# 定义角色与权限

roles = {

"admin": ["create_user", "delete_user", "view_report"],

"user": ["view_report"],

"guest": []

}

  

# 用户与角色映射

user_roles = {

"alice": "admin",

"bob": "user",

"charlie": "guest"

}

  

def has_permission(username, action):

role = user_roles.get(username)

if not role:

return False

return action in roles.get(role, [])

  

# 测试

print(has_permission("alice", "create_user")) # True

print(has_permission("bob", "delete_user")) # False

print(has_permission("charlie", "view_report")) # False

from datetime import datetime

  

# 用户属性

user_attrs = {

"david": {"department": "sales", "level": "manager"},

"eva": {"department": "sales", "level": "staff"}

}

  

# 策略函数

def policy(user, resource, env):

attrs = user_attrs.get(user, {})

if resource == "customer_data":

return (

attrs.get("department") == "sales" and

attrs.get("level") == "manager" and

9 <= env["hour"] <= 18

)

return False

  

# 测试

env = {"hour": datetime.now().hour}

print(policy("david", "customer_data", env)) # True (若在工作时间)

print(policy("eva", "customer_data", env)) # False

# 定义资源与 ACL

acl = {

"file1.txt": {

"alice": ["read", "write"],

"bob": ["read"]

},

"file2.txt": {

"charlie": ["read"]

}

}

  

def check_acl(user, resource, action):

return action in acl.get(resource, {}).get(user, [])

  

# 测试

print(check_acl("alice", "file1.txt", "write")) # True

print(check_acl("bob", "file1.txt", "write")) # False

print(check_acl("charlie", "file2.txt", "read")) # True