https://www.smartlegalcontract.cn/mediawiki/api.php?action=feedcontributions&feedformat=atom&user=20260503
智能法律合约 - 用户贡献 [zh-cn]
2026-09-27T02:39:03Z
用户贡献
MediaWiki 1.35.0
https://www.smartlegalcontract.cn/mediawiki/index.php?title=MediaWiki:Sidebar&diff=550
MediaWiki:Sidebar
2026-09-14T15:30:40Z
<p>20260503：</p>
<hr />
<div><br />
* 导航<br />
** http://39.106.77.250:8090/index.html|crypto202<br />
<br />
* navigation<br />
** mainpage|智能合约<br />
** recentchanges-url|recentchanges<br />
** SPESC|SPESC<br />
** helppage|help-mediawiki<br />
* 语言<br />
** https://www.smartlegalcontract.cn/mediawiki/index.php/%E5%8C%BA%E5%9D%97%E9%93%BE%E6%99%BA%E8%83%BD%E5%90%88%E7%BA%A6%E5%BD%A2%E5%BC%8F%E5%8C%96%E8%A1%A8%E8%BE%BE|智能法律合约<br />
** https://www.smartlegalcontract.cn/mediawiki/index.php/T/CIE_095-2020|Smart Legal Contract<br />
** http://39.107.64.13:8080/spescabac/ | SPESC-ABAC 托管合约语言设计<br />
<br />
<br />
* 应用<br />
**http://123.56.246.148:8080/ |公益遗嘱链<br />
**http://smpc.smartlegalcontract.cn/ |计算管理平台<br />
**https://api.smartlegalcontract.cn/web/index.html |畜牧问答平台<br />
*样例<br />
**https://www.smartlegalcontract.cn/mediawiki/index.php/Examples|智能法律合约样例<br />
* SEARCH<br />
* TOOLBOX<br />
* LANGUAGES</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=549
CBAC
2026-09-05T08:55:01Z
<p>20260503：/* 概览 */</p>
<hr />
<div><br />
<meta charset="utf-8" /><br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="bb6a5ee2dfaec6abb09392096a33b2bf618e9c0e" /><br />
<meta property="dc:modified" content="2026-09-04T19:16:40.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]--><br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
<br />
----<br />
<br />
== 概览 ==<br />
<br />
<br />
<br />
更新时间：2026.9.5<br />
<br />
将语言最简化，去除了将combination逻辑中，使用evalterm和逻辑谓词表达的方法。理由：在没有ifelse的情况下，无法表达其中某种组合逻辑。obligation的选取完全无法脱离if-else完成。<br />
<br />
成功转换了27个从oasis官网获取的example<br />
<br />
下一步安排：寻找一些更复杂的例子（实战，官网没更多了）（周六）<br />
<br />
下一步安排：简单判决测试，完善例子的输入，寻找xacml执行器并进行对比，在确认正确后进行效率测试（周六）<br />
<br />
一、基本结构<br />
<br />
PolicySet（可选；一整套策略集，此处不转化）<br />
<br />
│ ← 策略集组合算法（deny-overrides / permit-overrides / only-one-applicable…）（此处不转化）<br />
<br />
└── Policy（一份策略 = 一份 SPESC 合约）<br />
<br />
│ ← 规则组合算法 RuleCombiningAlg（permit/deny-overrides、first-applicable、t-of-n）<br />
<br />
│<br />
<br />
├── Target（策略级过滤器 = 匹配条款，如 no0）<br />
<br />
│ └── AnyOf（OR） → AllOf（AND） → Match ×n（单条匹配条件）<br />
<br />
│<br />
<br />
├── Rule ×n（一条规则 = 一个子条款，如 no1_1~no1_4）<br />
<br />
│ ├── Target（规则级过滤器，可选，规则如上）<br />
<br />
│ ├── Condition（= when 前置条件）→ Apply（and/or/not/比较）→ 叶子（值/属性）<br />
<br />
│ ├── Effect（= can → Permit / cannot → Deny）<br />
<br />
│ └── Obligation（可选义务；SLA 阶梯「允许但限流」的挂点）<br />
<br />
│<br />
<br />
└── Obligation<br />
<br />
<br />
<br />
二、执行顺序：<br />
<br />
（1）Target Term，只做资源级适用性判断，包含when逻辑并调用<br />
<br />
（2）Authentic Term：在运行前临时进行变量赋值逻辑<br />
<br />
├── when 条件<br />
<br />
└── while 赋值<br />
<br />
（3）rule_term<br />
<br />
├── when：rule级target<br />
<br />
├── where：condition<br />
<br />
└── while：rule级obligation<br />
<br />
(4) obligation_term：policy级的义务，在最后执行<br />
<br />
└── 使用while调用platform的函数<br />
=例1：sample6=<br />
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" <br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"><br />
<Description>Test Or</Description><br />
<Target></Target><br />
<Rule Effect="Permit" RuleId="primary-group-emps-rule"> <br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" <br />
Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Permit" RuleId="primary-user-rule"> <br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Deny" RuleId="deny-rule"></Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy (组合: first-applicable) <br />
<br />
├── Target = 空<br />
<br />
├── Rule1 (Permit)<br />
<br />
│ ├── Target: action-id = read<br />
<br />
│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集<br />
<br />
├── Rule2 (Permit)<br />
<br />
│ ├── Target: 无<br />
<br />
