } catch (OPAException e) {
            log.error("OPA evaluation failed", e);
            // 失败时保守拒绝
            return AuthorizationResult.builder()
                .allowed(false)
                .error(e.getMessage())
                .build();
        }
    }
    
    private String buildCacheKey(AccessRequest request) {
        return String.format("%s:%s:%s:%s",
            request.getUserId(),
            request.getResourceType(),
            request.getResourceId(),
            request.getAction());
    }
    
    private Map<String, Object> buildOPAInput(AccessRequest request) {
        Map<String, Object> input = new HashMap<>();
        
        input.put("user", Map.of(
            "id", request.getUserId(),
            "roles", request.getRoles(),
            "department", request.getDepartment(),
            "clearance_level", request.getClearanceLevel()
        ));
        
        input.put("resource", Map.of(
            "type", request.getResourceType(),
            "id", request.getResourceId(),
            "classification", request.getClassification(),
            "owner", request.getOwner()
        ));
        
        input.put("action", request.getAction());
        
        input.put("environment", Map.of(
            "timestamp", Instant.now().toString(),
            "ip_address", request.getClientIp()
        ));
        
        return input;
    }
}

@Configuration
@EnableWebSecurity
public class OPAWebSecurityConfig {
    
    @Autowired
    private AuthorizationService authorizationService;
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .sessionManagement(session -> 
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/health", "/actuator/**").permitAll()
                .requestMatchers("/api/**").authenticated()
                .anyRequest().permitAll()
            )
            .addFilterBefore(new OPAAuthorizationFilter(authorizationService),
                UsernamePasswordAuthenticationFilter.class);
        
        return http.build();
    }
}

@Slf4j
public class OPAAuthorizationFilter extends OncePerRequestFilter {
    
    private final AuthorizationService authorizationService;
    
    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain) 
            throws ServletException, IOException {
        
        String path = request.getRequestURI();
        String method = request.getMethod();
        
        // 构建访问请求
        AccessRequest accessRequest = AccessRequest.builder()
            .userId(getCurrentUserId(request))
            .resourceType(extractResourceType(path))
            .resourceId(extractResourceId(path))
            .action(mapHttpMethodToAction(method))
            .clientIp(request.getRemoteAddr())
            .build();
        
        // OPA 权限检查
        AuthorizationResult result = authorizationService.authorize(accessRequest);
        
        if (!result.isAllowed()) {
            log.warn("Access denied: user={}, path={}, action={}",
                accessRequest.getUserId(), path, method);
            
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.getWriter().write("{\"error\":\"Access denied\"}");
            return;
        }
        
        // 记录审计日志
        if (result.getLatencyMs() != null) {
            log.info("Access audit: user={}, path={}, latency={}ms",
                accessRequest.getUserId(), path, result.getLatencyMs());
        }
        
        chain.doFilter(request, response);
    }
}