5.5.4 配置安全与加密 #

// 配置加密管理器
type ConfigEncryptionManager struct {
    keyManager KeyManager
    cipher     CipherService
    logger     *log.Logger
}

// 密钥管理接口
type KeyManager interface {
    GetEncryptionKey(keyID string) ([]byte, error)
    CreateEncryptionKey(keyID string) ([]byte, error)
    RotateKey(keyID string) error
    ListKeys() ([]string, error)
}

// 加密服务接口
type CipherService interface {
    Encrypt(plaintext []byte, keyID string) (*EncryptedData, error)
    Decrypt(encryptedData *EncryptedData) ([]byte, error)
    GenerateDataKey() (*DataKey, error)
}

// 加密数据结构
type EncryptedData struct {
    KeyID       string    `json:"key_id"`
    Algorithm   string    `json:"algorithm"`
    Ciphertext  []byte    `json:"ciphertext"`
    IV          []byte    `json:"iv,omitempty"`
    Tag         []byte    `json:"tag,omitempty"`
    CreatedAt   time.Time `json:"created_at"`
}

// 数据密钥
type DataKey struct {
    KeyID     string `json:"key_id"`
    Plaintext []byte `json:"plaintext"`
    Encrypted []byte `json:"encrypted"`
}

// 权限管理器
type ConfigPermissionManager struct {
    userService UserService
    roleService RoleService
    policyEngine PolicyEngine
    logger      *log.Logger
}

// 用户信息
type User struct {
    ID       string   `json:"id"`
    Username string   `json:"username"`
    Email    string   `json:"email"`
    Roles    []string `json:"roles"`
    Groups   []string `json:"groups"`
    Status   UserStatus `json:"status"`
}

type UserStatus int

const (
    UserStatusActive UserStatus = iota
    UserStatusInactive
    UserStatusSuspended
)

// 角色定义
type Role struct {
    ID          string       `json:"id"`
    Name        string       `json:"name"`
    Description string       `json:"description"`
    Permissions []Permission `json:"permissions"`
    Scope       RoleScope    `json:"scope"`
}

type Permission struct {
    Resource string   `json:"resource"`
    Actions  []string `json:"actions"`
}

type RoleScope struct {
    Environments []string `json:"environments"`
    Namespaces   []string `json:"namespaces"`
    Applications []string `json:"applications"`
}

// 权限检查
func (m *ConfigPermissionManager) CheckPermission(userID, action, resource string, context map[string]string) (bool, error) {
    // 获取用户信息
    user, err := m.userService.GetUser(userID)
    if err != nil {
        return false, err
    }

    if user.Status != UserStatusActive {
        return false, fmt.Errorf("用户状态异常")
    }

    // 检查用户角色权限
    for _, roleID := range user.Roles {
        role, err := m.roleService.GetRole(roleID)
        if err != nil {
            continue
        }

        if m.checkRolePermission(role, action, resource, context) {
            return true, nil
        }
    }

    // 使用策略引擎进行复杂权限检查
    return m.policyEngine.Evaluate(user, action, resource, context)
}

func (m *ConfigPermissionManager) checkRolePermission(role *Role, action, resource string, context map[string]string) bool {
    // 检查作用域
    if !m.checkScope(role.Scope, context) {
        return false
    }

    // 检查权限
    for _, permission := range role.Permissions {
        if m.matchResource(permission.Resource, resource) {
            for _, allowedAction := range permission.Actions {
                if allowedAction == action || allowedAction == "*" {
                    return true
                }
            }
        }
    }

    return false
}

func (m *ConfigPermissionManager) checkScope(scope RoleScope, context map[string]string) bool {
    env := context["environment"]
    namespace := context["namespace"]
    app := context["application"]

    // 检查环境权限
    if len(scope.Environments) > 0 && !contains(scope.Environments, env) && !contains(scope.Environments, "*") {
        return false
    }

    // 检查命名空间权限
    if len(scope.Namespaces) > 0 && !contains(scope.Namespaces, namespace) && !contains(scope.Namespaces, "*") {
        return false
    }

    // 检查应用权限
    if len(scope.Applications) > 0 && !contains(scope.Applications, app) && !contains(scope.Applications, "*") {
        return false
    }

    return true
}

// 策略引擎
type PolicyEngine interface {
    Evaluate(user *User, action, resource string, context map[string]string) (bool, error)
    AddPolicy(policy *Policy) error
    RemovePolicy(policyID string) error
}

