package jnpf.dmsService;
|
|
import jnpf.base.UserInfo;
|
import jnpf.dmsEntity.permission.entity.DmsFilePermissionEntity;
|
import jnpf.dmsEntity.permission.enums.DmsPermissionAction;
|
import jnpf.dmsEntity.permission.form.PermissionDecisionForm;
|
import jnpf.dmsEntity.permission.model.DmsResourcePath;
|
import jnpf.dmsEntity.permission.model.DmsSubjectSet;
|
import jnpf.dmsEntity.permission.vo.DmsPermissionDecisionVO;
|
import jnpf.dmsMapper.DmsFilePermissionMapper;
|
import jnpf.dmsIntegration.audit.DmsAuditAdapter;
|
import jnpf.dmsPermission.DmsAccessExclusionResolver;
|
import jnpf.dmsPermission.DmsCurrentIdentity;
|
import jnpf.dmsPermission.DmsPermissionError;
|
import jnpf.dmsPermission.DmsPermissionException;
|
import jnpf.dmsPermission.DmsPermissionGroupMembershipResolver;
|
import jnpf.dmsPermission.DmsPermissionMatcher;
|
import jnpf.dmsPermission.DmsPermissionProperties;
|
import jnpf.dmsPermission.DmsResourceResolver;
|
import jnpf.dmsPermission.DmsSubjectResolver;
|
import lombok.RequiredArgsConstructor;
|
import org.springframework.stereotype.Service;
|
import org.springframework.transaction.annotation.Transactional;
|
|
import java.util.ArrayList;
|
import java.util.Collections;
|
import java.util.LinkedHashSet;
|
import java.util.List;
|
import java.util.Map;
|
import java.util.Set;
|
import java.util.UUID;
|
import java.util.stream.Collectors;
|
|
@Service
|
@RequiredArgsConstructor
|
public class DmsPermissionDecisionService {
|
private final DmsCurrentIdentity currentIdentity;
|
private final DmsSubjectResolver subjectResolver;
|
private final DmsResourceResolver resourceResolver;
|
private final DmsFilePermissionMapper permissionMapper;
|
private final DmsPermissionGroupMembershipResolver groupMembershipResolver;
|
private final DmsPermissionMatcher matcher;
|
private final DmsPermissionProperties properties;
|
private final DmsAuditAdapter auditAdapter;
|
private final DmsAccessExclusionResolver exclusionResolver;
|
|
@Transactional(readOnly = true)
|
public DmsPermissionDecisionVO evaluate(PermissionDecisionForm request) {
|
return evaluate(Collections.singletonList(request)).get(0);
|
}
|
|
@Transactional(readOnly = true)
|
public List<DmsPermissionDecisionVO> evaluate(List<PermissionDecisionForm> requests) {
|
if (requests == null || requests.isEmpty() || requests.size() > properties.getMaxDecisionBatchSize()) {
|
throw DmsPermissionException.of(DmsPermissionError.INVALID_REQUEST,
|
"裁决批量大小必须在 1 到 " + properties.getMaxDecisionBatchSize() + " 之间");
|
}
|
UserInfo user = currentIdentity.requireUser();
|
String tenantId = currentIdentity.tenantId(user);
|
Map<UUID, DmsResourcePath> paths = resourceResolver.resolveAll(tenantId, requests);
|
List<DmsResourcePath> readPaths = requests.stream()
|
.filter(request -> request.getActionCode() == DmsPermissionAction.READ)
|
.map(request -> paths.get(request.getResourceId()))
|
.collect(Collectors.toList());
|
DmsAccessExclusionResolver.Snapshot exclusions = exclusionResolver.resolve(
|
tenantId, user.getUserId().trim(), readPaths);
|
|
List<PermissionDecisionForm> eligibleRequests = requests.stream()
|
.filter(request -> !isReadExcluded(request, paths.get(request.getResourceId()), exclusions))
|
.collect(Collectors.toList());
|
|