│ └── Condition: resource-id 与 {<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>, <nowiki>http://localhost:8280/services/Customers/getVersion2}</nowiki> 有交集<br />
<br />
└── Rule3 (Deny) 兜底<br />
<br />
==原始请求等效json：==<br />
{<br />
"sub": {<br />
"subjectId": "anyone",<br />
"groups": []<br />
},<br />
"act": {<br />
"actionId": "read"<br />
},<br />
"obj": {<br />
"resourceId": "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>"<br />
}<br />
}<br />
<br />
==转换版：==<br />
contract Sample6_RoleAccess {<br />
<br />
party Sub {<br />
<br />
subjectId: String<br />
<br />
groups: set String<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
resourceId: String<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
addition fn {<br />
<br />
regexpMatch(value: String, pattern: String): Boolean<br />
<br />
}<br />
<br />
combineAlgorithm = first-applicable<br />
<br />
## Type(target)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
term primaryGroupEmpsRule: Sub can read Resource<br />
<br />
when ATTR(Request::Act, actionId) = "read"<br />
<br />
where ATTR(Request::Sub, groups) overlaps {"admin_emps", "admin"}<br />
<br />
term primaryUserRule: Sub can access Resource<br />
<br />
where ATTR(Request::Obj, resourceId) belong {<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion2</nowiki>"<br />
<br />
}<br />
<br />
term denyRule: Sub cannot access Resource<br />
<br />
}<br />
<br />
<br />
=例2：OASIS 3-4=<br />
来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502<br />
<br />
语法：双target，有obligation<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"<br />
PolicyId="copyright-approve"<br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"<br />
Version="1"><br />
<Description>Example copyright material policy</Description><br />
<br />
<!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant --><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/><br />
</Match><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- 规则级 Target：资源 ip-owner = Acme --><br />
<Rule Effect="Permit" RuleId="Right to use copyrighted material match"><br />
<Description>Allow if subject's association to the designated custodian of the copyright agrees</Description><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- Condition：以下 5 个条件全部成立才 Permit --><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and"><br />
<!-- ① 请求方组织 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ② 主体协议号 = 资源协议号 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ③ 资源被许可方 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ④ 当前时间 >= 生效时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ⑤ 当前时间 < 过期时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<br />
<!-- Permit 时要求 PEP：加标记 + 加密 --><br />
<ObligationExpressions><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit"><br />
<AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue><br />
</AttributeAssignmentExpression><br />
</ObligationExpression><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/><br />
</ObligationExpressions><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy copyright-approve (deny-overrides) <br />
<br />
├── Target: resource:copyright = true<br />
<br />
│ AND resource:agreement-type = <nowiki>urn:...:copyright-grant</nowiki><br />
<br />
└── Rule "Right to use copyrighted material match" (Permit)<br />
<br />
| ├── Target: resource:ip-owner = "Acme"<br />
<br />
| └── Condition (AND):<br />
<br />
| ├── subject:organization = "Wiley Corp"<br />
<br />
| ├── subject:agreement-id = resource:agreement-id<br />
<br />
| ├── resource:ip-licensee = "Wiley Corp"<br />
<br />
| ├── current-dateTime >= resource:effective-date<br />
<br />
| └── current-dateTime 小于 resource:expiration-date<br />
<br />
└── Obligations (Permit):<br />
<br />
├── marking(text = "Copyright 2011 Acme")<br />
<br />
└── encrypt<br />
<br />
==原始请求等效json： ==<br />
{<br />
"sub": {<br />
"organization": "Wiley Corp",<br />
"agreementId": "A-001"<br />
},<br />
"obj": {<br />
"copyright": true,<br />
