电商篇：安全——基于请求方法的访问控制绕过

授权规则：p, admin, /api/users/*/role, POST, allow
处理函数：func UpdateRole(w, r) { ... 不看 r.Method ... }
路由注册：mux.HandleFunc("/api/users/{id}/role", UpdateRole)   ← 所有方法都进这个函数

rpc GetProductDetail(GetProductDetailRequest) returns (GetProductDetailResponse) {
  option idempotency_level = NO_SIDE_EFFECTS;   // 只有标了它，Connect 才放开 GET
}

paymentv1connectPath, paymentv1connectHandler := paymentv1connect.NewPaymentServiceHandler(
    paymentv1Service,
    combinedOptions...,
)
mux.Handle(paymentv1connectPath, paymentv1connectHandler)

// control-tower services/gateway/internal/httpmw/auth.go
allowed, err := d.Enforcer.Allowed(claims.RoleNames(), path, r.Method)
if !allowed {
    d.Errors.Write(w, r, connect.CodePermissionDenied, "RBAC_DENIED", "role not permitted for this procedure")
    return
}

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act, eft

[policy_effect]
e = some(where (p.eft == allow)) && !some(where (p.eft == deny))

[matchers]
m = g(r.sub, p.sub) && keyMatch2(r.obj, p.obj) && regexMatch(r.act, p.act)

// 方法不匹配。
{[]string{"customer"}, "/cart.v1.CartService/AddItem", "DELETE", false},

// control-tower services/gateway/internal/httpmw/auth.go
if res.viaCookie && !safeMethod(r.Method) && d.OriginAllowed != nil {
    if !d.OriginAllowed(r.Header.Get("Origin")) {
        d.Errors.Write(w, r, connect.CodePermissionDenied, "CSRF_ORIGIN_REJECTED", "origin not allowed for state-changing request")
        return
    }
}

func safeMethod(m string) bool {
    switch m {
    case http.MethodGet, http.MethodHead, http.MethodOptions:
        return true
    default:
        return false
    }
}

// 修补前
func (s *MerchantService) ApproveApplication(ctx context.Context, c *connect.Request[v1.ApproveApplicationRequest]) (*connect.Response[v1.ApproveApplicationResponse], error) {
    req := c.Msg
    _, err := s.uc.ApproveApplication(ctx, &biz.ApproveApplicationRequest{
        AuditComment:  req.AuditComment,
        ApplicationId: req.ApplicationId,
    })
    // ...
}

p, admin, /merchant.v1.MerchantService/ApproveApplication, POST, allow

// HeaderRole 是网关按已验签 claims 注入的角色列表，多角色逗号拼接。
// 角色名与 Casdoor 原值一致：admin / merchant / customer。
const HeaderRole = "x-md-global-role"

const RoleAdmin = "admin"

var ErrRoleNotAllowed = errors.New("identity: 当前用户没有执行该操作的角色")

// RequireRole 返回登录用户的 ID，并要求其持有 role。
// 访客、无身份、角色不含 role 分别返回 ErrAnonymousNotAllowed / ErrNoIdentity / ErrRoleNotAllowed。
func RequireRole(h http.Header, role string) (string, error) {
    id, err := RequireUser(h)
    if err != nil {
        return "", err
    }
    for _, r := range Roles(h) {
        if r == role {
            return id, nil
        }
    }
    return "", fmt.Errorf("%w: 需要 %q", ErrRoleNotAllowed, role)
}

// requireAdmin 是审批类 RPC 的 handler 内授权：判「主体能不能审批」，不判 HTTP 方法。
func requireAdmin(h http.Header) error {
    _, err := identity.RequireRole(h, identity.RoleAdmin)
    switch {
    case err == nil:
        return nil
    case errors.Is(err, identity.ErrRoleNotAllowed):
        return connect.NewError(connect.CodePermissionDenied, err)
    default:
        return connect.NewError(connect.CodeUnauthenticated, err)
    }
}

func (s *MerchantService) ApproveApplication(ctx context.Context, c *connect.Request[v1.ApproveApplicationRequest]) (*connect.Response[v1.ApproveApplicationResponse], error) {
    if err := requireAdmin(c.Header()); err != nil {
        return nil, err
    }
    req := c.Msg
    // ...
}

func TestApproveApplication_RequiresAdminBeforeUseCase(t *testing.T) {
    s := &MerchantService{}   // uc 故意留 nil
    cases := []struct {
        name   string
        userID string
        anon   string
        roles  string
        want   connect.Code
    }{
        {"merchant 角色被拒", user, "", "merchant", connect.CodePermissionDenied},
        {"无角色被拒", user, "", "", connect.CodePermissionDenied},
        {"访客被拒", user, "true", "admin", connect.CodeUnauthenticated},
        {"无身份被拒", "", "", "admin", connect.CodeUnauthenticated},
    }
    // ...
}