Map<String, List<DmsFilePermissionEntity>> candidatesByAction = new java.util.HashMap<>();
|
Set<String> permissionGroupIds = new LinkedHashSet<>();
|
DmsSubjectSet subjects = null;
|
if (!eligibleRequests.isEmpty()) {
|
subjects = subjectResolver.resolve(user);
|
LinkedHashSet<String> actionCodes = new LinkedHashSet<>();
|
LinkedHashSet<UUID> resourceIds = new LinkedHashSet<>();
|
for (PermissionDecisionForm request : eligibleRequests) {
|
actionCodes.add(request.getActionCode().name());
|
resourceIds.addAll(resourceResolver.candidateResourceIds(paths.get(request.getResourceId())));
|
}
|
List<DmsFilePermissionEntity> candidates = permissionMapper.selectCandidates(tenantId,
|
new ArrayList<>(actionCodes), new ArrayList<>(resourceIds));
|
for (DmsFilePermissionEntity candidate : candidates) {
|
candidatesByAction.computeIfAbsent(candidate.getActionCode(), key -> new ArrayList<>())
|
.add(candidate);
|
if ("GROUP".equals(candidate.getPrincipalType())) {
|
permissionGroupIds.add(candidate.getPrincipalId());
|
}
|
}
|
groupMembershipResolver.resolve(permissionGroupIds, subjects);
|
}
|
|
List<DmsPermissionDecisionVO> result = new ArrayList<>();
|
for (PermissionDecisionForm request : requests) {
|
DmsPermissionDecisionVO decision = denied(request);
|
DmsResourcePath path = paths.get(request.getResourceId());
|
if (isReadExcluded(request, path, exclusions)) {
|
decision.setReasonCode("USER_READ_EXCLUDED");
|
} else {
|
for (DmsFilePermissionEntity candidate : candidatesByAction.getOrDefault(
|
request.getActionCode().name(), Collections.<DmsFilePermissionEntity>emptyList())) {
|
if (matcher.matches(candidate, path, subjects)) {
|
decision.setAllowed(true);
|
decision.setReasonCode("ALLOWED");
|
decision.setMatchedPermissionId(candidate.getId());
|
if (candidate.getMaxUseCount() != null) {
|
decision.setRemainingUseCount(candidate.getMaxUseCount() - candidate.getUsedCount());
|
}
|
break;
|
}
|
}
|
}
|
auditAdapter.permissionDecision(decision.isAllowed(), request.getActionCode().name(),
|
request.getResourceId().toString(), "{\"reasonCode\":\"" + decision.getReasonCode() + "\"}");
|
result.add(decision);
|
}
|
return result;
|
}
|
|
private boolean isReadExcluded(PermissionDecisionForm request, DmsResourcePath path,
|
DmsAccessExclusionResolver.Snapshot exclusions) {
|
return request.getActionCode() == DmsPermissionAction.READ && exclusions.excludes(path);
|
}
|
|
public void requireAllowed(jnpf.dmsEntity.permission.enums.DmsResourceType type, UUID id,
|
jnpf.dmsEntity.permission.enums.DmsPermissionAction action) {
|
PermissionDecisionForm request = new PermissionDecisionForm();
|
request.setResourceType(type);
|
request.setResourceId(id);
|
request.setActionCode(action);
|
if (!evaluate(request).isAllowed()) {
|
throw DmsPermissionException.of(DmsPermissionError.PERMISSION_DENIED,
|
"当前用户没有所需的 " + action.name() + " 权限");
|
}
|
}
|
|
private DmsPermissionDecisionVO denied(PermissionDecisionForm request) {
|
DmsPermissionDecisionVO result = new DmsPermissionDecisionVO();
|
result.setResourceId(request.getResourceId());
|
result.setResourceType(request.getResourceType().name());
|
result.setActionCode(request.getActionCode().name());
|
result.setAllowed(false);
|
result.setReasonCode("NO_MATCHING_PERMISSION");
|
return result;
|
}
|
}
|