"ipOwner": "Acme",<br />
"ipLicensee": "Wiley Corp",<br />
"agreementType": "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>",<br />
"agreementId": "A-001",<br />
"effectiveDate": "2020-01-01T00:00:00",<br />
"expirationDate": "2030-01-01T00:00:00"<br />
},<br />
"act": {<br />
"actionId": "use"<br />
},<br />
"env": {<br />
"currentDateTime": "2024-06-01T12:00:00"<br />
}<br />
}<br />
<br />
==转换版：==<br />
<br />
contract CopyrightApprove {<br />
<br />
party Sub {<br />
<br />
organization: String<br />
<br />
agreementId: String<br />
<br />
}<br />
<br />
party Platform {<br />
<br />
marking(trigger: OrderState, text: String)<br />
<br />
encrypt(trigger: OrderState)<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
copyright: Boolean<br />
<br />
agreementType: String<br />
<br />
ipOwner: String<br />
<br />
ipLicensee: String<br />
<br />
agreementId: String<br />
<br />
effectiveDate: dateTime<br />
<br />
expirationDate: dateTime<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
addition fn {<br />
<br />
oneAndOnly(x: String): String<br />
<br />
oneAndOnly(x: dateTime): dateTime<br />
<br />
}<br />
<br />
enum OrderState {<br />
<br />
Permit, Deny<br />
<br />
}<br />
<br />
combineAlgorithm = deny-overrides<br />
<br />
## Type(target)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
when ATTR(Request::Obj, copyright) = true<br />
<br />
and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"<br />
<br />
term rightsToUse: Sub can use Resource<br />
<br />
when ATTR(Request::Obj, ipOwner) = "Acme"<br />
<br />
where ATTR(Request::Sub, organization) = "Wiley Corp"<br />
<br />
and oneAndOnly(ATTR(Request::Sub, agreementId)) =<br />
<br />
oneAndOnly(ATTR(Request::Obj, agreementId))<br />
<br />
and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"<br />
<br />
and now >= oneAndOnly(ATTR(Request::Obj, effectiveDate))<br />
<br />
and now < oneAndOnly(ATTR(Request::Obj, expirationDate))<br />
<br />
## Type(obligation)<br />
<br />
term policy_obligation: Platform must fulfillObligations(Request)<br />
<br />
while marking(Permit, "Copyright 2011 Acme")<br />
<br />
and encrypt(Permit)<br />
<br />
}<br />
*</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=548
CBAC
2026-09-04T19:16:40Z
<p>20260503：</p>
<hr />
<div><br />
<meta charset="utf-8" /><br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="1b89805c99cd8717dc27f4973d17a86e2f59ddb3" /><br />
<meta property="dc:modified" content="2026-09-04T13:34:42.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]--><br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
<br />
<meta charset="utf-8" /><br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="6484283d6d9200fc6e16e86fda94ddc6c13a9b49" /><br />
<meta property="dc:modified" content="2026-09-03T01:08:50.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
----<br />
<br />
== 概览 ==<br />
<br />
<br />
更新时间：2026.9.4<br />
<br />
将语言最简化，去除了将combination逻辑中，使用evalterm和逻辑谓词表达的方法。理由：在没有ifelse的情况下，无法表达其中某种组合逻辑。obligation的选取完全无法脱离if-else完成。<br />
<br />
成功转换了100+个从oasis官网获取的example<br />
<br />
下一步安排：在方磊制作的网页上上传10个精选版（周五夜里）<br />
<br />
下一步安排：寻找一些更复杂的例子（周五夜里）<br />
<br />
下一步安排：精进栈式判决测试，完善例子的输入，寻找xacml执行器并进行对比，在确认正确后进行效率测试（周六）<br />
<br />
一、基本结构<br />
<br />
PolicySet（可选；一整套策略集，此处不转化）<br />
<br />
│ ← 策略集组合算法（deny-overrides / permit-overrides / only-one-applicable…）（此处不转化）<br />
<br />
└── Policy（一份策略 = 一份 SPESC 合约）<br />
<br />
│ ← 规则组合算法 RuleCombiningAlg（permit/deny-overrides、first-applicable、t-of-n）<br />
<br />
│<br />
<br />
├── Target（策略级过滤器 = 匹配条款，如 no0）<br />
<br />
│ └── AnyOf（OR） → AllOf（AND） → Match ×n（单条匹配条件）<br />
<br />
│<br />
<br />
├── Rule ×n（一条规则 = 一个子条款，如 no1_1~no1_4）<br />
<br />
│ ├── Target（规则级过滤器，可选，规则如上）<br />
<br />
│ ├── Condition（= when 前置条件）→ Apply（and/or/not/比较）→ 叶子（值/属性）<br />
<br />
│ ├── Effect（= can → Permit / cannot → Deny）<br />
<br />
│ └── Obligation（可选义务；SLA 阶梯「允许但限流」的挂点）<br />
<br />
│<br />
<br />
└── Obligation<br />
<br />
<br />
<br />
二、执行顺序：<br />
<br />
