@Entity
@Table(name = "users")
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(unique = true)
    private String username;
    
    private String email;
    private String password;
    private boolean enabled;
    
    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(
        name = "user_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id")
    )
    private Set<Role> roles = new HashSet<>();
    
    // getters and setters
}

@Entity
@Table(name = "roles")
public class Role {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(unique = true)
    private String name;
    
    private String description;
    
    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(
        name = "role_permissions",
        joinColumns = @JoinColumn(name = "role_id"),
        inverseJoinColumns = @JoinColumn(name = "permission_id")
    )
    private Set<Permission> permissions = new HashSet<>();
    
    // getters and setters
}

@Entity
@Table(name = "permissions")
public class Permission {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(unique = true)
    private String name;
    
    private String description;
    private String resourceType;
    private String action;
    
    // getters and setters
}

权限检查机制

@Service
public class PermissionService {
    
    @Autowired
    private UserRepository userRepository;
    
    @Autowired
    private RoleRepository roleRepository;
    
    public boolean hasPermission(String username, String permissionName) {
        User user = userRepository.findByUsername(username);
        if (user == null || !user.isEnabled()) {
            return false;
        }
        
        return user.getRoles().stream()
                .anyMatch(role -> role.getPermissions().stream()
                        .anyMatch(permission -> permission.getName().equals(permissionName)));
    }
    
    public boolean hasPermission(String username, String resourceType, String action) {
        User user = userRepository.findByUsername(username);
        if (user == null || !user.isEnabled()) {
            return false;
        }
        
        return user.getRoles().stream()
                .anyMatch(role -> role.getPermissions().stream()
                        .anyMatch(permission -> 
                            permission.getResourceType().equals(resourceType) && 
                            permission.getAction().equals(action)));
    }
    
    public Set<String> getUserPermissions(String username) {
        User user = userRepository.findByUsername(username);
        if (user == null || !user.isEnabled()) {
            return Collections.emptySet();
        }
        
        return user.getRoles().stream()
                .flatMap(role -> role.getPermissions().stream())
                .map(Permission::getName)
                .collect(Collectors.toSet());
    }
}

基于注解的权限控制

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Inherited
public @interface RequirePermission {
    String value();
    LogicalOperator operator() default LogicalOperator.AND;
}

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Inherited
public @interface RequireRole {
    String[] value();
    LogicalOperator operator() default LogicalOperator.AND;
}

@Aspect
@Component
public class PermissionCheckAspect {
    
    @Autowired
    private PermissionService permissionService;
    
    @Around("@annotation(requirePermission)")
    public Object checkPermission(ProceedingJoinPoint joinPoint, RequirePermission requirePermission) throws Throwable {
        String username = getCurrentUsername();
        String permission = requirePermission.value();
        
        if (!permissionService.hasPermission(username, permission)) {
            throw new AccessDeniedException("User " + username + " does not have permission: " + permission);
        }
        
        return joinPoint.proceed();
    }
    
    @Around("@annotation(requireRole)")
    public Object checkRole(ProceedingJoinPoint joinPoint, RequireRole requireRole) throws Throwable {
        String username = getCurrentUsername();
        String[] roles = requireRole.value();
        LogicalOperator operator = requireRole.operator();
        
        boolean hasRole = false;
        if (operator == LogicalOperator.AND) {
            hasRole = Arrays.stream(roles).allMatch(role -> hasRole(username, role));
        } else {
            hasRole = Arrays.stream(roles).anyMatch(role -> hasRole(username, role));
        }
        
        if (!hasRole) {
            throw new AccessDeniedException("User " + username + " does not have required roles: " + Arrays.toString(roles));
        }
        
        return joinPoint.proceed();
    }
    
    private String getCurrentUsername() {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        return authentication != null ? authentication.getName() : null;
    }
    
    private boolean hasRole(String username, String roleName) {
        User user = userRepository.findByUsername(username);
        return user != null && user.getRoles().stream()
                .anyMatch(role -> role.getName().equals(roleName));
    }
}

