《互联网产品的服务端架构·交易、增长与平台化》12.1 后台的权限与审计

// file: internal/admin/permission.go
// tier: L1
// verify: go test ./internal/admin/

package admin

import (
	"errors"
	"fmt"
	"strings"
)

var (
	// ErrEmptyRoleName 表示角色名为空，无法在审计日志里定位授权主体。
	ErrEmptyRoleName = errors.New("admin: empty role name")
	// ErrDuplicateRole 表示同一个权限集合里出现了重复角色。
	ErrDuplicateRole = errors.New("admin: duplicate role name")
	// ErrEmptyPerm 表示权限字符串为空，空权限不能授予任何能力。
	ErrEmptyPerm = errors.New("admin: empty permission")
)

// Role 是后台的一个角色。Name 是角色标识，Perms 是该角色拥有的权限点。
// 后台权限与面向用户的权限是两套体系：用户权限决定“能看什么”，
// 后台权限决定“能改什么”，两者不能共用同一个角色表。
type Role struct {
	Name  string
	Perms []string
}

// Validate 检查角色定义本身是否合法。角色名不能为空白且不能重复；
// 每个权限字符串也不能为空白。它只校验定义，不判断某次请求是否放行。
func Validate(roles []Role) error {
	seen := make(map[string]struct{}, len(roles))
	for i, role := range roles {
		name := strings.TrimSpace(role.Name)
		if name == "" {
			return fmt.Errorf("%w: index %d", ErrEmptyRoleName, i)
		}
		if _, ok := seen[name]; ok {
			return fmt.Errorf("%w: %q", ErrDuplicateRole, name)
		}
		seen[name] = struct{}{}
		for j, perm := range role.Perms {
			if strings.TrimSpace(perm) == "" {
				return fmt.Errorf("%w: role %q index %d", ErrEmptyPerm, name, j)
			}
		}
	}
	return nil
}

// Allow 判断这组角色是否拥有 perm。任意一个角色命中即通过。
// 权限点支持冒号结尾的通配前缀，例如 order:* 命中 order:read 和
// order:refund，但不命中 order 本身。空 perm 一律拒绝。
func Allow(roles []Role, perm string) bool {
	if strings.TrimSpace(perm) == "" {
		return false
	}
	for _, role := range roles {
		for _, granted := range role.Perms {
			if granted == perm {
				return true
			}
			if strings.HasSuffix(granted, ":*") {
				prefix := strings.TrimSuffix(granted, "*")
				if strings.HasPrefix(perm, prefix) {
					return true
				}
			}
		}
	}
	return false
}

// file: internal/admin/permission_test.go
// tier: L1
// verify: go test ./internal/admin/

package admin

import (
	"errors"
	"testing"
)

func TestValidate(t *testing.T) {
	ok := []Role{
		{Name: "cs", Perms: []string{"order:read"}},
		{Name: "ops", Perms: []string{"order:*", "campaign:write"}},
	}
	if err := Validate(ok); err != nil {
		t.Fatalf("valid roles = %v, want nil", err)
	}

	if err := Validate([]Role{{Name: "  ", Perms: []string{"order:read"}}}); !errors.Is(err, ErrEmptyRoleName) {
		t.Fatalf("blank name = %v, want ErrEmptyRoleName", err)
	}
	if err := Validate([]Role{{Name: "cs"}, {Name: "cs"}}); !errors.Is(err, ErrDuplicateRole) {
		t.Fatalf("duplicate role = %v, want ErrDuplicateRole", err)
	}
	if err := Validate([]Role{{Name: "cs", Perms: []string{"order:read", " "}}}); !errors.Is(err, ErrEmptyPerm) {
		t.Fatalf("blank perm = %v, want ErrEmptyPerm", err)
	}
}

func TestAllowExact(t *testing.T) {
	roles := []Role{{Name: "cs", Perms: []string{"order:read", "refund:create"}}}
	if !Allow(roles, "order:read") {
		t.Fatal("order:read should be allowed")
	}
	if !Allow(roles, "refund:create") {
		t.Fatal("refund:create should be allowed")
	}
	if Allow(roles, "order:refund") {
		t.Fatal("order:refund should not be allowed")
	}
}

func TestAllowWildcard(t *testing.T) {
	roles := []Role{{Name: "ops", Perms: []string{"order:*"}}}
	for _, perm := range []string{"order:read", "order:refund", "order:export"} {
		if !Allow(roles, perm) {
			t.Fatalf("%s should match order:*", perm)
		}
	}
	if Allow(roles, "order") {
		t.Fatal("order should not match order:*")
	}
	if Allow(roles, "campaign:write") {
		t.Fatal("campaign:write should not match order:*")
	}
}

func TestAllowAnyRole(t *testing.T) {
	roles := []Role{
		{Name: "cs", Perms: []string{"order:read"}},
		{Name: "ops", Perms: []string{"order:*"}},
	}
	if !Allow(roles, "order:refund") {
		t.Fatal("second role should grant order:refund")
	}
	if Allow(nil, "order:read") {
		t.Fatal("nil roles should deny")
	}
}

func TestAllowEmptyPerm(t *testing.T) {
	roles := []Role{{Name: "ops", Perms: []string{"order:*"}}}
	for _, perm := range []string{"", "   "} {
		if Allow(roles, perm) {
			t.Fatalf("empty perm %q should be denied", perm)
		}
	}
}

cd .local/checks/webapp-lab && go test ./internal/admin/ -run 'TestValidate|TestAllow' -count=1 -v

=== RUN   TestValidate
--- PASS: TestValidate (0.00s)
=== RUN   TestAllowExact
--- PASS: TestAllowExact (0.00s)
=== RUN   TestAllowWildcard
--- PASS: TestAllowWildcard (0.00s)
=== RUN   TestAllowAnyRole
--- PASS: TestAllowAnyRole (0.00s)
=== RUN   TestAllowEmptyPerm
--- PASS: TestAllowEmptyPerm (0.00s)
PASS
ok  	webapp/internal/admin	0.243s