RBAC（基于角色的访问控制）#

public enum RoleLevel {
    // 层级越高，权限越大
    INTERN(1),      // 实习生：最低权限
    JUNIOR(2),       // 初级：继承实习生
    SENIOR(3),       // 高级：继承初级
    MANAGER(4),       // 经理：继承高级
    DIRECTOR(5),     // 总监：继承经理
    CTO(6);          // CTO：最高权限
    
    private final int level;
    
    RoleLevel(int level) {
        this.level = level;
    }
    
    public boolean canInheritFrom(RoleLevel parent) {
        return this.level <= parent.level;
    }
}

public class MutuallyExclusiveRoleValidator {
    
    private static final Set<RolePair> EXCLUSIVE_PAIRS = Set.of(
        new RolePair("ACCOUNTANT", "AUDITOR"),
        new RolePair("PURCHASE_APPROVER", "PURCHASE_REQUESTER"),
        new RolePair("SYSTEM_ADMIN", "SECURITY_AUDITOR")
    );
    
    public boolean validateAssignment(User user, Role newRole) {
        Set<Role> currentRoles = user.getAssignedRoles();
        
        for (Role existingRole : currentRoles) {
            if (EXCLUSIVE_PAIRS.contains(new RolePair(
                    existingRole.getName(), 
                    newRole.getName()))) {
                return false; // 违反互斥约束
            }
        }
        return true;
    }
}

public class RoleCardinalityConstraint {
    // 角色最大分配数
    private final Map<String, Integer> roleMaxAssignments;
    
    // 统计当前角色分配数
    public boolean canAssignRole(Role role) {
        int currentCount = roleAssignmentRepository
            .countByRoleId(role.getId());
        int maxAllowed = roleMaxAssignments.getOrDefault(
            role.getName(), 
            Integer.MAX_VALUE
        );
        return currentCount < maxAllowed;
    }
}

public class PrerequisiteRoleValidator {
    
    private static final Map<String, Set<String>> PREREQUISITES = Map.of(
        "SENIOR_DEVELOPER", Set.of("DEVELOPER"),
        "TEAM_LEAD", Set.of("SENIOR_DEVELOPER"),
        "PROJECT_MANAGER", Set.of("LEAD_DEVELOPER")
    );
    
    public boolean hasPrerequisiteRoles(User user, Role targetRole) {
        Set<String> required = PREREQUISITES.get(targetRole.getName());
        if (required == null || required.isEmpty()) {
            return true; // 无先决条件
        }
        
        Set<String> userRoles = user.getAssignedRoles().stream()
            .map(Role::getName)
            .collect(Collectors.toSet());
        
        return userRoles.containsAll(required);
    }
}

@Configuration
@EnableMethodSecurity(prePostEnabled = true)
public class RbacSecurityConfig {
    
    @Autowired
    private UserDetailsService userDetailsService;
    
    @Bean
    public RoleHierarchy roleHierarchy() {
        RoleHierarchyImpl hierarchy = new RoleHierarchyImpl();
        
        // 使用 ">" 表示继承关系
        // CTO > Director > Manager > Senior > Junior > Intern
        hierarchy.setHierarchy(
            "ROLE_CTO > ROLE_DIRECTOR > ROLE_MANAGER > " +
            "ROLE_SENIOR > ROLE_JUNIOR > ROLE_INTERN"
        );
        
        return hierarchy;
    }
    
    @Bean
    public DefaultMethodSecurityExpressionHandler 
            defaultMethodSecurityExpressionHandler() {
        DefaultMethodSecurityExpressionHandler handler = 
            new DefaultMethodSecurityExpressionHandler();
        handler.setRoleHierarchy(roleHierarchy());
        return handler;
    }
}

@Service
@Transactional
public class PermissionService {
    
    @Autowired
    private RoleRepository roleRepository;
    
    @Autowired
    private PermissionRepository permissionRepository;
    
    @Autowired
    private UserRoleRepository userRoleRepository;
    
    @Autowired
    private RolePermissionRepository rolePermissionRepository;
    
    @Autowired
    private RoleHierarchyService roleHierarchyService;
    
    /**
     * 检查用户是否具有特定权限
     * 考虑角色层级继承
     */
    public boolean hasPermission(Long userId, String permission) {
        // 1. 获取用户直接权限（通过角色层级展开）
        Set<String> userPermissions = getUserEffectivePermissions(userId);
        
        // 2. 检查权限匹配
        return userPermissions.stream()
            .anyMatch(p -> matchesPermission(p, permission));
    }
    
    /**
     * 获取用户所有有效权限（含继承）
     */
    public Set<String> getUserEffectivePermissions(Long userId) {
        // 获取用户角色
        Set<Role> userRoles = getUserRoles(userId);
        
        // 展开角色层级
        Set<Role> expandedRoles = roleHierarchyService
            .expandRoleHierarchy(userRoles);
        
        // 收集所有权限
        return expandedRoles.stream()
            .flatMap(role -> role.getPermissions().stream())
            .map(Permission::getCode)
            .collect(Collectors.toSet());
    }
    
    /**
     * 权限模式匹配（支持通配符）
     * "document:read" 匹配 "document:read"
     * "document:*" 匹配 "document:read"、"document:write"
     * "*:read" 匹配 "document:read"、"report:read"
     */
    private boolean matchesPermission(String granted, String requested) {
        if (granted.equals(requested)) {
            return true;
        }
        
        String[] grantedParts = granted.split(":");
        String[] requestedParts = requested.split(":");
        
        if (grantedParts.length != requestedParts.length) {
            return false;
        }
        
        for (int i = 0; i < grantedParts.length; i++) {
            if (!grantedParts[i].equals("*") && 
                !grantedParts[i].equals(requestedParts[i])) {
                return false;
            }
        }
        
        return true;
    }
}

public class LeastPrivilegeValidator {
    
    public ValidationResult validateRolePermissions(
            Role role, 
            Set<Permission> requestedPermissions) {
        
        // 1. 检查权限是否与角色职责相关
        Set<String> roleDomain = extractRoleDomain(role);
        
        Set<Permission> irrelevantPermissions = requestedPermissions.stream()
            .filter(p -> !isRelatedToDomain(p, roleDomain))
            .collect(Collectors.toSet());
        
        if (!irrelevantPermissions.isEmpty()) {
            return ValidationResult.rejected(
                "以下权限与角色职责无关: " + irrelevantPermissions
            );
        }
        
        // 2. 检查是否存在更小的权限子集
        Set<Permission> minimalSet = findMinimalPermissionSet(
            requestedPermissions
        );
        
        if (minimalSet.size() < requestedPermissions.size()) {
            return ValidationResult.warning(
                "可以授予更小权限集: " + minimalSet
            );
        }
        
        return ValidationResult.approved();
    }
}