细粒度权限控制

资源级权限控制

@Service
public class ResourcePermissionService {
    
    public boolean canAccessResource(String username, ResourceType resourceType, 
                                   Long resourceId, ResourceAction action) {
        // 检查全局权限
        if (hasGlobalPermission(username, resourceType, action)) {
            return true;
        }
        
        // 检查资源所有者权限
        if (isResourceOwner(username, resourceType, resourceId)) {
            return true;
        }
        
        // 检查共享权限
        return hasSharedPermission(username, resourceType, resourceId, action);
    }
    
    private boolean hasGlobalPermission(String username, ResourceType resourceType, ResourceAction action) {
        return permissionService.hasPermission(username, resourceType.name(), action.name());
    }
    
    private boolean isResourceOwner(String username, ResourceType resourceType, Long resourceId) {
        switch (resourceType) {
            case TEST_CASE:
                TestCase testCase = testCaseRepository.findById(resourceId).orElse(null);
                return testCase != null && testCase.getCreatedBy().equals(username);
            case TEST_SUITE:
                TestSuite testSuite = testSuiteRepository.findById(resourceId).orElse(null);
                return testSuite != null && testSuite.getCreatedBy().equals(username);
            // 其他资源类型...
            default:
                return false;
        }
    }
    
    private boolean hasSharedPermission(String username, ResourceType resourceType, 
                                      Long resourceId, ResourceAction action) {
        ResourceShare share = resourceShareRepository.findByResourceIdAndResourceTypeAndSharedTo(
                resourceId, resourceType, username);
        return share != null && share.getPermissions().contains(action);
    }
}

数据级权限控制

@Service
public class DataPermissionService {
    
    public <T> List<T> filterByDataPermission(List<T> dataList, String username, 
                                            Class<T> dataType) {
        // 获取用户的数据权限范围
        Set<DataScope> userScopes = getUserDataScopes(username, dataType);
        
        // 根据数据权限过滤数据
        return dataList.stream()
                .filter(item -> isInDataScope(item, userScopes))
                .collect(Collectors.toList());
    }
    
    private Set<DataScope> getUserDataScopes(String username, Class<?> dataType) {
        User user = userRepository.findByUsername(username);
        Set<DataScope> scopes = new HashSet<>();
        
        // 基于角色的数据权限
        for (Role role : user.getRoles()) {
            RoleDataPermission rolePermission = roleDataPermissionRepository.findByRoleAndDataType(role, dataType);
            if (rolePermission != null) {
                scopes.addAll(rolePermission.getDataScopes());
            }
        }
        
        // 基于个人的数据权限
        List<UserDataPermission> userPermissions = userDataPermissionRepository.findByUserAndDataType(user, dataType);
        for (UserDataPermission permission : userPermissions) {
            scopes.addAll(permission.getDataScopes());
        }
        
        return scopes;
    }
    
    private boolean isInDataScope(Object item, Set<DataScope> scopes) {
        // 根据具体业务逻辑实现数据范围检查
        return scopes.stream().anyMatch(scope -> scope.contains(item));
    }
}

操作审计机制

审计日志设计

@Entity
@Table(name = "audit_logs")
public class AuditLog {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    private String username;
    private String action;
    private String resourceType;
    private Long resourceId;
    private String ipAddress;
    private String userAgent;
    private LocalDateTime timestamp;
    
    @Column(length = 1000)
    private String details;
    
    private String sessionId;
    private String traceId;
    
    // getters and setters
}

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface AuditLoggable {
    String action() default "";
    boolean logParameters() default true;
    boolean logReturnValue() default false;
}

@Aspect
@Component
public class AuditLogAspect {
    
    @Autowired
    private AuditLogService auditLogService;
    
    @Around("@annotation(auditLoggable)")
    public Object logAudit(ProceedingJoinPoint joinPoint, AuditLoggable auditLoggable) throws Throwable {
        AuditLog auditLog = new AuditLog();
        auditLog.setTimestamp(LocalDateTime.now());
        auditLog.setUsername(getCurrentUsername());
        auditLog.setIpAddress(getClientIpAddress());
        auditLog.setUserAgent(getUserAgent());
        auditLog.setSessionId(getSessionId());
        auditLog.setTraceId(MDC.get("traceId"));
        