（1）Target Term，只做资源级适用性判断，包含when逻辑并调用<br />
<br />
（2）Authentic Term：在运行前临时进行变量赋值逻辑<br />
<br />
├── when 条件<br />
<br />
└── while 赋值<br />
<br />
（3）rule_term<br />
<br />
├── when：rule级target<br />
<br />
├── where：condition<br />
<br />
└── while：rule级obligation<br />
<br />
(4) obligation_term：policy级的义务，在最后执行<br />
<br />
└── 使用while调用platform的函数<br />
=例1：sample6=<br />
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" <br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"><br />
<Description>Test Or</Description><br />
<Target></Target><br />
<Rule Effect="Permit" RuleId="primary-group-emps-rule"> <br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" <br />
Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Permit" RuleId="primary-user-rule"> <br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Deny" RuleId="deny-rule"></Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy (组合: first-applicable) <br />
<br />
├── Target = 空<br />
<br />
├── Rule1 (Permit)<br />
<br />
│ ├── Target: action-id = read<br />
<br />
│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集<br />
<br />
├── Rule2 (Permit)<br />
<br />
│ ├── Target: 无<br />
<br />
│ └── Condition: resource-id 与 {<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>, <nowiki>http://localhost:8280/services/Customers/getVersion2}</nowiki> 有交集<br />
<br />
└── Rule3 (Deny) 兜底<br />
<br />
==原始请求等效json：==<br />
{<br />
"sub": {<br />
"subjectId": "anyone",<br />
"groups": []<br />
},<br />
"act": {<br />
"actionId": "read"<br />
},<br />
"obj": {<br />
"resourceId": "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>"<br />
}<br />
}<br />
<br />
==转换版：==<br />
contract Sample6_RoleAccess {<br />
<br />
party Sub {<br />
<br />
subjectId: String<br />
<br />
groups: set String<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
resourceId: String<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
addition fn {<br />
<br />
regexpMatch(value: String, pattern: String): Boolean<br />
<br />
}<br />
<br />
combineAlgorithm = first-applicable<br />
<br />
## Type(target)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
term primaryGroupEmpsRule: Sub can read Resource<br />
<br />
when ATTR(Request::Act, actionId) = "read"<br />
<br />
where ATTR(Request::Sub, groups) overlaps {"admin_emps", "admin"}<br />
<br />
term primaryUserRule: Sub can access Resource<br />
<br />
where ATTR(Request::Obj, resourceId) belong {<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion2</nowiki>"<br />
<br />
}<br />
<br />
term denyRule: Sub cannot access Resource<br />
<br />
}<br />
<br />
<br />
=例2：OASIS 3-4=<br />
来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502<br />
<br />
语法：双target，有obligation<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"<br />
PolicyId="copyright-approve"<br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"<br />
Version="1"><br />
<Description>Example copyright material policy</Description><br />
<br />
<!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant --><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/><br />
</Match><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- 规则级 Target：资源 ip-owner = Acme --><br />
<Rule Effect="Permit" RuleId="Right to use copyrighted material match"><br />
<Description>Allow if subject's association to the designated custodian of the copyright agrees</Description><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- Condition：以下 5 个条件全部成立才 Permit --><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and"><br />
<!-- ① 请求方组织 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ② 主体协议号 = 资源协议号 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ③ 资源被许可方 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ④ 当前时间 >= 生效时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ⑤ 当前时间 < 过期时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<br />
<!-- Permit 时要求 PEP：加标记 + 加密 --><br />
<ObligationExpressions><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit"><br />
<AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue><br />
</AttributeAssignmentExpression><br />
</ObligationExpression><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/><br />
</ObligationExpressions><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy copyright-approve (deny-overrides) <br />
<br />
├── Target: resource:copyright = true<br />
<br />
│ AND resource:agreement-type = <nowiki>urn:...:copyright-grant</nowiki><br />
<br />
└── Rule "Right to use copyrighted material match" (Permit)<br />
<br />
| ├── Target: resource:ip-owner = "Acme"<br />
<br />
| └── Condition (AND):<br />
<br />
| ├── subject:organization = "Wiley Corp"<br />
<br />
| ├── subject:agreement-id = resource:agreement-id<br />
<br />
| ├── resource:ip-licensee = "Wiley Corp"<br />
<br />
| ├── current-dateTime >= resource:effective-date<br />
<br />
| └── current-dateTime 小于 resource:expiration-date<br />
<br />
└── Obligations (Permit):<br />
<br />
├── marking(text = "Copyright 2011 Acme")<br />
<br />
└── encrypt<br />
<br />
==原始请求等效json： ==<br />
{<br />
"sub": {<br />
"organization": "Wiley Corp",<br />
"agreementId": "A-001"<br />
},<br />
"obj": {<br />
"copyright": true,<br />
"ipOwner": "Acme",<br />
"ipLicensee": "Wiley Corp",<br />
"agreementType": "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>",<br />
"agreementId": "A-001",<br />
"effectiveDate": "2020-01-01T00:00:00",<br />
"expirationDate": "2030-01-01T00:00:00"<br />
},<br />
"act": {<br />
"actionId": "use"<br />
},<br />
"env": {<br />
"currentDateTime": "2024-06-01T12:00:00"<br />
}<br />
}<br />
<br />
==转换版：==<br />
<br />
contract CopyrightApprove {<br />
<br />
party Sub {<br />
<br />
organization: String<br />
<br />
agreementId: String<br />
<br />
}<br />
<br />
party Platform {<br />
<br />
marking(trigger: OrderState, text: String)<br />
<br />
encrypt(trigger: OrderState)<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
copyright: Boolean<br />
<br />
agreementType: String<br />
<br />
ipOwner: String<br />
<br />
ipLicensee: String<br />
<br />
agreementId: String<br />
<br />
effectiveDate: dateTime<br />
<br />
expirationDate: dateTime<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
addition fn {<br />
<br />
oneAndOnly(x: String): String<br />
<br />
oneAndOnly(x: dateTime): dateTime<br />
<br />
}<br />
<br />
enum OrderState {<br />
<br />
Permit, Deny<br />
<br />
}<br />
<br />
combineAlgorithm = deny-overrides<br />
<br />
## Type(target)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
when ATTR(Request::Obj, copyright) = true<br />
<br />
and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"<br />
<br />
term rightsToUse: Sub can use Resource<br />
<br />
when ATTR(Request::Obj, ipOwner) = "Acme"<br />
<br />
where ATTR(Request::Sub, organization) = "Wiley Corp"<br />
<br />
and oneAndOnly(ATTR(Request::Sub, agreementId)) =<br />
<br />
oneAndOnly(ATTR(Request::Obj, agreementId))<br />
<br />
and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"<br />
<br />
and now >= oneAndOnly(ATTR(Request::Obj, effectiveDate))<br />
<br />
and now < oneAndOnly(ATTR(Request::Obj, expirationDate))<br />
<br />
## Type(obligation)<br />
<br />
term policy_obligation: Platform must fulfillObligations(Request)<br />
<br />
while marking(Permit, "Copyright 2011 Acme")<br />
<br />
and encrypt(Permit)<br />
<br />
}<br />
*</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=547
CBAC
2026-09-04T13:34:42Z
<p>20260503：</p>
<hr />
<div><meta charset="utf-8" /><br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="6484283d6d9200fc6e16e86fda94ddc6c13a9b49" /><br />
<meta property="dc:modified" content="2026-09-03T01:08:50.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
----<br />
<br />
== 概览 ==<br />
<br />
<br />
更新时间：2026.9.4<br />
<br />
将语言最简化，去除了将combination逻辑中，使用evalterm和逻辑谓词表达的方法。理由：在没有ifelse的情况下，无法表达其中某种组合逻辑。obligation的选取完全无法脱离if-else完成。<br />
<br />
成功转换了100+个从oasis官网获取的example<br />
<br />
下一步安排：在方磊制作的网页上上传10个精选版（周五夜里）<br />