// 策略定义
type Policy struct {
    ID          string            `json:"id"`
    Name        string            `json:"name"`
    Description string            `json:"description"`
    Rules       []PolicyRule      `json:"rules"`
    Effect      PolicyEffect      `json:"effect"`
    Conditions  []PolicyCondition `json:"conditions"`
}

type PolicyRule struct {
    Subject  string   `json:"subject"`  // 用户、角色或组
    Action   string   `json:"action"`   // 操作
    Resource string   `json:"resource"` // 资源
}

type PolicyEffect int

const (
    PolicyEffectAllow PolicyEffect = iota
    PolicyEffectDeny
)

type PolicyCondition struct {
    Field    string      `json:"field"`
    Operator string      `json:"operator"`
    Value    interface{} `json:"value"`
}

// 简单策略引擎实现
type SimplePolicyEngine struct {
    policies sync.Map // policyID -> *Policy
}

func NewSimplePolicyEngine() *SimplePolicyEngine {
    return &SimplePolicyEngine{}
}

func (e *SimplePolicyEngine) Evaluate(user *User, action, resource string, context map[string]string) (bool, error) {
    var allowPolicies, denyPolicies []*Policy

    // 收集适用的策略
    e.policies.Range(func(key, value interface{}) bool {
        policy := value.(*Policy)

        if e.policyApplies(policy, user, action, resource, context) {
            if policy.Effect == PolicyEffectAllow {
                allowPolicies = append(allowPolicies, policy)
            } else {
                denyPolicies = append(denyPolicies, policy)
            }
        }

        return true
    })

    // 拒绝策略优先
    if len(denyPolicies) > 0 {
        return false, nil
    }

    // 检查允许策略
    return len(allowPolicies) > 0, nil
}

func (e *SimplePolicyEngine) policyApplies(policy *Policy, user *User, action, resource string, context map[string]string) bool {
    // 检查规则匹配
    ruleMatches := false
    for _, rule := range policy.Rules {
        if e.matchSubject(rule.Subject, user) &&
           e.matchAction(rule.Action, action) &&
           e.matchResource(rule.Resource, resource) {
            ruleMatches = true
            break
        }
    }

    if !ruleMatches {
        return false
    }

    // 检查条件
    for _, condition := range policy.Conditions {
        if !e.evaluateCondition(condition, user, context) {
            return false
        }
    }

    return true
}

func (e *SimplePolicyEngine) matchSubject(subject string, user *User) bool {
    if subject == "*" || subject == user.ID || subject == user.Username {
        return true
    }

    // 检查角色匹配
    for _, role := range user.Roles {
        if subject == "role:"+role {
            return true
        }
    }

    // 检查组匹配
    for _, group := range user.Groups {
        if subject == "group:"+group {
            return true
        }
    }

    return false
}

func (e *SimplePolicyEngine) evaluateCondition(condition PolicyCondition, user *User, context map[string]string) bool {
    var fieldValue interface{}

    // 获取字段值
    switch condition.Field {
    case "user.id":
        fieldValue = user.ID
    case "user.email":
        fieldValue = user.Email
    case "time.hour":
        fieldValue = time.Now().Hour()
    case "client.ip":
        fieldValue = context["client_ip"]
    default:
        if value, exists := context[condition.Field]; exists {
            fieldValue = value
        } else {
            return false
        }
    }

    // 评估条件
    switch condition.Operator {
    case "eq":
        return fieldValue == condition.Value
    case "ne":
        return fieldValue != condition.Value
    case "in":
        if values, ok := condition.Value.([]interface{}); ok {
            for _, v := range values {
                if fieldValue == v {
                    return true
                }
            }
        }
        return false
    case "gt":
        if fv, ok := fieldValue.(int); ok {
            if cv, ok := condition.Value.(float64); ok {
                return float64(fv) > cv
            }
        }
        return false
    case "lt":
        if fv, ok := fieldValue.(int); ok {
            if cv, ok := condition.Value.(float64); ok {
                return float64(fv) < cv
            }
        }
        return false
    default:
        return false
    }
}

// JWT认证中间件
type JWTAuthMiddleware struct {
    secretKey []byte
    permissionManager *ConfigPermissionManager
}

func NewJWTAuthMiddleware(secretKey []byte, permissionManager *ConfigPermissionManager) *JWTAuthMiddleware {
    return &JWTAuthMiddleware{
        secretKey:         secretKey,
        permissionManager: permissionManager,
    }
}

func (m *JWTAuthMiddleware) Authenticate() gin.HandlerFunc {
    return func(c *gin.Context) {
        tokenString := m.extractToken(c)
        if tokenString == "" {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "缺少认证令牌"})
            c.Abort()
            return
        }

        // 验证JWT令牌
        token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
            if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
                return nil, fmt.Errorf("无效的签名方法")
            }
            return m.secretKey, nil
        })

        if err != nil || !token.Valid {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "无效的认证令牌"})
            c.Abort()
            return
        }

