管理后台权限设计

用户 (N) ←→ 角色 (N) ←→ 权限 (N) ←→ 资源 (N)

// 权限标识采用 "模块:资源:操作" 的命名规范
const PERMISSIONS = {
  // 内容模块
  CONTENT_ARTICLE_VIEW: 'content:article:view',
  CONTENT_ARTICLE_CREATE: 'content:article:create',
  CONTENT_ARTICLE_EDIT: 'content:article:edit',
  CONTENT_ARTICLE_DELETE: 'content:article:delete',
  CONTENT_ARTICLE_PUBLISH: 'content:article:publish',
 
  // 用户模块
  USER_LIST_VIEW: 'user:list:view',
  USER_DETAIL_VIEW: 'user:detail:view',
  USER_ACCOUNT_DISABLE: 'user:account:disable',
 
  // 财务模块
  FINANCE_BILL_VIEW: 'finance:bill:view',
  FINANCE_SETTLEMENT_OPERATE: 'finance:settlement:operate',
  FINANCE_EXPORT: 'finance:report:export',
} as const

// 数据权限中间件示例
function applyDataScope(query: Query, user: User) {
  // 行级过滤：只看自己负责的区域
  if (user.dataScope === 'REGION') {
    query.where('region', 'IN', user.allowedRegions)
  }
  // 列级脱敏：隐藏敏感字段
  if (user.dataScope === 'DESENSITIZED') {
    query.select('id', 'name', 'email', raw('CONCAT(LEFT(phone, 3), "****", RIGHT(phone, 4)) as phone'))
  }
  return query
}

// 前端权限控制组件
function PermissionGuard({
  permission,
  children,
  fallback,
}: {
  permission: string
  children: React.ReactNode
  fallback?: React.ReactNode
}) {
  const { hasPermission } = usePermission()
 
  if (!hasPermission(permission)) {
    return fallback ?? null
  }
 
  return <>{children}</>
}
 
// 使用示例
<PermissionGuard permission="content:article:delete">
  <Button variant="destructive" onClick={handleDelete}>
    删除文章
  </Button>
</PermissionGuard>

// Hono 后端权限中间件
function requirePermission(...permissions: string[]) {
  return async (c: Context, next: Next) => {
    const user = c.get('user')
    const userPermissions = await getUserPermissions(user.id)
 
    const hasAll = permissions.every((p) => userPermissions.includes(p))
    if (!hasAll) {
      return c.json({ error: '权限不足' }, 403)
    }
 
    await next()
  }
}
 
// 路由使用
app.delete('/api/articles/:id', requirePermission('content:article:delete'), async (c) => {
  // 业务逻辑
})

// 审计日志记录服务
class AuditLogService {
  async log(entry: AuditLogEntry) {
    // 异步写入，不影响主业务流程
    await this.queue.publish('audit-log', {
      ...entry,
      timestamp: new Date().toISOString(),
    })
  }
 
  async query(filter: AuditLogFilter): Promise<AuditLogEntry[]> {
    // 支持按操作人、操作类型、资源类型、时间范围查询
    return this.db.auditLog.findMany({
      where: {
        actor_id: filter.actorId,
        action: filter.action,
        resource_type: filter.resourceType,
        timestamp: { gte: filter.startTime, lte: filter.endTime },
      },
      orderBy: { timestamp: 'desc' },
      take: filter.pageSize,
      skip: filter.offset,
    })
  }
}
 
// 在业务中间件中自动记录
function auditMiddleware(action: string, getResource: (c: Context) => ResourceInfo) {
  return async (c: Context, next: Next) => {
    await next()
 
    const resource = getResource(c)
    await auditLogService.log({
      actor_id: c.get('user').id,
      actor_name: c.get('user').name,
      action,
      resource_type: resource.type,
      resource_id: resource.id,
      resource_name: resource.name,
      ip_address: c.req.header('x-forwarded-for') ?? '',
      user_agent: c.req.header('user-agent') ?? '',
      result: c.res.status < 400 ? 'SUCCESS' : 'FAILURE',
      detail: c.get('audit_diff'),
    })
  }
}

// 职责分离配置
const SEPARATION_RULES = [
  {
    name: '资金操作分离',
    mutuallyExclusivePermissions: [
      ['finance:payment:create', 'finance:payment:approve'],
    ],
  },
  {
    name: '内容发布分离',
    mutuallyExclusivePermissions: [
      ['content:article:edit', 'content:article:publish'],
    ],
  },
]
 
// 校验用户是否违反职责分离规则
function checkSeparation(userId: string, newPermission: string): boolean {
  const userPermissions = getUserPermissions(userId)
  for (const rule of SEPARATION_RULES) {
    for (const [permA, permB] of rule.mutuallyExclusivePermissions) {
      if (
        (userPermissions.includes(permA) && newPermission === permB) ||
        (userPermissions.includes(permB) && newPermission === permA)
      ) {
        return false // 违反分离规则
      }
    }
  }
  return true
}

const ROLES = {
  SUPER_ADMIN: {
    name: '超级管理员',
    permissions: ['*'], // 全部权限
  },
  CONTENT_ADMIN: {
    name: '内容管理员',
    permissions: [
      'content:*:view',
      'content:*:create',
      'content:*:edit',
      'content:article:publish',
      'content:comic:audit',
    ],
  },
  CUSTOMER_SERVICE: {
    name: '客服专员',
    permissions: [
      'user:list:view',
      'user:detail:view',
      'ticket:*:view',
      'ticket:reply:create',
      'refund:create', // 退款发起，超过 100 美元需审批
    ],
  },
  FINANCE: {
    name: '财务管理',
    permissions: [
      'finance:bill:view',
      'finance:settlement:view',
      'finance:settlement:operate',
      'finance:report:export',
    ],
  },
  DATA_ANALYST: {
    name: '数据分析师',
    permissions: [
      'dashboard:view',
      'report:*:view',
      'report:*:export',
    ],
  },
  TECH_ADMIN: {
    name: '技术管理员',
    permissions: [
      'model:*:view',
      'model:*:edit',
      'apikey:*:manage',
      'system:log:view',
    ],
  },
}

// 数据模型：权限与租户关联
interface TenantRole {
  id: string
  tenant_id: string // 租户隔离
  name: string
  permissions: string[]
  is_system: boolean // 系统预置角色不可删除
  created_by: string
}
 
// 查询时强制租户隔离
function getRoles(tenantId: string) {
  return db.tenantRole.findMany({
    where: { tenant_id: tenantId },
  })
}
 
// 权限校验时同时校验租户归属
function checkPermission(userId: string, permission: string, tenantId: string) {
  const user = getUserWithRoles(userId)
  if (user.tenant_id !== tenantId) {
    return false // 跨租户访问拒绝
  }
  const rolePermissions = getPermissionsForRoles(user.roles)
  return rolePermissions.includes(permission)
}