Galosys.Foundation.Authorization
26.8.13.2
dotnet add package Galosys.Foundation.Authorization --version 26.8.13.2
NuGet\Install-Package Galosys.Foundation.Authorization -Version 26.8.13.2
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="Galosys.Foundation.Authorization" Version="26.8.13.2" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
<PackageVersion Include="Galosys.Foundation.Authorization" Version="26.8.13.2" />
<PackageReference Include="Galosys.Foundation.Authorization" />
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.
paket add Galosys.Foundation.Authorization --version 26.8.13.2
The NuGet Team does not provide support for this client. Please contact its maintainers for support.
#r "nuget: Galosys.Foundation.Authorization, 26.8.13.2"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
#:package Galosys.Foundation.Authorization@26.8.13.2
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.
#addin nuget:?package=Galosys.Foundation.Authorization&version=26.8.13.2
#tool nuget:?package=Galosys.Foundation.Authorization&version=26.8.13.2
The NuGet Team does not provide support for this client. Please contact its maintainers for support.
Galosys.Foundation.Authorization
框架无关的统一授权核心（PDP，Policy Decision Point）：四要素授权请求、富决策结果、阿里云 RAM 风格策略模型（PolicyRule）、结构化条件块、可插拔组合算法与评估引擎。零 Web 运行时依赖——Worker/Agent/桌面/API 各类宿主均可直接引用。
设计文档：
docs/designs/abac-design.md（整体架构与路线图）；Web 适配层见Galosys.Foundation.AspNetCore.Authorization。
能力清单
| 能力 | 说明 |
|---|---|
| 请求模型 | AuthorizationRequest（Subject/Resource/Action/Environment 四要素 + TenantId），属性袋支持运行时动态属性 |
| 富决策 | AuthorizationDecision：DecisionEffect + DenyReason + MatchedPolicies + Obligations/Advices |
| 策略模型 | PolicyRule（阿里云 RAM Statement 形状：Effect/Principals/Actions/Resources/Conditions/Priority）+ PolicyRuleSerializer JSON 往返 |
| 条件块 | ConditionBlock 结构化操作符（IP CIDR / 字符串 / 数值 / 日期 / 布尔 / contains / between / And-Or-Not 复合）+ ${subject.X} 模板引用 |
| 组合算法 | ICombiningAlgorithm：ForbidWins（默认，Deny 优先）/ DenyUnlessPermit / FirstApplicable |
| 评估引擎 | IAuthorizationEngine + DefaultAuthorizationEngine（默认拒绝 + 显式 Deny 优先 + 拒绝原因分类，内置 RBAC 主体展开与 ACL 无条件规则） |
| 存储抽象 | IAuthorizationPolicyRepository + ConfigurationPolicyRepository（对象/JSON 文件）+ PolicyCache 版本号轮询热更新；支持按主体查询 GetRulesForPrincipalAsync |
| 关键字注册表 | IAuthorizationAttributeProvider（user/resource/env 域，惰性取值）；PIP IAuthorizationAttributeResolver |
使用示例
注册（DI）
services.AddAuthorizationEngineCore(options =>
{
options.Policies = new[] { policyRule }; // 或 options.PolicyFilePath = "policies.json"
options.PollingInterval = TimeSpan.FromSeconds(30);
});
按主体查询策略（默认实现）
IAuthorizationPolicyRepository 提供 GetRulesForPrincipalAsync(principals, tenantId) 默认实现：全量拉取后按主体（user:{id} / role:{r}）与租户过滤，按优先级降序返回；未覆写的仓储直接可用，EF Core 存储等实现可在数据库侧覆写优化。
var rules = await repository.GetRulesForPrincipalAsync(
new[] { "user:1001", "role:admin" },
tenantId: "t1");
进程内引擎直用（Worker/Agent，零 Web 依赖）
var engine = sp.GetRequiredService<IAuthorizationEngine>();
var request = new AuthorizationRequest
{
Subject = new Subject("alice").WithAttr("Department", "finance"),
Resource = new Resource("acs:doc:*:*:report/2024-q1", "doc"),
Action = new Action("doc:Read"),
Environment = new EnvironmentContext().WithAttr("SourceIp", "10.0.0.42")
};
var decision = await engine.EvaluateAsync(request);
if (decision.IsAllowed)
{
// 执行操作
}
else
{
_logger.LogWarning("拒绝: {Reason}, 命中: {Policies}", decision.Reason, decision.MatchedPolicies);
}
策略 JSON（阿里云 RAM 风格）
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Principal": ["role:admin"],
"Action": ["doc:Read", "doc:List"],
"Resource": ["acs:doc:*:*:report/*"],
"Condition": { "op": "and", "children": [ /* ConditionBlock */ ] }
}
]
}
依赖
Galosys.Foundation.CoreMicrosoft.Extensions.DependencyInjection/Microsoft.Extensions.Logging
不依赖 任何 Microsoft.AspNetCore.*，也不依赖 Galosys.Foundation.AspNetCore / Galosys.Foundation.DataPermission。Web 适配（[Authorize] 管线、env.* 外部源）由 Galosys.Foundation.AspNetCore.Authorization 提供。
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.
-
net10.0
- Galosys.Foundation.Core (>= 26.8.13.2)
- Microsoft.Extensions.DependencyInjection (>= 10.0.0)
- Microsoft.Extensions.Logging (>= 10.0.0)
NuGet packages (2)
Showing the top 2 NuGet packages that depend on Galosys.Foundation.Authorization:
| Package | Downloads |
|---|---|
|
Galosys.Foundation.AspNetCore.Authorization
Galosys.Foundation快速开发库 |
|
|
Galosys.Foundation.Authorization.EntityFrameworkCore
Galosys.Foundation快速开发库 |
GitHub repositories
This package is not used by any popular GitHub repositories.