-- 用户
t_user(id, username, email, tenant_id)

-- 租户
t_tenant(id, name, plan_type, status)

-- 项目
t_project(id, tenant_id, name, description)

-- 角色
t_role(id, scope ENUM('global','tenant','project'), code, name)

-- 权限
t_permission(id, resource, action, description)
-- 示例： ('device', 'view'), ('device', 'control'), ('product', 'edit')

-- 角色-权限 绑定
t_role_permission(role_id, permission_id)

-- 用户-角色-作用域 绑定
t_user_role_scope(
    user_id INT,
    role_id INT,
    tenant_id INT NULL,
    project_id INT NULL,
    UNIQUE(user_id, role_id, tenant_id, project_id)
)

t_policy(
    id INT PRIMARY KEY,
    effect ENUM('allow','deny'),
    subject_expr VARCHAR,  -- 用户属性表达式
    resource_expr VARCHAR, -- 资源属性表达式
    action VARCHAR,        -- 动作
    condition_json JSON,   -- 其他条件（时间、通道等）
    description TEXT
)

def check_permission(user, action, resource):
    # Step 1: 基于 RBAC
    if not has_rbac_permission(user, resource, action):
        return False

    # Step 2: 加载 ABAC 策略
    policies = load_abac_policies(action)
    for p in policies:
        if eval_expr(p.subject_expr, user) and eval_expr(p.resource_expr, resource):
            if match_condition(p.condition_json, user, resource):
                return p.effect == "allow"

    return False

[request_definition]
r = sub, obj, act, attr

[policy_definition]
p = sub, obj, act, attr, eft

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = r.sub.role == p.sub && r.obj.type == p.obj && r.act == p.act && eval(p.attr)

def authorize(user, resource, action):
    adapter = casbin_sql_adapter.Adapter("mysql://...")
    e = casbin.Enforcer("model.conf", adapter)
    attr = {"obj": resource, "sub": user}
    return e.enforce(user.role, resource.type, action, attr)

{
  "name": "rbac-abac-node-mongo",
  "version": "1.0.0",
  "main": "src/index.js",
  "scripts": {
    "start": "node src/index.js",
    "seed": "node seed.js"
  },
  "dependencies": {
    "express": "^4.18.2",
    "mongoose": "^7.0.0",
    "jsonwebtoken": "^9.0.0",
    "jsonlogic-js": "^1.2.2",
    "lodash": "^4.17.21",
    "body-parser": "^1.20.2"
  }
}

npm install

const mongoose = require('mongoose');
const Schema = mongoose.Schema;

const RoleSchema = new Schema({
  code: { type: String, unique: true }, // e.g. "tenant_admin", "product_manager", "developer"
  name: String,
  scope: { type: String, enum: ['global','tenant','project'], default: 'project' }
});
module.exports = mongoose.model('Role', RoleSchema);

const mongoose = require('mongoose');
const Schema = mongoose.Schema;

const PermissionSchema = new Schema({
  resource: String, // e.g. "product", "device"
  action: String,   // e.g. "view","edit","control"
  description: String
});
module.exports = mongoose.model('Permission', PermissionSchema);

const mongoose = require('mongoose');
const Schema = mongoose.Schema;

const UserRoleSchema = new Schema({
  role: { type: Schema.Types.ObjectId, ref: 'Role' },
  tenantId: { type: Schema.Types.ObjectId, ref: 'Tenant', required: false },
  projectId: { type: Schema.Types.ObjectId, ref: 'Project', required: false }
}, { _id: false });

const UserSchema = new Schema({
  username: String,
  email: String,
  passwordHash: String,
  tenantId: { type: Schema.Types.ObjectId, ref: 'Tenant' },
  attributes: Schema.Types.Mixed, // 任意用户属性（department, tags, etc）
  roles: [UserRoleSchema]
});
module.exports = mongoose.model('User', UserSchema);

const mongoose = require('mongoose');
const Schema = mongoose.Schema;

const ProjectSchema = new Schema({
  tenantId: { type: Schema.Types.ObjectId, ref: 'Tenant' },
  name: String
});
module.exports = mongoose.model('Project', ProjectSchema);

const mongoose = require('mongoose');
const Schema = mongoose.Schema;

const ProductSchema = new Schema({
  projectId: { type: Schema.Types.ObjectId, ref: 'Project' },
  name: String,
  status: { type: String, enum: ['developing','testing','released','archived'], default: 'developing' },
  ownerUserId: { type: Schema.Types.ObjectId, ref: 'User' },
  attributes: Schema.Types.Mixed
});
module.exports = mongoose.model('Product', ProductSchema);

const mongoose = require('mongoose');
const Schema = mongoose.Schema;

