ReBAC（基于关系的访问控制）#

public class RelationshipPathFinder {
    
    /**
     * 查找两个实体之间的关系路径
     */
    public List<Path> findPath(String from, String to) {
        Graph graph = buildGraph();
        
        BFSResult result = graph.bfs(from, to, maxDepth: 5);
        
        return result.getPaths().stream()
            .map(this::toReadablePath)
            .collect(Collectors.toList());
    }
    
    /**
     * 示例路径：
     * alice -> team:engineering -> member_of -> dept:engineering -> member_of -> doc-123 -> can_view
     */
}

@Service
public class OrgRelationService {
    
    /**
     * 基于组织关系自动授权
     */
    public void grantOrgAccess(User user, Department dept) {
        // 部门成员可以查看部门文档
        tuples.add(RelationTuple.builder()
            .namespace("document")
            .object("dept:" + dept.getId())
            .relation("viewer")
            .subject("user:" + user.getId())
            .build());
        
        // 部门经理有编辑权限
        if (user.isDeptManager(dept)) {
            tuples.add(RelationTuple.builder()
                .namespace("document")
                .object("dept:" + dept.getId())
                .relation("editor")
                .subject("user:" + user.getId())
                .build());
        }
    }
}

public class RelationDerivationService {
    
    /**
     * 当员工转岗时，自动更新关系
     */
    public void onEmployeeTransfer(EmployeeTransfer transfer) {
        // 移除旧部门关系
        removeRelation(
            "user:" + transfer.getUserId(),
            "member",
            "team:" + transfer.getOldTeamId()
        );
        
        // 添加新部门关系
        addRelation(
            "user:" + transfer.getUserId(),
            "member",
            "team:" + transfer.getNewTeamId()
        );
        
        // 删除旧项目组关系（项目组与部门绑定）
        projectGroups.findByDepartment(transfer.getOldDept())
            .forEach(pg -> removeRelation(
                "user:" + transfer.getUserId(),
                "member",
                "project:" + pg.getId()
            ));
        
        // 添加新项目组关系
        projectGroups.findByDepartment(transfer.getNewDept())
            .forEach(pg -> addRelation(
                "user:" + transfer.getUserId(),
                "member",
                "project:" + pg.getId()
            ));
    }
}

@Service
public class ReBACPerformanceService {
    
    // 预计算常用的关系组合
    private LoadingCache<String, Boolean> computedPermissions;
    
    /**
     * 限制最大遍历深度
     */
    public static final int MAX_TRAVERSAL_DEPTH = 5;
    
    /**
     * 超出深度的查询降级处理
     */
    public PermissionResult checkPermission(
            String subject, String object, String relation) {
        
        try {
            return graphService.checkWithTimeout(
                subject, object, relation,
                MAX_TRAVERSAL_DEPTH,
                100, TimeUnit.MILLISECONDS  // 100ms 超时
            );
        } catch (TimeoutException e) {
            // 超时降级：保守拒绝
            return PermissionResult.denied("查询超时，保守拒绝");
        }
    }
}

public class CycleDetector {
    
    /**
     * 检测关系变更是否会产生循环
     */
    public boolean wouldCreateCycle(RelationTuple newTuple) {
        // 特殊关系类型才需要检测
        if (!requiresCycleCheck(newTuple.getRelation())) {
            return false;
        }
        
        // BFS 检测是否有回路
        Graph graph = buildCurrentGraph();
        return graph.hasCycleAfterAdding(
            newTuple.getSubject(),
            newTuple.getObject()
        );
    }
    
    private boolean requiresCycleCheck(String relation) {
        // 只有层级关系需要检测循环
        return Set.of("manager", "parent", "owner", "member")
            .contains(relation);
    }
}

@Entity
@Table(name = "relation_tuples")
public class RelationTuple {
    
    @Id
    private String id;
    
    @Column(nullable = false)
    private String namespace;
    
    @Column(nullable = false)
    private String objectId;
    
    @Column(nullable = false)
    private String relation;
    
    @Column(nullable = false)
    private String subjectId;
    
    @Column
    private String subjectRelation;  // 通用的 subject 可以指定子关系
    
    @Column
    private Instant createdAt;
    
    @Column
    private Instant deletedAt;  // 软删除
}

@Service
public class ReBACPermissionChecker {
    
    @Autowired
    private TupleRepository tupleRepository;
    
    @Autowired
    private GraphService graphService;
    
    /**
     * 检查权限：subject 是否对 object 有 relation 权限
     */
    public PermissionCheckResult check(
            String subject,
            String namespace,
            String objectId,
            String relation) {
        
        // 1. 直接关系检查
        if (hasDirectRelation(subject, namespace, objectId, relation)) {
            return PermissionCheckResult.permit();
        }
        
        // 2. 通配符关系检查
        if (hasWildcardRelation(subject, namespace, objectId, relation)) {
            return PermissionCheckResult.permit();
        }
        
        // 3. 关系路径遍历
        Set<String> reachable = graphService.findReachable(
            subject, namespace + ":" + objectId);
        
        for (String target : reachable) {
            if (impliesRelation(target, relation)) {
                return PermissionCheckResult.permit();
            }
        }
        
        return PermissionCheckResult.denied();
    }
    
    /**
     * 关系蕴含：owner 蕴含 editor 和 viewer
     */
    private boolean impliesRelation(String sourceRelation, String targetRelation) {
        Map<String, Set<String>> hierarchy = Map.of(
            "owner", Set.of("editor", "viewer", "commenter"),
            "editor", Set.of("viewer", "commenter"),
            "viewer", Set.of()
        );
        
        return hierarchy.getOrDefault(sourceRelation, Set.of())
            .contains(targetRelation);
    }
}