<br />
下一步安排：寻找一些更复杂的例子（周五夜里）<br />
<br />
下一步安排：精进栈式判决测试，完善例子的输入，寻找xacml执行器并进行对比，在确认正确后进行效率测试（周六）<br />
<br />
一、基本结构<br />
<br />
TODO<br />
<br />
<br />
二、执行顺序：<br />
<br />
（1）Target Term，只做资源级适用性判断，包含when逻辑并调用<br />
<br />
（2）Authentic Term：在运行前临时进行变量赋值逻辑<br />
<br />
when 条件<br />
<br />
while 赋值<br />
<br />
（3）rule_term<br />
<br />
when：rule级target<br />
<br />
where：condition<br />
<br />
while：rule级obligation<br />
<br />
(4) obligation_term：policy级的义务，在最后执行<br />
<br />
使用while调用platform的函数<br />
=例1：sample6=<br />
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" <br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"><br />
<Description>Test Or</Description><br />
<Target></Target><br />
<Rule Effect="Permit" RuleId="primary-group-emps-rule"> <br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" <br />
Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Permit" RuleId="primary-user-rule"> <br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Deny" RuleId="deny-rule"></Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy (组合: first-applicable) <br />
<br />
├── Target = 空<br />
<br />
├── Rule1 (Permit)<br />
<br />
│ ├── Target: action-id = read<br />
<br />
│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集<br />
<br />
├── Rule2 (Permit)<br />
<br />
│ ├── Target: 无<br />
<br />
│ └── Condition: resource-id 与 {<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>, <nowiki>http://localhost:8280/services/Customers/getVersion2}</nowiki> 有交集<br />
<br />
└── Rule3 (Deny) 兜底<br />
<br />
==原始请求等效json：==<br />
{<br />
"sub": {<br />
"subjectId": "anyone",<br />
"groups": []<br />
},<br />
"act": {<br />
"actionId": "read"<br />
},<br />
"obj": {<br />
"resourceId": "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>"<br />
}<br />
}<br />
<br />
==转换版：==<br />
contract Sample6_RoleAccess {<br />
<br />
party Sub {<br />
<br />
subjectId: String<br />
<br />
groups: set String<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
resourceId: String<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
addition fn {<br />
<br />
regexpMatch(value: String, pattern: String): Boolean<br />
<br />
}<br />
<br />
combineAlgorithm = first-applicable<br />
<br />
## Type(target)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
term primaryGroupEmpsRule: Sub can read Resource<br />
<br />
when ATTR(Request::Act, actionId) = "read"<br />
<br />
where ATTR(Request::Sub, groups) overlaps {"admin_emps", "admin"}<br />
<br />
term primaryUserRule: Sub can access Resource<br />
<br />
where ATTR(Request::Obj, resourceId) belong {<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion2</nowiki>"<br />
<br />
}<br />
<br />
term denyRule: Sub cannot access Resource<br />
<br />
}<br />
<br />
<br />
=例2：OASIS 3-4=<br />
来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502<br />
<br />
语法：双target，有obligation<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"<br />
PolicyId="copyright-approve"<br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"<br />
Version="1"><br />
<Description>Example copyright material policy</Description><br />
<br />
<!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant --><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/><br />
</Match><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- 规则级 Target：资源 ip-owner = Acme --><br />
<Rule Effect="Permit" RuleId="Right to use copyrighted material match"><br />
<Description>Allow if subject's association to the designated custodian of the copyright agrees</Description><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- Condition：以下 5 个条件全部成立才 Permit --><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and"><br />
<!-- ① 请求方组织 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ② 主体协议号 = 资源协议号 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ③ 资源被许可方 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ④ 当前时间 >= 生效时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ⑤ 当前时间 < 过期时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<br />
