Galosys.Foundation.Authorization 26.8.29.1

Galosys.Foundation.Authorization

框架无关的统一授权核心（PDP，Policy Decision Point）：四要素授权请求、富决策结果、阿里云 RAM 风格策略模型（PolicyRule）、结构化条件块、可插拔组合算法与评估引擎。零 Web 运行时依赖——Worker/Agent/桌面/API 各类宿主均可直接引用。

设计文档：docs/designs/abac-design.md（整体架构与路线图）；Web 适配层见 Galosys.Foundation.AspNetCore.Authorization。

能力清单

使用示例

注册（DI）

services.AddAuthorizationEngineCore(options =>
{
    options.Policies = new[] { policyRule };          // 或 options.PolicyFilePath = "policies.json"
    options.PollingInterval = TimeSpan.FromSeconds(30);
});

按主体查询策略（默认实现）

IAuthorizationPolicyRepository 提供 GetRulesForPrincipalAsync(principals, tenantId) 默认实现：全量拉取后按主体（user:{id} / role:{r}）与租户过滤，按优先级降序返回；未覆写的仓储直接可用，EF Core 存储等实现可在数据库侧覆写优化。

var rules = await repository.GetRulesForPrincipalAsync(
    new[] { "user:1001", "role:admin" },
    tenantId: "t1");

策略缓存 PolicyCache

PolicyCache 实现 IAuthorizationPolicyRepository + IDisposable，默认 30s 轮询底层 GetVersionAsync()，版本变化时全量重载并原子替换快照。提供两个 public 构造函数：

• PolicyCache(IAuthorizationPolicyRepository inner, TimeSpan, ILogger<PolicyCache>)：内存路径（如 ConfigurationPolicyRepository），构造期与运行期复用传入实例。
• PolicyCache(IServiceScopeFactory scopeFactory, Func<IServiceScope, IAuthorizationPolicyRepository> innerFactory, TimeSpan, ILogger<PolicyCache>)：作用域解析路径，每次首载/轮询/ReloadAsync 创建独立 scope、经 innerFactory 解析底层仓储并转发，scope 结束释放——用于底层仓储本身是 Scoped（如 EF Core 版），避免 Singleton 缓存捕获 Scoped DbContext。

// 作用域路径：底层仓储为 Scoped 时使用
services.TryAddSingleton<IAuthorizationPolicyRepository>(sp => new PolicyCache(
    sp.GetRequiredService<IServiceScopeFactory>(),
    scope => scope.ServiceProvider.GetRequiredService<EfCoreAuthorizationPolicyRepository<MyContext>>(),
    TimeSpan.FromSeconds(30),
    sp.GetRequiredService<ILogger<PolicyCache>>()));

EF Core 集成包 Galosys.Foundation.Authorization.EntityFrameworkCore 的 AddAuthorizationEngineEfCore<TContext>() 已内置该作用域解析注册，宿主通常无需手动装配。

进程内引擎直用（Worker/Agent，零 Web 依赖）

var engine = sp.GetRequiredService<IAuthorizationEngine>();
var request = new AuthorizationRequest
{
    Subject = new Subject("alice").WithAttr("Department", "finance"),
    Resource = new Resource("acs:doc:*:*:report/2024-q1", "doc"),
    Action = new Action("doc:Read"),
    Environment = new EnvironmentContext().WithAttr("SourceIp", "10.0.0.42")
};

var decision = await engine.EvaluateAsync(request);
if (decision.IsAllowed)
{
    // 执行操作
}
else
{
    _logger.LogWarning("拒绝: {Reason}, 命中: {Policies}", decision.Reason, decision.MatchedPolicies);
}

策略 JSON（阿里云 RAM 风格）

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": ["role:admin"],
      "Action": ["doc:Read", "doc:List"],
      "Resource": ["acs:doc:*:*:report/*"],
      "Condition": { "op": "and", "children": [ /* ConditionBlock */ ] }
    }
  ]
}

依赖

• Galosys.Foundation.Core
• Microsoft.Extensions.DependencyInjection / Microsoft.Extensions.Logging

不依赖 任何 Microsoft.AspNetCore.*，也不依赖 Galosys.Foundation.AspNetCore / Galosys.Foundation.DataPermission。Web 适配（[Authorize] 管线、env.* 外部源）由 Galosys.Foundation.AspNetCore.Authorization 提供。