当前位置：首页 > PHP

php实现权限管理

2026-01-28 22:12:25PHP

基于角色的访问控制（RBAC）实现

RBAC是一种常见的权限管理模型，通过角色关联权限，用户关联角色实现权限控制。以下是一个基础实现示例：

定义数据库表结构：

CREATE TABLE users (
    id INT PRIMARY KEY AUTO_INCREMENT,
    username VARCHAR(50) NOT NULL,
    password VARCHAR(255) NOT NULL
);

CREATE TABLE roles (
    id INT PRIMARY KEY AUTO_INCREMENT,
    name VARCHAR(50) NOT NULL
);

CREATE TABLE permissions (
    id INT PRIMARY KEY AUTO_INCREMENT,
    name VARCHAR(50) NOT NULL,
    description TEXT
);

CREATE TABLE role_permission (
    role_id INT,
    permission_id INT,
    PRIMARY KEY (role_id, permission_id),
    FOREIGN KEY (role_id) REFERENCES roles(id),
    FOREIGN KEY (permission_id) REFERENCES permissions(id)
);

CREATE TABLE user_role (
    user_id INT,
    role_id INT,
    PRIMARY KEY (user_id, role_id),
    FOREIGN KEY (user_id) REFERENCES users(id),
    FOREIGN KEY (role_id) REFERENCES roles(id)
);

权限检查函数示例：

function hasPermission($userId, $permissionName) {
    $db = new PDO('mysql:host=localhost;dbname=your_db', 'username', 'password');

    $stmt = $db->prepare("
        SELECT COUNT(*) 
        FROM user_role ur
        JOIN role_permission rp ON ur.role_id = rp.role_id
        JOIN permissions p ON rp.permission_id = p.id
        WHERE ur.user_id = ? AND p.name = ?
    ");
    $stmt->execute([$userId, $permissionName]);

    return $stmt->fetchColumn() > 0;
}

中间件实现权限验证

在框架中使用中间件进行权限验证（以Laravel为例）：

namespace App\Http\Middleware;

use Closure;

class CheckPermission
{
    public function handle($request, Closure $next, $permission)
    {
        if (!auth()->user()->hasPermission($permission)) {
            abort(403, 'Unauthorized action.');
        }

        return $next($request);
    }
}

路由中使用中间件：

Route::get('/admin/dashboard', function () {
    // 管理员面板
})->middleware('permission:admin_access');

权限缓存优化

为提高性能，可以实现权限缓存：

class PermissionCache {
    private static $cache = [];

    public static function userHasPermission($userId, $permission) {
        if (!isset(self::$cache[$userId])) {
            self::loadUserPermissions($userId);
        }

        return in_array($permission, self::$cache[$userId]);
    }

    private static function loadUserPermissions($userId) {
        // 从数据库加载用户权限到缓存
        $db = new PDO('...');
        $stmt = $db->prepare("...");
        $stmt->execute([$userId]);

        self::$cache[$userId] = $stmt->fetchAll(PDO::FETCH_COLUMN);
    }
}

前端权限控制

在视图中根据权限显示内容：

<?php if (hasPermission($user->id, 'edit_content')): ?>
    <a href="/content/edit">Edit</a>
<?php endif; ?>

JavaScript前端权限控制：

const permissions = <?php echo json_encode($userPermissions); ?>;

function checkPermission(permission) {
    return permissions.includes(permission);
}