基于Zanzibar论文的OpenFGA细粒度授权系统使用指南

OpenFGA是一个基于Google Zanzibar论文理念的开源细粒度授权系统，它提供了一种灵活的方式来定义和管理复杂的访问控制关系。下面我将介绍如何在Golang中使用OpenFGA实现细粒度授权。

1. OpenFGA核心概念

OpenFGA基于以下几个核心概念：

• 授权模型(Authorization Model)：定义实体类型和它们之间的关系
• 元组(Tuples)：存储具体的关系实例
• 检查(Check)：验证用户是否有权限
• 列表(List)：列出用户有权限的所有资源

2. 安装OpenFGA Go SDK

首先安装OpenFGA的Go SDK：

go get github.com/openfga/go-sdk

3. 初始化OpenFGA客户端

package main

import (
	"context"
	"fmt"
	"log"

	openfga "github.com/openfga/go-sdk"
	"github.com/openfga/go-sdk/client"
)

func main() {
	// 配置OpenFGA客户端
	configuration, err := client.NewConfiguration(client.Configuration{
		ApiScheme: "http",
		ApiHost:   "localhost:8080", // OpenFGA服务器地址
	})
	if err != nil {
		log.Fatal(err)
	}

	fgaClient := client.NewOpenFgaClient(configuration)
	
	// 设置认证信息（如果有）
	// fgaClient.SetStoreId("your-store-id")
	// fgaClient.SetAuthorizationModelId("your-model-id")
}

4. 定义授权模型

func createAuthorizationModel(fgaClient *client.OpenFgaClient) {
	model := openfga.WriteAuthorizationModelRequest{
		TypeDefinitions: []openfga.TypeDefinition{
			{
				Type: "user",
			},
			{
				Type: "document",
				Relations: map[string]openfga.Userset{
					"reader": {
						This: &map[string]interface{}{},
					},
					"writer": {
						This: &map[string]interface{}{},
					},
					"owner": {
						This: &map[string]interface{}{},
					},
					"can_view": {
						Union: &openfga.Usersets{
							Child: []openfga.Userset{
								{This: &map[string]interface{}{}},
								{ComputedUserset: &openfga.ObjectRelation{
									Object:   openfga.PtrString(""),
									Relation: openfga.PtrString("reader"),
								}},
								{ComputedUserset: &openfga.ObjectRelation{
									Object:   openfga.PtrString(""),
									Relation: openfga.PtrString("writer"),
								}},
								{ComputedUserset: &openfga.ObjectRelation{
									Object:   openfga.PtrString(""),
									Relation: openfga.PtrString("owner"),
								}},
							},
						},
					},
					"can_edit": {
						Union: &openfga.Usersets{
							Child: []openfga.Userset{
								{This: &map[string]interface{}{}},
								{ComputedUserset: &openfga.ObjectRelation{
									Object:   openfga.PtrString(""),
									Relation: openfga.PtrString("writer"),
								}},
								{ComputedUserset: &openfga.ObjectRelation{
									Object:   openfga.PtrString(""),
									Relation: openfga.PtrString("owner"),
								}},
							},
						},
					},
				},
				Metadata: &openfga.Metadata{
					Relations: map[string]openfga.RelationMetadata{
						"reader": {
							DirectlyRelatedUserTypes: []openfga.RelationReference{
								{Type: "user"},
							},
						},
						"writer": {
							DirectlyRelatedUserTypes: []openfga.RelationReference{
								{Type: "user"},
							},
						},
						"owner": {
							DirectlyRelatedUserTypes: []openfga.RelationReference{
								{Type: "user"},
							},
						},
					},
				},
			},
		},
		SchemaVersion: "1.1",
	}

	response, err := fgaClient.WriteAuthorizationModel(context.Background()).Body(model).Execute()
	if err != nil {
		log.Fatal(err)
	}

	fmt.Printf("Authorization model created with ID: %s\n", *response.AuthorizationModelId)
}

5. 写入关系元组

func writeTuples(fgaClient *client.OpenFgaClient) {
	// 添加关系元组
	body := client.ClientWriteRequest{
		Writes: []client.ClientTupleKey{
			{
				User:     "user:alice",
				Relation: "owner",
				Object:   "document:budget",
			},
			{
				User:     "user:bob",
				Relation: "writer",
				Object:   "document:budget",
			},
			{
				User:     "user:charlie",
				Relation: "reader",
				Object:   "document:budget",
			},
		},
	}

	_, err := fgaClient.Write(context.Background()).Body(body).Execute()
	if err != nil {
		log.Fatal(err)
	}

	fmt.Println("Tuples written successfully")
}

6. 检查权限

func checkPermission(fgaClient *client.OpenFgaClient) {
	checkRequest := client.ClientCheckRequest{
		User:     "user:bob",
		Relation: "can_edit",
		Object:   "document:budget",
	}

	response, err := fgaClient.Check(context.Background()).Body(checkRequest).Execute()
	if err != nil {
		log.Fatal(err)
	}

	if *response.Allowed {
		fmt.Println("Bob can edit the budget document")
	} else {
		fmt.Println("Bob cannot edit the budget document")
	}
}

7. 列出用户有权限的资源

func listDocuments(fgaClient *client.OpenFgaClient) {
	listRequest := client.ClientListObjectsRequest{
		User:     "user:bob",
		Relation: "can_view",
		Type:     "document",
	}

	response, err := fgaClient.ListObjects(context.Background()).Body(listRequest).Execute()
	if err != nil {
		log.Fatal(err)
	}

	fmt.Println("Bob can view the following documents:")
	for _, obj := range response.Objects {
		fmt.Println(obj)
	}
}

8. 完整示例

package main

import (
	"context"
	"fmt"
	"log"

	openfga "github.com/openfga/go-sdk"
	"github.com/openfga/go-sdk/client"
)

func main() {
	// 初始化客户端
	configuration, err := client.NewConfiguration(client.Configuration{
		ApiScheme: "http",
		ApiHost:   "localhost:8080",
	})
	if err != nil {
		log.Fatal(err)
	}
	fgaClient := client.NewOpenFgaClient(configuration)

	// 创建授权模型
	createAuthorizationModel(fgaClient)

	// 写入关系元组
	writeTuples(fgaClient)

	// 检查权限
	checkPermission(fgaClient)

	// 列出可访问资源
	listDocuments(fgaClient)
}

// 前面定义的函数放在这里...

9. 实际应用建议

1. 缓存策略：OpenFGA检查操作可能会频繁调用，考虑添加缓存层
2. 批量操作：使用批量API减少网络开销
3. 监控：监控授权检查的延迟和错误率
4. 模型设计：精心设计授权模型，避免过于复杂的嵌套关系

OpenFGA提供了强大的细粒度授权能力，通过合理的设计可以实现复杂的访问控制场景。以上代码展示了基本用法，实际应用中可能需要根据具体需求进行调整。