/*
Policy doc fields:
- name
- effect: 'allow'|'deny'
- subject: e.g. "role == 'developer' || attributes.department == 'iot_ops'"
- resource: e.g. "resource.type == 'product'"
- action: e.g. "edit"
- condition: JSONLogic expression for runtime check involving user, resource, env
- priority: higher wins (optional)
*/
const PolicySchema = new Schema({
  name: String,
  effect: { type: String, enum: ['allow','deny'], default: 'allow' },
  subjectExpr: String,
  resourceExpr: String,
  action: String,
  condition: Schema.Types.Mixed,
  priority: { type: Number, default: 0 }
});

module.exports = mongoose.model('Policy', PolicySchema);

const jsonLogic = require('jsonlogic-js');
const _ = require('lodash');
const Policy = require('../models/Policy');
const Permission = require('../models/Permission');

/**
 * checkPermission: 混合 RBAC + ABAC 校验入口
 * @param {Object} user - Mongoose user doc (包含 roles[])
 * @param {Object} resource - 资源对象（例如 product doc）
 * @param {String} action - 动作 (e.g. 'edit')
 * @param {Object} env - 环境属性 (e.g. {now: '2025-10-13T..', channel: 'api'})
 */
async function checkPermission(user, resource, action, env = {}) {
  // 1) RBAC 初筛：用户是否拥有角色，并且角色拥有基础 permission?
  //    这里的简单策略：先把角色对应的 permission 存在 policy 或 role->permission 表中
  //    在本示例，我们用 policy 存放高级策略；也可用 role->permission 作为白名单优化。
  //    为保持通用性：先允许 RBAC 通过（假设角色允许），再靠 ABAC 精细控制。
  //    如果你需要严格的 RBAC 拒绝，则先检查 role_permission 表（未实现示例）
  
  // 2) 加载可能匹配的策略 (action + resource.type)
  const resourceType = resource.type || resource._doc && resource._doc.constructor.modelName.toLowerCase() || 'product';
  const policies = await Policy.find({ action, $or: [
    { resourceExpr: new RegExp(resourceType, 'i') },
    { resourceExpr: '' }, // 通配
  ]}).sort({ priority: -1 }).lean();

  // 3) Evaluate policies sequentially (priority)
  // Build evaluation context
  const ctx = {
    user: {
      id: user._id.toString(),
      username: user.username,
      tenantId: user.tenantId ? user.tenantId.toString() : null,
      roles: (user.roles || []).map(r => r.role && (r.role.code || r.role.toString())),
      attributes: user.attributes || {}
    },
    resource: {
      id: resource._id ? resource._id.toString() : null,
      type: resourceType,
      status: resource.status,
      ownerUserId: resource.ownerUserId ? resource.ownerUserId.toString() : null,
      attributes: resource.attributes || {}
    },
    env
  };

  // If no policies found, fallback deny
  if (!policies || policies.length === 0) {
    return false;
  }

  // Evaluate each policy: first match wins (we assume priority sorted)
  for (const p of policies) {
    // quick subject/resource text match (optional) to skip unnecessary jsonlogic
    if (p.subjectExpr) {
      // naive eval: allow simple contains / role== checks
      // For production, use safe expression evaluators. Here we do simple checks:
      // if subjectExpr contains role name, check user.roles includes it
      const tokens = p.subjectExpr.match(/\b[a-zA-Z0-9_]+\b/g) || [];
      let skip = true;
      for (const t of tokens) {
        if (t.toLowerCase() === 'role' || t.toLowerCase() === 'roles') { skip = false; break; }
        if ((ctx.user.roles || []).includes(t)) { skip = false; break; }
      }
      // not strict — keep evaluating condition anyway
    }

    // Evaluate JSONLogic condition if present
    let matched = true;
    if (p.condition && Object.keys(p.condition).length > 0) {
      try {
        matched = jsonLogic.apply(p.condition, ctx);
      } catch (err) {
        matched = false;
      }
    }

    if (matched) {
      return p.effect === 'allow';
    }
  }

  // default deny
  return false;
}

module.exports = {
  checkPermission
};

const jwt = require('jsonwebtoken');
const User = require('../models/User');

const SECRET = 'changeme_secret'; // production use env var

async function authMiddleware(req, res, next) {
  const auth = req.headers.authorization;
  if (!auth) return res.status(401).json({ error: 'missing auth' });
  const token = auth.split(' ')[1];
  try {
    const decoded = jwt.verify(token, SECRET);
    const user = await User.findById(decoded.sub).populate('roles.role').lean();
    if (!user) return res.status(401).json({ error: 'invalid user' });
    req.user = user;
    next();
  } catch (err) {
    return res.status(401).json({ error: 'invalid token' });
  }
}