// control-tower services/gateway/internal/authz/authz.go
// allowedAct 是 p 行 act 列唯一合法的字面值。Connect procedure 一律 POST。
const allowedAct = "POST"

// validatePolicyRow 校验 p 行（不含 ptype）：列数固定 4，act 列只认字面 POST。
//
// 拒绝的不只是 `.*`：`GET|POST`、`(GET)|(POST)`、`POST.*`、小写 `post`、
// 单独的 `GET` 全部拒绝——regexMatch 下这些都不是「恰好 POST」，而任何比
// POST 更宽的匹配都会让授权层与执行层对「这是什么操作」的理解分叉。
func validatePolicyRow(fields []string) error {
    if len(fields) != pFieldCount {
        return fmt.Errorf("p row must have %d fields (sub, obj, act, eft), got %d", pFieldCount, len(fields))
    }
    if act := fields[2]; act != allowedAct {
        return fmt.Errorf("p row act column must be literally %q, got %q (wildcards and method alternations are refused)", allowedAct, act)
    }
    return nil
}

func TestActColumnMustBeLiteralPOST(t *testing.T) {
    a := newEnforcer(t)
    bad := []string{
        "p, admin, /user.v1.UserService/UpdateRole, .*, allow",
        "p, admin, /user.v1.UserService/UpdateRole, (GET)|(POST), allow",
        "p, admin, /user.v1.UserService/UpdateRole, GET|POST, allow",
        "p, admin, /user.v1.UserService/UpdateRole, POST.*, allow",
        "p, admin, /user.v1.UserService/UpdateRole, GET, allow",
        "p, admin, /user.v1.UserService/UpdateRole, post, allow",
        "p, admin, /user.v1.UserService/UpdateRole, allow", // 少一列：act 位被 eft 顶上
    }
    for _, row := range bad {
        if err := a.SetPolicies(modelText, row); err == nil {
            t.Errorf("row %q must be refused", row)
        }
    }
    // 旧策略仍然生效（last-known-good）。
    ok, err := a.Allowed([]string{"customer"}, "/cart.v1.CartService/AddItem", "POST")
    if err != nil || !ok {
        t.Fatalf("old enforcer must keep working: ok=%v err=%v", ok, err)
    }
    // 反向：字面 POST 正常加载，且对 GET 仍然默认拒绝。
    if err := a.SetPolicies(modelText, "p, admin, /user.v1.UserService/UpdateRole, POST, allow"); err != nil {
        t.Fatalf("literal POST must load: %v", err)
    }
    if ok, _ := a.Allowed([]string{"admin"}, "/user.v1.UserService/UpdateRole", "GET"); ok {
        t.Fatal("GET must not match a POST-only rule")
    }
}

// getEnabledRPCs 是允许经 GET 到达的 procedure 白名单（`/pkg.Service/Method`）。
var getEnabledRPCs = map[string]bool{}

func TestNoSideEffectsRPCsAreAllowlisted(t *testing.T) {
    // 遍历 backend/api/**/*.proto，逐行跟踪 package / service / rpc，
    // 遇到 idempotency_level = NO_SIDE_EFFECTS 就拼出 procedure 查白名单。
    // ...
    if !getEnabledRPCs[procedure] {
        t.Errorf("%s:%d 标了 NO_SIDE_EFFECTS（放开 GET）但 %s 不在 getEnabledRPCs 白名单；"+
            "先确认它真的无副作用并同步 control-tower authz.allowedAct，再把它加进白名单", path, line, procedure)
    }
}

--- FAIL: TestNoSideEffectsRPCsAreAllowlisted (0.00s)
    rpc_method_test.go:74: ../api/product/v1/product.proto:13 标了 NO_SIDE_EFFECTS（放开 GET）
    但 /product.v1.ProductService/GetProductDetail 不在 getEnabledRPCs 白名单；……