        // 设置操作类型
        String action = auditLoggable.action();
        if (StringUtils.isEmpty(action)) {
            action = joinPoint.getSignature().getName();
        }
        auditLog.setAction(action);
        
        // 记录方法参数
        if (auditLoggable.logParameters()) {
            Object[] args = joinPoint.getArgs();
            auditLog.setDetails(JsonUtils.toJson(args));
        }
        
        try {
            Object result = joinPoint.proceed();
            
            // 记录返回值
            if (auditLoggable.logReturnValue()) {
                String details = auditLog.getDetails();
                if (details == null) {
                    details = "{}";
                }
                JsonNode detailsNode = JsonUtils.parse(details);
                ((ObjectNode) detailsNode).set("returnValue", JsonUtils.toJsonNode(result));
                auditLog.setDetails(JsonUtils.toJson(detailsNode));
            }
            
            auditLogService.saveAuditLog(auditLog);
            return result;
        } catch (Exception e) {
            // 记录异常信息
            String details = auditLog.getDetails();
            if (details == null) {
                details = "{}";
            }
            JsonNode detailsNode = JsonUtils.parse(details);
            ((ObjectNode) detailsNode).put("exception", e.getClass().getName());
            ((ObjectNode) detailsNode).put("errorMessage", e.getMessage());
            auditLog.setDetails(JsonUtils.toJson(detailsNode));
            
            auditLogService.saveAuditLog(auditLog);
            throw e;
        }
    }
}

审计日志存储与查询

@Service
public class AuditLogService {
    
    @Autowired
    private AuditLogRepository auditLogRepository;
    
    @Autowired
    private ElasticsearchTemplate elasticsearchTemplate;
    
    public void saveAuditLog(AuditLog auditLog) {
        // 保存到关系数据库
        auditLogRepository.save(auditLog);
        
        // 异步保存到Elasticsearch用于搜索
        CompletableFuture.runAsync(() -> {
            IndexQuery indexQuery = new IndexQueryBuilder()
                    .withIndex("audit-logs-" + LocalDate.now().format(DateTimeFormatter.BASIC_ISO_DATE))
                    .withObject(auditLog)
                    .build();
            elasticsearchTemplate.index(indexQuery);
        });
    }
    
    public List<AuditLog> searchAuditLogs(AuditLogSearchCriteria criteria) {
        // 构建查询条件
        BoolQueryBuilder queryBuilder = QueryBuilders.boolQuery();
        
        // 用户名查询
        if (StringUtils.isNotBlank(criteria.getUsername())) {
            queryBuilder.must(QueryBuilders.termQuery("username", criteria.getUsername()));
        }
        
        // 操作类型查询
        if (StringUtils.isNotBlank(criteria.getAction())) {
            queryBuilder.must(QueryBuilders.termQuery("action", criteria.getAction()));
        }
        
        // 时间范围查询
        if (criteria.getStartTime() != null && criteria.getEndTime() != null) {
            queryBuilder.must(QueryBuilders.rangeQuery("timestamp")
                    .gte(criteria.getStartTime())
                    .lte(criteria.getEndTime()));
        }
        
        // IP地址查询
        if (StringUtils.isNotBlank(criteria.getIpAddress())) {
            queryBuilder.must(QueryBuilders.termQuery("ipAddress", criteria.getIpAddress()));
        }
        
        // 执行查询
        SearchQuery searchQuery = new NativeSearchQueryBuilder()
                .withQuery(queryBuilder)
                .withPageable(PageRequest.of(criteria.getPage(), criteria.getSize()))
                .withSort(SortBuilders.fieldSort("timestamp").order(SortOrder.DESC))
                .build();
        
        return elasticsearchTemplate.queryForList(searchQuery, AuditLog.class);
    }
    
    public AuditReport generateAuditReport(AuditReportCriteria criteria) {
        // 统计用户操作次数
        Map<String, Long> userOperationStats = getUserOperationStats(criteria);
        
