Add components for secure access control (#59)

* Add components for secure access control

.github/workflows/close-pull-request.yml

@@ -0,0 +1,13 @@
+name: Close Pull Request
+
+on:
+  pull_request_target:
+    types: [ opened ]
+
+jobs:
+  run:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: superbrothers/close-pull-request@v3
+        with:
+          comment: "Hi, this is a READ-ONLY repository, please submit your PR on the https://github.com/mineadmin/components repository.<br><br> This Pull Request will close automatically.<br><br> Thanks! "

.github/workflows/release.yml

@@ -0,0 +1,24 @@
+on:
+  push:
+    tags:
+      - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
+
+name: Release
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Create Release
+        id: create_release
+        uses: actions/create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ github.ref }}
+          release_name: Release ${{ github.ref }}
+          draft: false
+          prerelease: false

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 MineAdmin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1 @@
+# 基于 mineadmin/security-bundle 提供安全访问控制

composer.json

@@ -0,0 +1,39 @@
+{
+  "name": "mineadmin/security-access",
+  "description": "Security Access Component",
+  "type": "library",
+  "license": "MIT",
+  "authors": [
+    {
+      "name": "xmo",
+      "email": "root@imoi.cn",
+      "role": "Developer"
+    },
+    {
+      "name": "zds",
+      "email": "2771717608@qq.com",
+      "role": "Developer"
+    }
+  ],
+  "require": {
+    "php": ">=8.1",
+    "mineadmin/security-bundle": "2.0.x-dev",
+    "casbin/casbin": "^v3.21",
+    "friendsofhyperf/facade": "^3.1"
+  },
+  "autoload": {
+    "psr-4": {
+      "Mine\\Security\\Access\\": "src/"
+    }
+  },
+  "autoload-dev": {
+    "psr-4": {
+      "Mine\\Security\\Access\\Tests\\": "tests/"
+    }
+  },
+  "extra": {
+    "config": {
+      "hyperf": "Mine\\Security\\Access\\ConfigProvider"
+    }
+  }
+}

publish/access.php

@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * This file is part of MineAdmin.
+ *
+ * @link     https://www.mineadmin.com
+ * @document https://doc.mineadmin.com
+ * @contact  root@imoi.cn
+ * @license  https://github.com/mineadmin/MineAdmin/blob/master/LICENSE
+ */
+use Casbin\Enforcer;
+
+return [
+    'default' => 'rbac',
+    'component' => [
+        'rbac' => [
+            'construct' => [
+                __DIR__ . '/rbac_model.conf',
+                __DIR__ . '/rbac_policy.csv',
+            ],
+            'enforcer' => Enforcer::class,
+        ],
+    ],
+];

publish/rbac_model.conf

@@ -0,0 +1,14 @@
+[request_definition]
+r = sub, obj, act
+
+[policy_definition]
+p = sub, obj, act
+
+[role_definition]
+g = _, _
+
+[policy_effect]
+e = some(where (p.eft == allow))
+
+[matchers]
+m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act

src/ConfigProvider.php

@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * This file is part of MineAdmin.
+ *
+ * @link     https://www.mineadmin.com
+ * @document https://doc.mineadmin.com
+ * @contact  root@imoi.cn
+ * @license  https://github.com/mineadmin/MineAdmin/blob/master/LICENSE
+ */
+
+namespace Mine\Security\Access;
+
+use Mine\Security\Access\Contract\Access;
+
+class ConfigProvider
+{
+    public function __invoke(): array
+    {
+        return [
+            'dependencies' => [
+                Access::class => Manager::class,
+            ],
+            'publish' => [
+                [
+                    'id' => 'access rbac conf',
+                    'description' => 'Access Rbac Conf',
+                    'source' => __DIR__ . '/../publish/access.php',
+                    'destination' => BASE_PATH . '/config/autoload/access.php',
+                ],
+                [
+                    'id' => 'access rbac model conf',
+                    'description' => 'Access Rbac Model Conf',
+                    'source' => __DIR__ . '/../publish/rbac_model.conf',
+                    'destination' => BASE_PATH . '/config/autoload/rbac_model.conf',
+                ],
+                [
+                    'id' => 'access rbac policy csv',
+                    'description' => 'Access Rbac Policy csv',
+                    'source' => __DIR__ . '/../publish/rbac_policy.csv',
+                    'destination' => BASE_PATH . '/config/autoload/rbac_policy.csv',
+                ],
+            ],
+        ];
+    }
+}

