ABAC访问控制系统，使用Codebuddy实现

ABAC访问控制系统
整个系统下载：ABAC访问控制系统
conflict_detector.py

from typing import List, Dict, Any
from enum import Enum

class ConflictType(Enum):
    HARD_CONFLICT = "HARD_CONFLICT"  # 相同条件，相反决策
    SOFT_CONFLICT = "SOFT_CONFLICT"  # 条件重叠，决策不同
    REDUNDANT = "REDUNDANT"         # 条件完全包含，决策相同

class PolicyConflictDetector:
    def __init__(self):
        self.conflicts = []
    
    def detect(self, policies: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
        """检测策略集中的所有冲突"""
        self.conflicts = []
        
        # 按优先级排序
        sorted_policies = sorted(policies, key=lambda x: x.get("priority", 0), reverse=True)
        
        for i, policy1 in enumerate(sorted_policies):
            for policy2 in sorted_policies[i+1:]:
                conflict = self._compare_policies(policy1, policy2)
                if conflict:
                    self.conflicts.append({
                        "type": conflict,
                        "policy1": policy1["id"],
                        "policy2": policy2["id"],
                        "description": f"{policy1['id']} 与 {policy2['id']} 存在 {conflict.value} 冲突"
                    })
        
        return self.conflicts
    
    def _compare_policies(self, policy1: Dict[str, Any], policy2: Dict[str, Any]) -> ConflictType:
        """比较两个策略的冲突类型"""
        cond1 = policy1["condition"]
        cond2 = policy2["condition"]
        
        # 完全相同的条件
        if cond1 == cond2:
            if policy1["decision"] != policy2["decision"]:
                return ConflictType.HARD_CONFLICT
            return ConflictType.REDUNDANT
        
        # 条件重叠检测
        if self._conditions_overlap(cond1, cond2):
            if policy1["decision"] != policy2["decision"]:
                return ConflictType.SOFT_CONFLICT
        
        return None
    
    def _conditions_overlap(self, cond1: Dict[str, Any], cond2: Dict[str, Any]) -> bool:
        """检测条件是否有重叠"""
        # 检查主体属性重叠
        if self._attrs_overlap(cond1.get("subject", {}), cond2.get("subject", {})):
            return True
        
        # 检查资源属性重叠
        if self._attrs_overlap(cond1.get("resource", {}), cond2.get("resource", {})):
            return True
        
        # 检查环境属性重叠
        if self._attrs_overlap(cond1.get("environment", {}), cond2.get("environment", {})):
            return True
        
        return False
    
    def _attrs_overlap(self, attrs1: Dict[str, Any], attrs2: Dict[str, Any]) -> bool:
        """检测属性集是否有重叠"""
        for attr, value1 in attrs1.items():
            value2 = attrs2.get(attr)
            if value2 is None:
                continue
                
            # 简单值比较
            if isinstance(value1, (str, int, float)) and value1 == value2:
                return True
                
            # 范围比较逻辑可在此扩展
            
        return False

attributes.py

from dataclasses import dataclass
from typing import Dict, Any

@dataclass
class SubjectAttributes:
    """主体属性(用户特征)"""
    id: str
    role: str
    department: str
    clearance_level: int
    
    def to_dict(self) -> Dict[str, Any]:
        return {
            "id": self.id,
            "role": self.role,
            "department": self.department,
            "clearance_level": self.clearance_level
        }

@dataclass
class ResourceAttributes:
    """资源属性(数据特征)"""
    id: str
    type: str
    owner: str
    sensitivity: int  # 1-5级
    
    def to_dict(self) -> Dict[str, Any]:
        return {
            "id": self.id,
            "type": self.type,
            "owner": self.owner,
            "sensitivity": self.sensitivity
        }

@dataclass
class EnvironmentAttributes:
    """环境属性(上下文特征)"""
    time: str  # ISO格式时间
    location: str
    network: str  # internal/vpn/public
    
    def to_dict(self) -> Dict[str, Any]:
        return {
            "time": self.time,
            "location": self.location,
            "network": self.network
        }

policy_loader.py

import json
from typing import List, Dict, Any
from conflict_detector import PolicyConflictDetector

class PolicyLoader:
    def __init__(self, policy_path: str):
        self.policy_path = policy_path
        self.detector = PolicyConflictDetector()
    
    def load_and_validate(self) -> List[Dict[str, Any]]:
        """加载并验证策略集"""
        with open(self.policy_path, 'r', encoding='utf-8') as f:
            policies = json.load(f)
        