        // 统计操作类型分布
        Map<String, Long> actionDistribution = getActionDistribution(criteria);
        
        // 识别异常操作
        List<AuditLog> suspiciousOperations = identifySuspiciousOperations(criteria);
        
        return AuditReport.builder()
                .period(criteria.getStartTime(), criteria.getEndTime())
                .userOperationStats(userOperationStats)
                .actionDistribution(actionDistribution)
                .suspiciousOperations(suspiciousOperations)
                .build();
    }
}

权限管理界面设计

角色管理界面

@Controller
@RequestMapping("/admin/roles")
@RequireRole("ADMIN")
public class RoleManagementController {
    
    @Autowired
    private RoleService roleService;
    
    @GetMapping
    public String listRoles(Model model) {
        List<Role> roles = roleService.getAllRoles();
        model.addAttribute("roles", roles);
        return "admin/roles/list";
    }
    
    @GetMapping("/create")
    public String createRoleForm(Model model) {
        model.addAttribute("role", new Role());
        model.addAttribute("allPermissions", permissionService.getAllPermissions());
        return "admin/roles/create";
    }
    
    @PostMapping("/create")
    public String createRole(@ModelAttribute Role role, 
                           @RequestParam(required = false) List<Long> permissionIds) {
        if (permissionIds != null) {
            Set<Permission> permissions = permissionIds.stream()
                    .map(permissionService::getPermissionById)
                    .filter(Objects::nonNull)
                    .collect(Collectors.toSet());
            role.setPermissions(permissions);
        }
        
        roleService.createRole(role);
        return "redirect:/admin/roles";
    }
    
    @GetMapping("/{id}/edit")
    public String editRoleForm(@PathVariable Long id, Model model) {
        Role role = roleService.getRoleById(id);
        model.addAttribute("role", role);
        model.addAttribute("allPermissions", permissionService.getAllPermissions());
        return "admin/roles/edit";
    }
    
    @PostMapping("/{id}/edit")
    public String editRole(@PathVariable Long id, 
                          @ModelAttribute Role role,
                          @RequestParam(required = false) List<Long> permissionIds) {
        if (permissionIds != null) {
            Set<Permission> permissions = permissionIds.stream()
                    .map(permissionService::getPermissionById)
                    .filter(Objects::nonNull)
                    .collect(Collectors.toSet());
            role.setPermissions(permissions);
        }
        
        roleService.updateRole(id, role);
        return "redirect:/admin/roles";
    }
}

用户权限管理界面

@Controller
@RequestMapping("/admin/users")
@RequireRole("ADMIN")
public class UserManagementController {
    
    @Autowired
    private UserService userService;
    
    @Autowired
    private RoleService roleService;
    
    @GetMapping
    public String listUsers(@RequestParam(defaultValue = "0") int page,
                           @RequestParam(defaultValue = "20") int size,
                           Model model) {
        Page<User> users = userService.getUsers(PageRequest.of(page, size));
        model.addAttribute("users", users);
        return "admin/users/list";
    }
    
    @GetMapping("/{id}/permissions")
    public String manageUserPermissions(@PathVariable Long id, Model model) {
        User user = userService.getUserById(id);
        List<Role> allRoles = roleService.getAllRoles();
        
        model.addAttribute("user", user);
        model.addAttribute("allRoles", allRoles);
        return "admin/users/permissions";
    }
    
    @PostMapping("/{id}/permissions")
    public String updateUserPermissions(@PathVariable Long id,
                                      @RequestParam(required = false) List<Long> roleIds) {
        Set<Role> roles = new HashSet<>();
        if (roleIds != null) {
            roles = roleIds.stream()
                    .map(roleService::getRoleById)
                    .filter(Objects::nonNull)
                    .collect(Collectors.toSet());
        }
        
        userService.updateUserRoles(id, roles);
        return "redirect:/admin/users";
    }
}

