怎样实现权限校验脚本

wen 实用脚本 2026-06-29 226

本文目录导读：

怎样实现权限校验脚本

基础权限校验（Python版本）
RBAC（基于角色的访问控制）实现
基于令牌的权限校验（JWT）
Linux系统脚本（Shell版本）
数据库权限校验
通用权限校验装饰器
关键设计原则

我来详细说明如何实现权限校验脚本,这里提供几种常见场景的实现方案：

基础权限校验（Python版本）

import os
import stat
import sys
def check_file_permissions(filepath):
    """检查文件权限"""
    try:
        # 获取文件状态
        file_stat = os.stat(filepath)
        mode = file_stat.st_mode
        # 检查各种权限
        permissions = {
            'owner_read': bool(mode & stat.S_IRUSR),
            'owner_write': bool(mode & stat.S_IWUSR),
            'owner_execute': bool(mode & stat.S_IXUSR),
            'group_read': bool(mode & stat.S_IRGRP),
            'group_write': bool(mode & stat.S_IWGRP),
            'group_execute': bool(mode & stat.S_IXGRP),
            'other_read': bool(mode & stat.S_IROTH),
            'other_write': bool(mode & stat.S_IWOTH),
            'other_execute': bool(mode & stat.S_IXOTH)
        }
        return permissions
    except FileNotFoundError:
        print(f"文件 {filepath} 不存在")
        return None
    except PermissionError:
        print(f"没有权限访问 {filepath}")
        return None
def check_user_permissions(username, resource):
    """检查用户对资源的权限"""
    # 这里可以实现基于用户组的权限检查
    authorized_users = ['admin', 'root', username]
    if username in authorized_users:
        return True
    return False
# 使用示例
if __name__ == "__main__":
    # 检查文件权限
    perms = check_file_permissions("/etc/passwd")
    if perms:
        print("文件权限:")
        for key, value in perms.items():
            print(f"  {key}: {'✓' if value else '✗'}")

RBAC（基于角色的访问控制）实现

from enum import Enum
from typing import Set, Dict, List
class Permission(Enum):
    READ = "read"
    WRITE = "write"
    DELETE = "delete"
    EXECUTE = "execute"
    ADMIN = "admin"
class Role:
    def __init__(self, name: str, permissions: Set[Permission]):
        self.name = name
        self.permissions = permissions
    def has_permission(self, permission: Permission) -> bool:
        return permission in self.permissions
class RBACSystem:
    def __init__(self):
        # 预定义角色
        self.roles = {
            'admin': Role('admin', {Permission.READ, Permission.WRITE, 
                                  Permission.DELETE, Permission.EXECUTE, 
                                  Permission.ADMIN}),
            'editor': Role('editor', {Permission.READ, Permission.WRITE, 
                                     Permission.EXECUTE}),
            'viewer': Role('viewer', {Permission.READ})
        }
        # 用户到角色的映射
        self.user_roles: Dict[str, List[str]] = {}
    def assign_role(self, username: str, role_name: str):
        """为用户分配角色"""
        if role_name not in self.roles:
            raise ValueError(f"角色 {role_name} 不存在")
        if username not in self.user_roles:
            self.user_roles[username] = []
        if role_name not in self.user_roles[username]:
            self.user_roles[username].append(role_name)
    def check_permission(self, username: str, permission: Permission) -> bool:
        """检查用户是否有指定权限"""
        if username not in self.user_roles:
            return False
        for role_name in self.user_roles[username]:
            role = self.roles[role_name]
            if role.has_permission(permission):
                return True
        return False
    def revoke_role(self, username: str, role_name: str):
        """撤销用户的角色"""
        if username in self.user_roles and role_name in self.user_roles[username]:
            self.user_roles[username].remove(role_name)
# 使用示例
rbac = RBACSystem()
rbac.assign_role("张三", "editor")
print(rbac.check_permission("张三", Permission.WRITE))  # True
print(rbac.check_permission("张三", Permission.DELETE))  # False

