LoopBack4授权实现咨询：求比Casbin更简易的ACL方案

如果你觉得Casbin的规则定义和配置过于复杂，以下几种轻量型ACL实现方式更适合业务场景相对简单的LoopBack4应用：

1. 利用LoopBack4内置授权机制+角色验证 #

LoopBack4本身提供了基础的授权组件，无需引入第三方复杂库就能实现角色级的ACL控制：

• 首先定义角色枚举：

  export enum Role {
    ADMIN = 'admin',
    USER = 'user',
    GUEST = 'guest'
  }
  

• 实现自定义授权策略提供者，继承AuthorizationProvider接口：

  import {AuthorizationContext, AuthorizationDecision, AuthorizationMetadata, AuthorizationProvider} from '@loopback/authorization';
  import {inject} from '@loopback/core';
  import {SecurityBindings} from '@loopback/security';
  import {UserProfile} from '@loopback/security';
  
  export class RoleAuthorizationProvider implements AuthorizationProvider {
    constructor(
      @inject(SecurityBindings.USER, {optional: true})
      private user: UserProfile,
    ) {}
  
    async authorize(
      context: AuthorizationContext,
      metadata: AuthorizationMetadata,
    ): Promise<AuthorizationDecision> {
      // 无用户信息则拒绝访问
      if (!this.user) return AuthorizationDecision.DENY;
      // 检查用户角色是否在允许列表中
      const allowedRoles = metadata.allowedRoles ?? [];
      return allowedRoles.includes(this.user.role as Role)
        ? AuthorizationDecision.ALLOW
        : AuthorizationDecision.DENY;
    }
  }
  

• 在应用中注册授权组件和自定义策略：

  import {AuthorizationComponent} from '@loopback/authorization';
  import {MyApplication} from './application';
  
  export class MyApplication extends BootMixin(
    ServiceMixin(RepositoryMixin(RestApplication)),
  ) {
    constructor(options: ApplicationConfig = {}) {
      super(options);
      // 注册授权组件
      this.component(AuthorizationComponent);
      // 绑定自定义授权策略
      this.bind('authorizationProviders.role-based').to(RoleAuthorizationProvider);
    }
  }
  

• 最后在控制器方法上标记允许的角色：

  import {authorize} from '@loopback/authorization';
  import {get} from '@loopback/rest';
  import {Role} from '../enums/role';
  
  export class UserController {
    @get('/users')
    @authorize({allowedRoles: [Role.ADMIN]})
    async getAllUsers() {
      // 业务逻辑
    }
  }
  

2. 基于路由中间件的轻量ACL #

如果你的权限规则可以通过请求路径+HTTP方法直接映射，写一个路由中间件是最直接的方式：

• 实现权限检查中间件：

  import {Middleware, MiddlewareContext} from '@loopback/core';
  import {SecurityBindings} from '@loopback/security';
  import {UserProfile} from '@loopback/security';
  
  // 定义权限映射表：路径+方法 => 允许角色
  const PERMISSION_MAP = {
    'GET /users': ['admin'],
    'POST /orders': ['user'],
    'GET /public': ['guest', 'user', 'admin'],
  };
  
  export const AclMiddleware: Middleware = async (ctx: MiddlewareContext, next) => {
    const user: UserProfile | undefined = await ctx.get(SecurityBindings.USER, {optional: true});
    const key = `${ctx.request.method} ${ctx.request.path}`;
    const allowedRoles = PERMISSION_MAP[key];
  
    // 无权限配置的路径默认允许访问（或根据需求改为拒绝）
    if (!allowedRoles) return next();
    // 无用户且需要权限则拒绝
    if (!user) throw new Error('Unauthorized');
    // 检查角色是否匹配
    if (!allowedRoles.includes(user.role)) throw new Error('Forbidden');
  
    return next();
  };
  

• 在应用中注册中间件：

  export class MyApplication extends BootMixin(...) {
    constructor(options: ApplicationConfig = {}) {
      super(options);
      // 全局注册ACL中间件
      this.middleware(AclMiddleware);
      // 或针对特定路由注册
      // this.route('get', '/users', AclMiddleware, UserController.prototype.getAllUsers);
    }
  }
  

3. 自定义权限装饰器+细粒度权限检查 #

如果需要更细粒度的权限控制（比如view:user、edit:order这类操作级权限），可以自定义装饰器结合权限服务：

• 先创建自定义装饰器：

  import {MetadataAccessor, MethodDecoratorFactory} from '@loopback/core';
  
  export const PERMISSION_METADATA = MetadataAccessor.create<string[]>('permission');
  
  export function permission(...permissions: string[]) {
    return MethodDecoratorFactory.createDecorator(PERMISSION_METADATA, permissions);
  }
  

• 实现权限检查服务：

  import {injectable} from '@loopback/core';
  import {UserProfile} from '@loopback/security';
  
  @injectable()
  export class PermissionService {
    // 这里可以从数据库/配置文件加载用户权限，示例用硬编码模拟
    getUserPermissions(user: UserProfile): string[] {
      if (user.role === 'admin') return ['view:user', 'edit:user', 'view:order', 'edit:order'];
      if (user.role === 'user') return ['view:user', 'view:order'];
      return [];
    }
  
    checkPermission(user: UserProfile, requiredPermissions: string[]): boolean {
      const userPermissions = this.getUserPermissions(user);
      return requiredPermissions.every(p => userPermissions.includes(p));
    }
  }
  

• 结合授权策略使用：

  import {AuthorizationContext, AuthorizationDecision, AuthorizationMetadata, AuthorizationProvider} from '@loopback/authorization';
  import {inject} from '@loopback/core';
  import {SecurityBindings} from '@loopback/security';
  import {UserProfile} from '@loopback/security';
  import {PERMISSION_METADATA} from '../decorators/permission';
  import {PermissionService} from '../services/permission.service';
  
  export class PermissionAuthorizationProvider implements AuthorizationProvider {
    constructor(
      @inject(SecurityBindings.USER, {optional: true})
      private user: UserProfile,
      @inject('services.PermissionService')
      private permissionService: PermissionService,
    ) {}
  
    async authorize(
      context: AuthorizationContext,
      metadata: AuthorizationMetadata,
    ): Promise<AuthorizationDecision> {
      if (!this.user) return AuthorizationDecision.DENY;
      // 获取自定义装饰器标记的权限
      const requiredPermissions = context.metadata?.get(PERMISSION_METADATA) ?? [];
      if (requiredPermissions.length === 0) return AuthorizationDecision.ALLOW;
      // 检查权限
      return this.permissionService.checkPermission(this.user, requiredPermissions)
        ? AuthorizationDecision.ALLOW
        : AuthorizationDecision.DENY;
    }
  }
  

• 在控制器方法上使用：

  import {authorize} from '@loopback/authorization';
  import {get} from '@loopback/rest';
  import {permission} from '../decorators/permission';
  
  export class UserController {
    @get('/users/{id}')
    @authorize()
    @permission('view:user')
    async getUserById(@param.path.string('id') id: string) {
      // 业务逻辑
    }
  }
  

选择建议 #

• 如果只是简单的角色级控制，优先用LoopBack4内置的@authorize方案，配置最少；
• 如果权限规则和路由强绑定，用中间件方案最直接；
• 需要操作级的细粒度权限，选择自定义装饰器+权限服务的组合。

内容的提问来源于stack exchange，提问作者haider ali