        # 检测冲突
        conflicts = self.detector.detect(policies)
        if conflicts:
            for conflict in conflicts:
                print(f"[WARN] {conflict['description']}")
            
        return policies
    
    def get_policy_by_id(self, policy_id: str) -> Dict[str, Any]:
        """按ID获取策略"""
        with open(self.policy_path, 'r') as f:
            policies = json.load(f)
            
        for policy in policies:
            if policy["id"] == policy_id:
                return policy
        
        return None

abac.py

import json
from typing import Dict, Any
from enum import Enum
from policy_loader import PolicyLoader

class Decision(Enum):
    PERMIT = "PERMIT"
    DENY = "DENY"
    NOT_APPLICABLE = "NOT_APPLICABLE"

class ABACEngine:
    def __init__(self, policy_path: str = "policy.json"):
        """初始化策略引擎"""
        loader = PolicyLoader(policy_path)
        self.policies = loader.load_and_validate()
    
    def evaluate(self, 
                subject_attrs: Dict[str, Any], 
                resource_attrs: Dict[str, Any], 
                env_attrs: Dict[str, Any]) -> Decision:
        """
        执行ABAC策略评估
        :param subject_attrs: 主体属性(用户特征)
        :param resource_attrs: 资源属性(数据特征)
        :param env_attrs: 环境属性(上下文特征)
        :return: 访问决策
        """
        for policy in self.policies:
            # 检查策略适用性
            if self._match_conditions(policy["condition"], subject_attrs, resource_attrs, env_attrs):
                return Decision[policy["decision"]]
        
        return Decision.NOT_APPLICABLE
    
    def _match_conditions(self, 
                        conditions: Dict[str, Any], 
                        subject: Dict[str, Any], 
                        resource: Dict[str, Any], 
                        env: Dict[str, Any]) -> bool:
        """匹配策略条件"""
        # 主体属性匹配
        for attr, expected in conditions.get("subject", {}).items():
            if subject.get(attr) != expected:
                return False
        
        # 资源属性匹配
        for attr, expected in conditions.get("resource", {}).items():
            if resource.get(attr) != expected:
                return False
        
        # 环境属性匹配
        for attr, expected in conditions.get("environment", {}).items():
            if env.get(attr) != expected:
                return False
        
        return True

policy.json

[
    {
        "id": "policy-001",
        "description": "允许管理员在任何环境下访问任何资源",
        "priority": 100,
        "condition": {
            "subject": {"role": "admin"}
        },
        "decision": "PERMIT"
    },
    {
        "id": "policy-002",
        "description": "允许工程师在内网访问敏感度<=3的资源",
        "priority": 50,
        "condition": {
            "subject": {"role": "engineer"},
            "resource": {"sensitivity": {"lte": 3}},
            "environment": {"network": "internal"}
        },
        "decision": "PERMIT"
    },
    {
        "id": "policy-003",
        "description": "禁止在非工作时间访问敏感资源",
        "priority": 70,
        "condition": {
            "resource": {"sensitivity": {"gt": 3}},
            "environment": {"time": {"not_between": ["08:00", "18:00"]}}
        },
        "decision": "DENY"
    },
    {
        "id": "policy-004",
        "description": "允许同部门用户访问非敏感资源",
        "priority": 30,
        "condition": {
            "subject": {},
            "resource": {
                "sensitivity": {"lte": 2},
                "owner": "${subject.department}"
            }
        },
        "decision": "PERMIT"
    }
]

test.py

from abac import ABACEngine
from attributes import SubjectAttributes, ResourceAttributes, EnvironmentAttributes
from datetime import datetime

# 初始化引擎
engine = ABACEngine(policy_path="abac-model/policy.json")

# 构造属性
user = SubjectAttributes(
    id="user-123",
    role="engineer",
    department="R&D",
    clearance_level=4
)

document = ResourceAttributes(
    id="doc-456",
    type="design",
    owner="R&D",
    sensitivity=4
)

env = EnvironmentAttributes(
    time=datetime.now().isoformat(),
    location="office",
    network="internal"
)

# 执行访问决策
decision = engine.evaluate(
    user.to_dict(),
    document.to_dict(),
    env.to_dict()
)
print(decision)  # 输出: Decision.PERMIT