安全最佳实践

密码安全策略

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(12);
    }
    
    @Bean
    public AuthenticationManager authenticationManager() throws Exception {
        return super.authenticationManager();
    }
    
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService())
            .passwordEncoder(passwordEncoder());
    }
    
    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService());
        authProvider.setPasswordEncoder(passwordEncoder());
        return authProvider;
    }
}

@Service
public class PasswordPolicyService {
    
    public boolean validatePassword(String password) {
        // 长度检查
        if (password.length() < 8) {
            return false;
        }
        
        // 复杂度检查
        boolean hasUpper = password.chars().anyMatch(Character::isUpperCase);
        boolean hasLower = password.chars().anyMatch(Character::isLowerCase);
        boolean hasDigit = password.chars().anyMatch(Character::isDigit);
        boolean hasSpecial = password.chars().anyMatch(ch -> !Character.isLetterOrDigit(ch));
        
        return hasUpper && hasLower && hasDigit && hasSpecial;
    }
    
    public void enforcePasswordChange(User user) {
        // 检查密码过期
        if (isPasswordExpired(user)) {
            user.setPasswordExpired(true);
            userRepository.save(user);
        }
    }
}

会话安全管理

@Component
public class SessionManagementService {
    
    @Autowired
    private SessionRegistry sessionRegistry;
    
    public void invalidateUserSessions(String username) {
        List<SessionInformation> sessions = sessionRegistry.getAllSessions(username, false);
        for (SessionInformation session : sessions) {
            session.expireNow();
        }
    }
    
    public int getActiveUserCount() {
        return sessionRegistry.getAllPrincipals().size();
    }
    
    public List<ActiveUserSession> getActiveUserSessions() {
        List<ActiveUserSession> activeSessions = new ArrayList<>();
        
        for (Object principal : sessionRegistry.getAllPrincipals()) {
            if (principal instanceof User) {
                User user = (User) principal;
                List<SessionInformation> sessions = sessionRegistry.getAllSessions(user, false);
                
                for (SessionInformation session : sessions) {
                    activeSessions.add(ActiveUserSession.builder()
                            .username(user.getUsername())
                            .sessionId(session.getSessionId())
                            .lastRequest(session.getLastRequest())
                            .build());
                }
            }
        }
        
        return activeSessions;
    }
}

多因素认证

@Service
public class TwoFactorAuthenticationService {
    
    @Autowired
    private TotpService totpService;
    
    @Autowired
    private UserRepository userRepository;
    
    public boolean enable2FA(String username, String secret) {
        User user = userRepository.findByUsername(username);
        if (user == null) {
            return false;
        }
        
        user.setTwoFactorEnabled(true);
        user.setTwoFactorSecret(secret);
        userRepository.save(user);
        
        return true;
    }
    
    public boolean verify2FAToken(String username, String token) {
        User user = userRepository.findByUsername(username);
        if (user == null || !user.isTwoFactorEnabled()) {
            return false;
        }
        
        return totpService.verifyToken(user.getTwoFactorSecret(), token);
    }
    
    public String generateSecretKey() {
        return totpService.generateSecretKey();
    }
    
    public String getQRCodeUrl(String username, String secret) {
        return totpService.getQRCodeUrl(username, secret);
    }
}

审计分析与报告

异常行为检测

@Service
public class AnomalyDetectionService {
    
    @Autowired
    private AuditLogRepository auditLogRepository;
    
    public List<SuspiciousActivity> detectSuspiciousActivities() {
        List<SuspiciousActivity> suspiciousActivities = new ArrayList<>();
        
        // 检测频繁失败的登录尝试
        List<FailedLoginAttempt> failedLogins = detectFailedLoginAttempts();
        suspiciousActivities.addAll(failedLogins.stream()
                .map(this::convertToSuspiciousActivity)
                .collect(Collectors.toList()));
        
        // 检测异常时间的操作
        List<OffHourActivity> offHourActivities = detectOffHourActivities();
        suspiciousActivities.addAll(offHourActivities.stream()
                .map(this::convertToSuspiciousActivity)
                .collect(Collectors.toList()));
        
