Redis实现RBAC权限管理

go get -u github.com/gin-gonic/gin
go get -u github.com/golang-jwt/jwt/v5
go get -u github.com/redis/go-redis/v9

package main

import (
	"context"
	"fmt"
	"log"

	"github.com/redis/go-redis/v9"
)

// 初始化 Redis 客户端
var ctx = context.Background()
var redisClient = redis.NewClient(&redis.Options{
	Addr: "127.0.0.1:6379", // 连接 Redis
})

// 初始化 RBAC 角色 & 权限映射
func setupRBAC() {
	// 角色 → 权限
	redisClient.SAdd(ctx, "role_permissions:admin", "read", "write", "delete")
	redisClient.SAdd(ctx, "role_permissions:editor", "read", "write")
	redisClient.SAdd(ctx, "role_permissions:viewer", "read")

	// 权限 → API
	redisClient.SAdd(ctx, "permission_routes:read", "GET:/users", "GET:/articles")
	redisClient.SAdd(ctx, "permission_routes:write", "POST:/articles", "PUT:/articles")
	redisClient.SAdd(ctx, "permission_routes:delete", "DELETE:/articles")

	// 用户 → 角色
	redisClient.SAdd(ctx, "user_roles:1", "admin")
	redisClient.SAdd(ctx, "user_roles:2", "editor")
	redisClient.SAdd(ctx, "user_roles:3", "viewer")

	log.Println("RBAC 权限映射初始化完成")
}

package main

import (
	"fmt"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

// JWT 密钥
var jwtSecret = []byte("supersecretkey")

// 生成 JWT 令牌
func GenerateJWT(userID int) (string, error) {
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
		"user_id": userID,
		"exp":     time.Now().Add(24 * time.Hour).Unix(), // 24 小时有效
	})
	return token.SignedString(jwtSecret)
}

// 解析 JWT 令牌
func ParseJWT(tokenString string) (int, error) {
	token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
		return jwtSecret, nil
	})
	if err != nil || !token.Valid {
		return 0, fmt.Errorf("invalid token")
	}

	claims, ok := token.Claims.(jwt.MapClaims)
	if !ok {
		return 0, fmt.Errorf("invalid claims")
	}

	return int(claims["user_id"].(float64)), nil
}

// 访问权限检查
func hasAccess(userID int, method, path string) bool {
	// 1. 获取用户角色
	roles, err := redisClient.SMembers(ctx, fmt.Sprintf("user_roles:%d", userID)).Result()
	if err != nil || len(roles) == 0 {
		return false
	}

	// 2. 遍历角色，获取权限
	for _, role := range roles {
		permissions, _ := redisClient.SMembers(ctx, fmt.Sprintf("role_permissions:%s", role)).Result()
		for _, permission := range permissions {
			routes, _ := redisClient.SMembers(ctx, fmt.Sprintf("permission_routes:%s", permission)).Result()
			for _, route := range routes {
				if route == fmt.Sprintf("%s:%s", method, path) {
					return true
				}
			}
		}
	}

	return false
}

// RBAC 中间件
func RBACMiddleware() gin.HandlerFunc {
	return func(c *gin.Context) {
		tokenString := c.GetHeader("Authorization")
		if tokenString == "" {
			c.JSON(401, gin.H{"error": "未提供 Token"})
			c.Abort()
			return
		}

		// 解析 JWT
		userID, err := ParseJWT(tokenString)
		if err != nil {
			c.JSON(401, gin.H{"error": "Token 无效"})
			c.Abort()
			return
		}

		// 检查权限
		if !hasAccess(userID, c.Request.Method, c.FullPath()) {
			c.JSON(403, gin.H{"error": "无访问权限"})
			c.Abort()
			return
		}

		c.Set("userID", userID)
		c.Next()
	}
}

func main() {
	r := gin.Default()
	setupRBAC()

	// 登录
	r.POST("/login", func(c *gin.Context) {
		userID := 1 // 假设用户 1 登录
		token, _ := GenerateJWT(userID)
		c.JSON(200, gin.H{"token": token})
	})

	// 受保护 API
	api := r.Group("/api", RBACMiddleware())

	api.GET("/users", func(c *gin.Context) {
		c.JSON(200, gin.H{"message": "获取用户列表"})
	})

	api.POST("/articles", func(c *gin.Context) {
		c.JSON(200, gin.H{"message": "创建文章"})
	})

	api.DELETE("/articles", func(c *gin.Context) {
		c.JSON(200, gin.H{"message": "删除文章"})
	})

	r.Run(":8080")
}