ThinkPHP 6.x企业级RBAC权限系统开发实战与安全加固指南

一、企业级RBAC权限架构设计

1.1 核心数据模型设计

// 数据库迁移文件
class CreateRbacTables extends Migration
{
    public function change()
    {
        // 用户表
        $table = $this->table('users', ['comment' => '用户表']);
        $table->addColumn('tenant_id', 'integer', ['comment' => '租户ID'])
              ->addColumn('username', 'string', ['limit' => 50, 'comment' => '用户名'])
              ->addColumn('email', 'string', ['limit' => 100, 'comment' => '邮箱'])
              ->addColumn('password', 'string', ['limit' => 255, 'comment' => '密码'])
              ->addColumn('status', 'integer', ['default' => 1, 'comment' => '状态'])
              ->addTimestamps()
              ->addIndex(['tenant_id', 'username'], ['unique' => true])
              ->create();
        
        // 角色表
        $table = $this->table('roles', ['comment' => '角色表']);
        $table->addColumn('tenant_id', 'integer', ['comment' => '租户ID'])
              ->addColumn('role_name', 'string', ['limit' => 50, 'comment' => '角色名称'])
              ->addColumn('description', 'text', ['comment' => '角色描述'])
              ->addColumn('data_scope', 'integer', ['default' => 1, 'comment' => '数据权限范围'])
              ->addTimestamps()
              ->create();
        
        // 权限节点表
        $table = $this->table('permissions', ['comment' => '权限节点表']);
        $table->addColumn('permission_key', 'string', ['limit' => 100, 'comment' => '权限标识'])
              ->addColumn('permission_name', 'string', ['limit' => 50, 'comment' => '权限名称'])
              ->addColumn('module', 'string', ['limit' => 30, 'comment' => '模块名'])
              ->addColumn('controller', 'string', ['limit' => 30, 'comment' => '控制器名'])
              ->addColumn('action', 'string', ['limit' => 30, 'comment' => '方法名'])
              ->addColumn('type', 'integer', ['default' => 1, 'comment' => '权限类型'])
              ->addTimestamps()
              ->addIndex(['permission_key'], ['unique' => true])
              ->create();
        
        // 用户角色关联表
        $table = $this->table('user_roles', ['comment' => '用户角色关联表']);
        $table->addColumn('user_id', 'integer')
              ->addColumn('role_id', 'integer')
              ->addIndex(['user_id', 'role_id'], ['unique' => true])
              ->create();
        
        // 角色权限关联表
        $table = $this->table('role_permissions', ['comment' => '角色权限关联表']);
        $table->addColumn('role_id', 'integer')
              ->addColumn('permission_id', 'integer')
              ->addIndex(['role_id', 'permission_id'], ['unique' => true])
              ->create();
    }
}

1.2 权限验证核心服务

// app/common/service/PermissionService.php
namespace appcommonservice;

use thinkfacadeCache;
use thinkfacadeDb;

class PermissionService
{
    protected $cacheKey = 'user_permissions:%d'; // 用户权限缓存键
    
    /**
     * 验证用户权限
     */
    public function checkPermission($userId, $permissionKey)
    {
        // 超级管理员拥有所有权限
        if ($this->isSuperAdmin($userId)) {
            return true;
        }
        
        $userPermissions = $this->getUserPermissions($userId);
        return in_array($permissionKey, $userPermissions);
    }
    
    /**
     * 获取用户所有权限
     */
    public function getUserPermissions($userId)
    {
        $cacheKey = sprintf($this->cacheKey, $userId);
        
        return Cache::remember($cacheKey, function() use ($userId) {
            return Db::name('user_roles ur')
                ->join('roles r', 'ur.role_id = r.id')
                ->join('role_permissions rp', 'r.id = rp.role_id')
                ->join('permissions p', 'rp.permission_id = p.id')
                ->where('ur.user_id', $userId)
                ->where('r.status', 1)
                ->column('p.permission_key');
        }, 3600); // 缓存1小时
    }
    
    /**
     * 清除用户权限缓存
     */
    public function clearUserPermissionCache($userId)
    {
        $cacheKey = sprintf($this->cacheKey, $userId);
        Cache::delete($cacheKey);
    }
    
    /**
     * 检查是否为超级管理员
     */
    protected function isSuperAdmin($userId)
    {
        // 根据业务逻辑判断，这里简单示例
        return $userId == 1;
    }
}