基于令牌的权限校验（JWT）

import jwt
import time
from functools import wraps
from flask import request, jsonify
class JWTAuth:
    def __init__(self, secret_key, algorithm='HS256'):
        self.secret_key = secret_key
        self.algorithm = algorithm
    def create_token(self, user_id, role, permissions, expiry=3600):
        """创建JWT令牌"""
        payload = {
            'user_id': user_id,
            'role': role,
            'permissions': permissions,
            'exp': int(time.time()) + expiry,
            'iat': int(time.time())
        }
        return jwt.encode(payload, self.secret_key, algorithm=self.algorithm)
    def verify_token(self, token):
        """验证令牌"""
        try:
            payload = jwt.decode(token, self.secret_key, algorithms=[self.algorithm])
            return payload
        except jwt.ExpiredSignatureError:
            return None
        except jwt.InvalidTokenError:
            return None
    def require_permission(self, required_permission):
        """权限校验装饰器"""
        def decorator(f):
            @wraps(f)
            def decorated_function(*args, **kwargs):
                token = request.headers.get('Authorization', '').replace('Bearer ', '')
                if not token:
                    return jsonify({'error': '未提供令牌'}), 401
                payload = self.verify_token(token)
                if not payload:
                    return jsonify({'error': '令牌无效或已过期'}), 401
                # 检查权限
                if required_permission not in payload.get('permissions', []):
                    return jsonify({'error': '权限不足'}), 403
                # 将用户信息传递给视图函数
                request.user = payload
                return f(*args, **kwargs)
            return decorated_function
        return decorator
# Flask应用示例
from flask import Flask
app = Flask(__name__)
auth = JWTAuth('your-secret-key')
@app.route('/api/admin')
@auth.require_permission('admin')
def admin_panel():
    return jsonify({'message': '欢迎管理员', 'user': request.user})
@app.route('/api/login')
def login():
    # 模拟登录
    token = auth.create_token(
        user_id=1,
        role='admin',
        permissions=['read', 'write', 'admin']
    )
    return jsonify({'token': token})

Linux系统脚本（Shell版本）

#!/bin/bash
# 权限校验脚本
check_permissions() {
    local file_path=$1
    local required_perms=$2  # 格式: rwx
    if [ ! -e "$file_path" ]; then
        echo "错误: 文件 $file_path 不存在"
        return 1
    fi
    # 获取当前文件权限
    local file_perms=$(stat -c "%A" "$file_path" | cut -c2-10)
    echo "当前权限: $file_perms"
    # 检查权限
    local missing_perms=""
    [[ "$required_perms" == *"r"* && ! "$file_perms" == *"r"* ]] && missing_perms+="r"
    [[ "$required_perms" == *"w"* && ! "$file_perms" == *"w"* ]] && missing_perms+="w"
    [[ "$required_perms" == *"x"* && ! "$file_perms" == *"x"* ]] && missing_perms+="x"
    if [ -n "$missing_perms" ]; then
        echo "缺少权限: $missing_perms"
        return 1
    fi
    echo "权限检查通过"
    return 0
}
# 用户权限检查
check_user_access() {
    local username=$1
    local resource=$2
    # 检查用户是否存在
    if ! id "$username" &>/dev/null; then
        echo "用户 $username 不存在"
        return 1
    fi
    # 检查是否是root
    if [ "$(id -u "$username")" -eq 0 ]; then
        echo "root用户拥有所有权限"
        return 0
    fi
    # 检查文件所有者
    local owner=$(stat -c '%U' "$resource")
    if [ "$username" == "$owner" ]; then
        echo "用户是文件所有者"
        return 0
    fi
    # 检查用户组
    local group=$(stat -c '%G' "$resource")
    if groups "$username" | grep -q "\b$group\b"; then
        echo "用户属于文件所在组"
        return 0
    fi
    echo "用户没有访问权限"
    return 1
}
# 主函数
main() {
    local action=$1
    case $action in
        "file")
            check_permissions "$2" "$3"
            ;;
        "user")
            check_user_access "$2" "$3"
            ;;
        *)
            echo "用法: $0 {file|user} <参数>"
            exit 1
            ;;
    esac
}
main "$@"