        // 检测权限提升操作
        List<PrivilegeEscalation> privilegeEscalations = detectPrivilegeEscalations();
        suspiciousActivities.addAll(privilegeEscalations.stream()
                .map(this::convertToSuspiciousActivity)
                .collect(Collectors.toList()));
        
        return suspiciousActivities;
    }
    
    private List<FailedLoginAttempt> detectFailedLoginAttempts() {
        // 查找短时间内多次失败的登录尝试
        return auditLogRepository.findFailedLoginAttempts(
                LocalDateTime.now().minusHours(1), 5);
    }
    
    private List<OffHourActivity> detectOffHourActivities() {
        // 查找在非工作时间的敏感操作
        LocalTime workStart = LocalTime.of(9, 0);
        LocalTime workEnd = LocalTime.of(18, 0);
        
        return auditLogRepository.findOffHourActivities(workStart, workEnd);
    }
    
    private List<PrivilegeEscalation> detectPrivilegeEscalations() {
        // 查找权限相关的异常操作
        return auditLogRepository.findPrivilegeEscalations();
    }
}

合规报告生成

@Service
public class ComplianceReportService {
    
    @Autowired
    private AuditLogService auditLogService;
    
    @Autowired
    private UserService userService;
    
    public ComplianceReport generateSOXComplianceReport(LocalDate periodStart, LocalDate periodEnd) {
        ComplianceReport report = new ComplianceReport();
        report.setPeriodStart(periodStart);
        report.setPeriodEnd(periodEnd);
        
        // 统计系统访问情况
        report.setTotalUsers(userService.getTotalUserCount());
        report.setActiveUsers(userService.getActiveUserCount(periodStart, periodEnd));
        
        // 统计关键操作
        AuditLogSearchCriteria criteria = AuditLogSearchCriteria.builder()
                .startTime(periodStart.atStartOfDay())
                .endTime(periodEnd.atTime(23, 59, 59))
                .build();
        
        List<AuditLog> auditLogs = auditLogService.searchAuditLogs(criteria);
        report.setTotalOperations(auditLogs.size());
        
        // 分析权限变更操作
        long permissionChanges = auditLogs.stream()
                .filter(log -> log.getAction().contains("PERMISSION"))
                .count();
        report.setPermissionChanges(permissionChanges);
        
        // 分析数据访问操作
        long dataAccessOperations = auditLogs.stream()
                .filter(log -> log.getAction().contains("DATA_ACCESS"))
                .count();
        report.setDataAccessOperations(dataAccessOperations);
        
        // 识别高风险操作
        List<AuditLog> highRiskOperations = auditLogs.stream()
                .filter(this::isHighRiskOperation)
                .collect(Collectors.toList());
        report.setHighRiskOperations(highRiskOperations);
        
        return report;
    }
    
    private boolean isHighRiskOperation(AuditLog auditLog) {
        String action = auditLog.getAction();
        return action.contains("DELETE") || 
               action.contains("MODIFY") || 
               action.contains("EXPORT") ||
               action.contains("PERMISSION");
    }
}

总结

用户权限管理和操作审计是测试平台安全体系的重要组成部分。通过实施RBAC权限模型和完善的审计机制，我们能够：

保障系统安全：通过细粒度的权限控制防止未授权访问
满足合规要求：通过完整的操作审计满足法规和内部合规要求
提升管理效率：通过角色化管理简化权限分配和维护
支持问题追溯：通过详细的操作日志支持问题定位和责任认定

在实施过程中，需要注意以下关键点：

权限最小化原则：只授予用户完成工作所需的最小权限
定期权限审查：定期审查和清理不必要的权限分配
审计日志完整性：确保审计日志的完整性和不可篡改性
异常行为检测：建立自动化的异常行为检测机制

通过持续完善权限管理和操作审计体系，测试平台能够在保障安全的前提下，为用户提供更好的使用体验，同时满足企业的合规要求。