        // 提取用户信息
        if claims, ok := token.Claims.(jwt.MapClaims); ok {
            c.Set("user_id", claims["user_id"])
            c.Set("username", claims["username"])
            c.Set("roles", claims["roles"])
        }

        c.Next()
    }
}

func (m *JWTAuthMiddleware) Authorize(action string) gin.HandlerFunc {
    return func(c *gin.Context) {
        userID, exists := c.Get("user_id")
        if !exists {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "用户未认证"})
            c.Abort()
            return
        }

        // 构建资源路径
        resource := m.buildResourcePath(c)

        // 构建上下文
        context := map[string]string{
            "environment": c.Param("env"),
            "namespace":   c.Param("namespace"),
            "application": c.Param("app"),
            "client_ip":   c.ClientIP(),
        }

        // 检查权限
        allowed, err := m.permissionManager.CheckPermission(
            userID.(string), action, resource, context)

        if err != nil {
            c.JSON(http.StatusInternalServerError, gin.H{"error": "权限检查失败"})
            c.Abort()
            return
        }

        if !allowed {
            c.JSON(http.StatusForbidden, gin.H{"error": "权限不足"})
            c.Abort()
            return
        }

        c.Next()
    }
}

func (m *JWTAuthMiddleware) extractToken(c *gin.Context) string {
    // 从Authorization头提取
    authHeader := c.GetHeader("Authorization")
    if authHeader != "" && strings.HasPrefix(authHeader, "Bearer ") {
        return strings.TrimPrefix(authHeader, "Bearer ")
    }

    // 从查询参数提取
    return c.Query("token")
}

func (m *JWTAuthMiddleware) buildResourcePath(c *gin.Context) string {
    env := c.Param("env")
    namespace := c.Param("namespace")
    app := c.Param("app")
    key := c.Param("key")

    if key != "" {
        return fmt.Sprintf("config:%s/%s/%s/%s", env, namespace, app, key)
    }

    if app != "" {
        return fmt.Sprintf("config:%s/%s/%s/*", env, namespace, app)
    }

    if namespace != "" {
        return fmt.Sprintf("config:%s/%s/*", env, namespace)
    }

    return fmt.Sprintf("config:%s/*", env)
}

// 密钥轮换管理器
type KeyRotationManager struct {
    keyManager KeyManager
    storage    Storage
    scheduler  *cron.Cron
    logger     *log.Logger
}

func NewKeyRotationManager(keyManager KeyManager, storage Storage) *KeyRotationManager {
    return &KeyRotationManager{
        keyManager: keyManager,
        storage:    storage,
        scheduler:  cron.New(),
        logger:     log.New(os.Stdout, "[KeyRotation] ", log.LstdFlags),
    }
}

// 启动自动密钥轮换
func (m *KeyRotationManager) StartAutoRotation() {
    // 每月轮换一次主密钥
    m.scheduler.AddFunc("0 0 1 * *", func() {
        if err := m.RotateAllKeys(); err != nil {
            m.logger.Printf("自动密钥轮换失败: %v", err)
        }
    })

    m.scheduler.Start()
}

// 轮换所有密钥
func (m *KeyRotationManager) RotateAllKeys() error {
    keys, err := m.keyManager.ListKeys()
    if err != nil {
        return err
    }

    for _, keyID := range keys {
        if err := m.RotateKey(keyID); err != nil {
            m.logger.Printf("轮换密钥失败 [%s]: %v", keyID, err)
            continue
        }
        m.logger.Printf("密钥轮换成功: %s", keyID)
    }

    return nil
}

// 轮换单个密钥
func (m *KeyRotationManager) RotateKey(keyID string) error {
    // 创建新密钥
    newKey, err := m.keyManager.CreateEncryptionKey(keyID + "_new")
    if err != nil {
        return err
    }

    // 重新加密所有使用旧密钥的配置
    if err := m.reencryptConfigs(keyID, keyID+"_new"); err != nil {
        return err
    }

    // 删除旧密钥
    if err := m.keyManager.RotateKey(keyID); err != nil {
        return err
    }

    return nil
}

// 重新加密配置
func (m *KeyRotationManager) reencryptConfigs(oldKeyID, newKeyID string) error {
    // 获取所有使用旧密钥的配置
    configs, err := m.findConfigsByKeyID(oldKeyID)
    if err != nil {
        return err
    }

    for _, config := range configs {
        // 解密配置
        oldKey, err := m.keyManager.GetEncryptionKey(oldKeyID)
        if err != nil {
            return err
        }

        plaintext, err := m.decryptWithKey(config.EncryptedData, oldKey)
        if err != nil {
            return err
        }

        // 使用新密钥加密
        newEncryptedData, err := m.encryptWithNewKey(plaintext, newKeyID)
        if err != nil {
            return err
        }

        // 更新配置
        config.EncryptedData = newEncryptedData
        if err := m.storage.Set(config.Key, config.ConfigItem); err != nil {
            return err
        }
    }

    return nil
}