module.exports = authMiddleware;
module.exports.SECRET = SECRET;

const express = require('express');
const router = express.Router();
const Product = require('../models/Product');
const enforcer = require('../services/enforcer');

router.get('/:id', async (req, res) => {
  const prod = await Product.findById(req.params.id).lean();
  if (!prod) return res.status(404).send('not found');

  const allowed = await enforcer.checkPermission(req.user, prod, 'view', {now: new Date().toISOString(), channel: 'api'});
  if (!allowed) return res.status(403).send('forbidden');
  res.json(prod);
});

router.post('/:id/edit', async (req, res) => {
  const prod = await Product.findById(req.params.id);
  if (!prod) return res.status(404).send('not found');

  const allowed = await enforcer.checkPermission(req.user, prod, 'edit', {now: new Date().toISOString(), channel: 'api'});
  if (!allowed) return res.status(403).send('forbidden');

  // perform edit (simple example)
  prod.name = req.body.name || prod.name;
  await prod.save();
  res.json(prod);
});

module.exports = router;

const express = require('express');
const bodyParser = require('body-parser');
const mongoose = require('mongoose');
const auth = require('./middleware/auth');
const productRoutes = require('./routes/product');

const app = express();
app.use(bodyParser.json());

mongoose.connect('mongodb://localhost:27017/rbac_abac_example', { useNewUrlParser: true, useUnifiedTopology: true });

app.use('/product', auth, productRoutes);

app.listen(3000, () => {
  console.log('listening at 3000');
});

const mongoose = require('mongoose');
const Role = require('./src/models/Role');
const User = require('./src/models/User');
const Policy = require('./src/models/Policy');
const Product = require('./src/models/Product');

async function seed() {
  await mongoose.connect('mongodb://localhost:27017/rbac_abac_example');

  // 清空
  await Role.deleteMany({});
  await User.deleteMany({});
  await Policy.deleteMany({});
  await Product.deleteMany({});

  // 角色
  const devRole = await Role.create({ code: 'developer', name: 'Developer', scope: 'project' });
  const pmRole = await Role.create({ code: 'product_manager', name: 'Product Manager', scope: 'project' });
  const operatorRole = await Role.create({ code: 'operator', name: 'Operator', scope: 'project' });

  // 用户
  const alice = await User.create({
    username: 'alice',
    email: 'alice@example.com',
    tenantId: null,
    attributes: { department: 'engineering' },
    roles: [{ role: devRole._id }]
  });

  const bob = await User.create({
    username: 'bob',
    email: 'bob@example.com',
    attributes: { department: 'product' },
    roles: [{ role: pmRole._id }]
  });

  // 产品
  const p = await Product.create({
    name: 'sensor-x',
    status: 'developing',
    ownerUserId: alice._id,
    attributes: { model: 'x100' }
  });

  // 策略：开发者可以 edit 状态为 developing 的产品（JSONLogic）
  await Policy.create({
    name: 'dev-can-edit-developing',
    effect: 'allow',
    subjectExpr: 'developer',
    resourceExpr: 'product',
    action: 'edit',
    condition: {
      "and": [
        { "in": [ "developer", { "var": "user.roles" } ] },
        { "==": [ { "var": "resource.status" }, "developing" ] }
      ]
    },
    priority: 10
  });

  // 策略：产品经理可以 edit 所有状态为 developing 或 testing
  await Policy.create({
    name: 'pm-edit-dev-test',
    effect: 'allow',
    subjectExpr: 'product_manager',
    resourceExpr: 'product',
    action: 'edit',
    condition: {
      "and": [
        { "in": [ "product_manager", { "var": "user.roles" } ] },
        { "in": [ { "var": "resource.status" }, ["developing", "testing"] ] }
      ]
    },
    priority: 10
  });

  // 策略：operator 只能 view online devices (示例展示)
  await Policy.create({
    name: 'operator-view-online',
    effect: 'allow',
    subjectExpr: 'operator',
    resourceExpr: 'device',
    action: 'view',
    condition: {
      "and": [
        { "in": [ "operator", { "var": "user.roles" } ] },
        { "==": [ { "var": "resource.status" }, "online" ] }
      ]
    },
    priority: 5
  });

  console.log('seeded. user alice id:', alice._id.toString(), 'product id:', p._id.toString());
  process.exit(0);
}

seed();

node seed.js

const jwt = require('jsonwebtoken');
const token = jwt.sign({ sub: '<alice_id>' }, 'changeme_secret');
console.log(token);