src/Contract/Access.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * This file is part of MineAdmin.
+ *
+ * @link     https://www.mineadmin.com
+ * @document https://doc.mineadmin.com
+ * @contact  root@imoi.cn
+ * @license  https://github.com/mineadmin/MineAdmin/blob/master/LICENSE
+ */
+
+namespace Mine\Security\Access\Contract;
+
+use Casbin\Enforcer;
+use Mine\Security\Access\Exception\AccessException;
+
+interface Access
+{
+    /**
+     * @throws AccessException
+     */
+    public function get(?string $name = null): Enforcer;
+}

src/Exception/AccessException.php

@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * This file is part of MineAdmin.
+ *
+ * @link     https://www.mineadmin.com
+ * @document https://doc.mineadmin.com
+ * @contact  root@imoi.cn
+ * @license  https://github.com/mineadmin/MineAdmin/blob/master/LICENSE
+ */
+
+namespace Mine\Security\Access\Exception;
+
+class AccessException extends \Exception {}

src/Manager.php

@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * This file is part of MineAdmin.
+ *
+ * @link     https://www.mineadmin.com
+ * @document https://doc.mineadmin.com
+ * @contact  root@imoi.cn
+ * @license  https://github.com/mineadmin/MineAdmin/blob/master/LICENSE
+ */
+
+namespace Mine\Security\Access;
+
+use Casbin\Enforcer;
+use Hyperf\Config\Config;
+use Mine\Security\Access\Contract\Access;
+use Mine\Security\Access\Exception\AccessException;
+
+class Manager implements Access
+{
+    public function __construct(
+        private readonly Config $config
+    ) {}
+
+    public function get(?string $name = null): Enforcer
+    {
+        if ($name === null) {
+            $name = $this->getConfig('default');
+        }
+        return $this->getAdapter($name);
+    }
+
+    protected function getConfig(string $key, mixed $default = null): mixed
+    {
+        return $this->config->get('access.' . $key, $default);
+    }
+
+    protected function getAdapter(string $name): Enforcer
+    {
+        $adapter = $this->getConfig('component.' . $name);
+        if (empty($adapter)) {
+            throw new AccessException(sprintf('Access adapter [%s] not exists.', $name));
+        }
+        if (empty($adapter['construct']) || empty($adapter['enforcer'])) {
+            throw new AccessException(sprintf('Access adapter [%s] construct or enforcer not exists.', $name));
+        }
+        $construct = $adapter['construct'];
+        $enforcer = $adapter['enforcer'];
+        return new $enforcer(...$construct);
+    }
+}

src/Rbac.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * This file is part of MineAdmin.
+ *
+ * @link     https://www.mineadmin.com
+ * @document https://doc.mineadmin.com
+ * @contact  root@imoi.cn
+ * @license  https://github.com/mineadmin/MineAdmin/blob/master/LICENSE
+ */
+
+namespace Mine\Security\Access;
+
+use Casbin\Enforcer;
+use Mine\Security\Access\Contract\Access;
+
+/**
+ * @mixin Enforcer
+ */
+class Rbac
+{
+    public function __construct(
+        private readonly Access $access
+    ) {}
+
+    public function __call($name, $arguments)
+    {
+        return $this->getAccess()->get('rbac')->{$name}(...$arguments);
+    }
+
+    public function getAccess(): Access
+    {
+        return $this->access;
+    }
+}

src/RbacFacade.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * This file is part of MineAdmin.
+ *
+ * @link     https://www.mineadmin.com
+ * @document https://doc.mineadmin.com
+ * @contact  root@imoi.cn
+ * @license  https://github.com/mineadmin/MineAdmin/blob/master/LICENSE
+ */
+
+namespace Mine\Security\Access;
+
+use FriendsOfHyperf\Facade\Facade;
+
+/**
+ * @mixin Rbac
+ */
+class RbacFacade extends Facade
+{
+    public static function getFacadeRoot(): string
+    {
+        return Rbac::class;
+    }
+}

tests/Cases/ConfigProviderTest.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * This file is part of MineAdmin.
+ *
+ * @link     https://www.mineadmin.com
+ * @document https://doc.mineadmin.com
+ * @contact  root@imoi.cn
+ * @license  https://github.com/mineadmin/MineAdmin/blob/master/LICENSE
+ */
+
+namespace Mine\Security\Access\Tests\Cases;
+
+use Mine\Security\Access\ConfigProvider;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @internal
+ * @coversNothing
+ */
+class ConfigProviderTest extends TestCase
+{
+    public function testInvoke(): void
+    {
+        $this->assertIsArray((new ConfigProvider())());
+    }
+}