数据库权限校验

import sqlite3
from contextlib import contextmanager
class DatabasePermissions:
    def __init__(self, db_path):
        self.db_path = db_path
        self.init_database()
    def init_database(self):
        """初始化权限表"""
        with self.get_connection() as conn:
            conn.execute('''
                CREATE TABLE IF NOT EXISTS permissions (
                    id INTEGER PRIMARY KEY AUTOINCREMENT,
                    user_id INTEGER,
                    resource_type TEXT,
                    resource_id TEXT,
                    permission_type TEXT,
                    granted INTEGER DEFAULT 1,
                    UNIQUE(user_id, resource_type, resource_id, permission_type)
                )
            ''')
            conn.execute('''
                CREATE TABLE IF NOT EXISTS user_roles (
                    user_id INTEGER,
                    role_name TEXT,
                    PRIMARY KEY (user_id, role_name)
                )
            ''')
            conn.execute('''
                CREATE TABLE IF NOT EXISTS role_permissions (
                    role_name TEXT,
                    permission_name TEXT,
                    PRIMARY KEY (role_name, permission_name)
                )
            ''')
            conn.commit()
    @contextmanager
    def get_connection(self):
        conn = sqlite3.connect(self.db_path)
        try:
            yield conn
        finally:
            conn.close()
    def check_permission(self, user_id, resource_type, resource_id, permission_type):
        """检查用户是否有特定权限"""
        with self.get_connection() as conn:
            # 检查直接权限
            cursor = conn.execute('''
                SELECT granted FROM permissions 
                WHERE user_id = ? AND resource_type = ? 
                AND resource_id = ? AND permission_type = ?
            ''', (user_id, resource_type, resource_id, permission_type))
            result = cursor.fetchone()
            if result:
                return bool(result[0])
            # 检查角色权限
            cursor = conn.execute('''
                SELECT COUNT(*) FROM user_roles ur
                JOIN role_permissions rp ON ur.role_name = rp.role_name
                WHERE ur.user_id = ? AND rp.permission_name = ?
            ''', (user_id, permission_type))
            return cursor.fetchone()[0] > 0
    def grant_permission(self, user_id, resource_type, resource_id, permission_type):
        """授予权限"""
        with self.get_connection() as conn:
            conn.execute('''
                INSERT OR REPLACE INTO permissions 
                (user_id, resource_type, resource_id, permission_type, granted)
                VALUES (?, ?, ?, ?, 1)
            ''', (user_id, resource_type, resource_id, permission_type))
            conn.commit()
# 使用示例
db_perms = DatabasePermissions('permissions.db')
db_perms.grant_permission(1, 'file', 'document.txt', 'read')
print(db_perms.check_permission(1, 'file', 'document.txt', 'read'))  # True

通用权限校验装饰器

from functools import wraps
from typing import Callable, Any
class PermissionChecker:
    def __init__(self):
        self.permission_handlers = {}
    def register_handler(self, permission_type: str, handler: Callable):
        """注册权限处理函数"""
        self.permission_handlers[permission_type] = handler
    def require(self, permission_type: str, *args, **kwargs):
        """权限校验装饰器"""
        def decorator(func: Callable) -> Callable:
            @wraps(func)
            def wrapper(*func_args, **func_kwargs) -> Any:
                if permission_type in self.permission_handlers:
                    handler = self.permission_handlers[permission_type]
                    if not handler(*args, **kwargs):
                        raise PermissionError(f"缺少 {permission_type} 权限")
                else:
                    raise ValueError(f"未知的权限类型: {permission_type}")
                return func(*func_args, **func_kwargs)
            return wrapper
        return decorator
# 权限处理器示例
def admin_permission_check(user_id: int) -> bool:
    return user_id == 1  # 假设用户ID为1的是管理员
def file_permission_check(user_id: int, filename: str, action: str) -> bool:
    # 实现文件权限检查逻辑
    authorized_users = {1: ['read', 'write'], 2: ['read']}
    if user_id in authorized_users and action in authorized_users[user_id]:
        return True
    return False
# 使用通用权限校验
checker = PermissionChecker()
checker.register_handler('admin', admin_permission_check)
checker.register_handler('file', file_permission_check)
@checker.require('admin', user_id=1)
def admin_function():
    return "管理员功能"
@checker.require('file', user_id=2, filename='test.txt', action='read')
def read_file():
    return "读取文件成功"

关键设计原则

最小权限原则：只授予必要的最小权限
职责分离：不同的操作需要不同的权限
默认拒绝：除非明确授权，否则拒绝访问
权限分级：建立清晰的权限层级
审计日志：记录权限变更和访问记录

根据你的具体需求选择合适的实现方案，如果是简单的脚本，推荐使用Python的装饰器方式；如果是系统级别的,建议使用RBAC或JWT方案。

本文地址： https://www.bmjup.com/post/11883.html