Go 鉴权权限模型RBAC、ABAC、ReBAC 模型实战对比业务复杂到一定规模时权限管理就成核心模块。本文把 RBAC、ABAC、ReBAC 三种主流模型讲透。一、RBACRole-Based Access ControltypeRolestruct{Namestring}typePermissionstruct{Namestring}typeUserstruct{Roles[]Role}varUserRolesstruct{Mapmap[string][]string}{...}varRolePermsstruct{Mapmap[string][]string}{...}func(u*User)HasPermission(pstring)bool{for_,r:rangeu.Roles{for_,rp:rangeRolePerms.Map[r.Name]{ifrpp{returntrue}}}returnfalse}特点结构清晰角色变更频率低适合企业级管理员、雇员权限管理。二、ABACAttribute-Based属性包括用户、资源、环境、操作四元组typePolicystruct{Subject[]string// user traitObject[]string// resource traitAction[]string// actionEnvironment[]string// ip, time}引擎 OPA (Open Policy Agent)Go 端importgithub.com/open-policy-agent/opa/sdkresult,_:sdk.Rego(ctx, package example allow { input.user.roles[_] admin } ).Evaluate(ctx,rego.EvalInput(input))适合复杂组织、动态策略。三、ReBACRelationship-Based关系图模型Google Zanzibar 推广。typeGraphstruct{edgesmap[string]map[string]struct{}}func(g*Graph)AddEdge(from,tostring){g.edges[from][to]struct{}{}}func(g*Graph)HasAccess(user,resourcestring)bool{// 检查 user 对 resource 是否能访问 (子图遍历)}实际项目常用 SpiceDBclient,_:v1.NewClient(localhost:50051)resp,_:client.PermissionsService.CheckPermission(ctx,v1.CheckPermissionRequest{Resource:v1.ObjectReference{Type:document,Id:1},Permission:view,Subject:v1.SubjectReference{Object:v1.ObjectReference{Type:user,Id:42}},})适合社交网络、文档协同。四、Casbin 实战e,_:casbin.NewEnforcer(model.conf,policy.csv)sub,obj,act:alice,data1,readok,_:e.Enforce(sub,obj,act)model.conf定义 RBACsubject, object, action, eft。五、ReBAC 图数据库Neo4j / SQLiteCREATETABLEedges(from_idTEXT,to_idTEXT,typeTEXT,levelINT);WITHRECURSIVE path(id,level)AS(SELECTalice,0UNIONSELECTe.to_id,p.level1FROMedges eJOINpath pONe.from_idp.idWHEREp.level5)SELECT1FROMpathWHEREiddoc-42;六、对比维度RBACABACReBAC复杂度低高中灵活性中高高实现简单OPA图模型性能高中取决于图存储业务场景传统企业多租户 SaaS社交/协同七、生产实战RBAC ABAC 混合一级权限用 RBAC角色 → 菜单二级资源用 ABAC字段级权限八、踩坑清单RBAC 角色太多 → 维护难ABAC 调试难 → 写好决策日志ReBAC 关系循环 → 加 max depth九、总结与展望权限模型本质是业务边界的代码化。三模型组合使用是更可能的选择。未来OPA、WebAuthn、Passkey Zanzibar 类方案会在大企业中渐渐落地。十、参考文献NIST RBAC 标准OPA 官方文档SpiceDB 仓库
