Zed 语言深度解析：构建复杂权限系统的完整语法指南

Zed 语言详细语法规范

Zed 语言是一种 专门用于定义权限模型的声明式语言，具有严格的语法规则和丰富的表达能力。

• github-zh & authzed/spicedb

基本语法结构

1. 定义块 (Definition Block)

definition object_type_name {
    // 关系和权限定义
}

每个 definition 块定义一种对象类型，包含该类型的:

• 关系 (relation)
• 权限 (permission)

2. 关系定义语法

relation relation_name: allowed_types

allowed_types 支持以下格式：

// 单一类型
relation owner: user

// 多种类型（联合类型）
relation viewer: user | usergroup#member

// 通配符类型
relation public: anyuser

// 特定对象引用
relation parent: folder | organization

3. 权限定义语法

permission permission_name = expression

表达式操作符

基本操作符

操作符	含义	示例
+	并集（OR）	viewer + editor
-	差集（排除）	member - banned
&	交集（AND）	employee & verified
->	箭头（权限传递/继承）	parent->read

详细示例

definition document {
    // 基础关系
    relation viewer: user | usergroup#member
    relation editor: user | usergroup#member
    relation owner: user
    relation banned: user
    
    // 简单权限：并集操作
    permission view = viewer + editor + owner
    
    // 排除操作：从允许列表中排除特定用户
    permission read = (viewer + editor + owner) - banned
    
    // 交集操作：必须同时满足多个条件
    permission special_access = (editor & trusted_user) + owner
    
    // 箭头操作：继承父级权限
    permission write = editor + owner
}

---

复杂表达式结构

1. 括号优先级控制

definition resource {
    relation admin: user
    relation member: user
    relation guest: user
    
    // 使用括号明确优先级
    permission access = admin + (member - guest)
    
    // 复杂嵌套表达式
    permission manage = admin + ((member & verified) - suspended)
}

2. 层次结构与继承

definition organization {
    relation admin: user
    relation member: user
    
    permission manage = admin
}

definition team {
    // 引用父级组织的关系
    relation parent: organization
    relation lead: user
    relation member: user
    
    // 继承父级权限
    permission org_admin = parent->admin
    permission manage = lead + parent->manage
}

definition project {
    relation parent: team | organization
    relation owner: user
    relation contributor: user
    
    // 多层级继承
    permission admin = owner + parent->manage
    permission view = contributor + parent->manage
}

特殊类型和关键字

1. anyuser 类型

definition document {
    relation viewer: user | usergroup#member
    relation public_viewer: anyuser  // 允许任何用户访问
    
    permission read = viewer + public_viewer
}

2. 自引用关系

definition user {
    relation friend: user
    relation blocked: user
    
    // 用户可以查看自己朋友的信息，但不能查看已屏蔽用户的信息
    permission view_friends = friend - blocked
}

完整示例：企业权限系统

// 基础用户定义
definition user {}

// 用户组定义
definition group {
    relation member: user
    relation admin: user
    
    permission manage = admin
}

// 部门定义
definition department {
    relation member: user
    relation head: user
    relation parent: department
    
    permission manage = head + parent->manage
    permission view = member + manage
}

// 项目定义
definition project {
    relation owner: user
    relation department: department
    relation collaborator: user | group#member
    relation viewer: user | group#member
    
    // 项目管理权限：所有者或部门管理者
    permission manage = owner + department->manage
    
    // 编辑权限：所有者、协作者或部门管理者
    permission edit = owner + collaborator + department->manage
    
    // 查看权限：所有者、协作者、查看者或部门成员
    permission view = owner + collaborator + viewer + department->view
}

// 文档定义
definition document {
    relation parent: project | folder
    relation owner: user
    relation editor: user | group#member
    relation viewer: user | group#member
    relation banned: user
    
    // 继承父级管理权限
    permission manage = owner + parent->manage
    
    // 编辑权限：编辑者或管理者，但排除被禁止用户
    permission edit = (editor + parent->edit) - banned
    
    // 查看权限：查看者、编辑者或管理者，但排除被禁止用户
    permission view = ((viewer + editor + parent->view) - banned) + manage
}

// 文件夹定义
definition folder {
    relation parent: project | folder
    relation owner: user
    relation editor: user | group#member
    relation viewer: user | group#member
    
    permission manage = owner + parent->manage
    permission edit = editor + parent->edit + manage
    permission view = viewer + editor + parent->view + manage
}

注释语法

• Zed 语言支持 C-style 注释：

// 单行注释

/*
多行注释
可以跨越多行
*/

definition user {
    // 用户关系定义
    relation friend: user  // 好友关系
    relation blocked: user /* 屏蔽关系 */
}

最佳实践

1. 命名规范: 使用清晰、一致的命名约定
2. 权限分离: 将复杂权限分解为简单权限的组合
3. 继承设计: 合理利用箭头操作符实现权限继承
4. 避免循环: 确保关系定义不会形成循环依赖

这种语法设计使得 Zed 语言既强大又直观，能够准确表达复杂的权限模型，同时保持良好的可读性和维护性。