<!-- Permit 时要求 PEP：加标记 + 加密 --><br />
<ObligationExpressions><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit"><br />
<AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue><br />
</AttributeAssignmentExpression><br />
</ObligationExpression><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/><br />
</ObligationExpressions><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy copyright-approve (deny-overrides) <br />
<br />
├── Target: resource:copyright = true<br />
<br />
│ AND resource:agreement-type = <nowiki>urn:...:copyright-grant</nowiki><br />
<br />
└── Rule "Right to use copyrighted material match" (Permit)<br />
<br />
| ├── Target: resource:ip-owner = "Acme"<br />
<br />
| └── Condition (AND):<br />
<br />
| ├── subject:organization = "Wiley Corp"<br />
<br />
| ├── subject:agreement-id = resource:agreement-id<br />
<br />
| ├── resource:ip-licensee = "Wiley Corp"<br />
<br />
| ├── current-dateTime >= resource:effective-date<br />
<br />
| └── current-dateTime 小于 resource:expiration-date<br />
<br />
└── Obligations (Permit):<br />
<br />
├── marking(text = "Copyright 2011 Acme")<br />
<br />
└── encrypt<br />
<br />
==原始请求等效json： ==<br />
{<br />
"sub": {<br />
"organization": "Wiley Corp",<br />
"agreementId": "A-001"<br />
},<br />
"obj": {<br />
"copyright": true,<br />
"ipOwner": "Acme",<br />
"ipLicensee": "Wiley Corp",<br />
"agreementType": "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>",<br />
"agreementId": "A-001",<br />
"effectiveDate": "2020-01-01T00:00:00",<br />
"expirationDate": "2030-01-01T00:00:00"<br />
},<br />
"act": {<br />
"actionId": "use"<br />
},<br />
"env": {<br />
"currentDateTime": "2024-06-01T12:00:00"<br />
}<br />
}<br />
<br />
==转换版：==<br />
<br />
contract CopyrightApprove {<br />
<br />
party Sub {<br />
<br />
organization: String<br />
<br />
agreementId: String<br />
<br />
}<br />
<br />
party Platform {<br />
<br />
marking(trigger: OrderState, text: String)<br />
<br />
encrypt(trigger: OrderState)<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
copyright: Boolean<br />
<br />
agreementType: String<br />
<br />
ipOwner: String<br />
<br />
ipLicensee: String<br />
<br />
agreementId: String<br />
<br />
effectiveDate: dateTime<br />
<br />
expirationDate: dateTime<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
addition fn {<br />
<br />
oneAndOnly(x: String): String<br />
<br />
oneAndOnly(x: dateTime): dateTime<br />
<br />
}<br />
<br />
enum OrderState {<br />
<br />
Permit, Deny<br />
<br />
}<br />
<br />
combineAlgorithm = deny-overrides<br />
<br />
## Type(target)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
when ATTR(Request::Obj, copyright) = true<br />
<br />
and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"<br />
<br />
term rightsToUse: Sub can use Resource<br />
<br />
when ATTR(Request::Obj, ipOwner) = "Acme"<br />
<br />
where ATTR(Request::Sub, organization) = "Wiley Corp"<br />
<br />
and oneAndOnly(ATTR(Request::Sub, agreementId)) =<br />
<br />
oneAndOnly(ATTR(Request::Obj, agreementId))<br />
<br />
and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"<br />
<br />
and now >= oneAndOnly(ATTR(Request::Obj, effectiveDate))<br />
<br />
and now < oneAndOnly(ATTR(Request::Obj, expirationDate))<br />
<br />
## Type(obligation)<br />
<br />
term policy_obligation: Platform must fulfillObligations(Request)<br />
<br />
while marking(Permit, "Copyright 2011 Acme")<br />
<br />
and encrypt(Permit)<br />
<br />
}<br />
*</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=MediaWiki:Sidebar&diff=546
MediaWiki:Sidebar
2026-09-04T09:01:30Z
<p>20260503：</p>
<hr />
<div><br />
* 导航<br />
** http://39.106.77.250:8090/index.html|crypto202<br />
<br />
* navigation<br />
** mainpage|智能合约<br />
** recentchanges-url|recentchanges<br />
** SPESC|SPESC<br />
** helppage|help-mediawiki<br />
* 语言<br />
** https://www.smartlegalcontract.cn/mediawiki/index.php/%E5%8C%BA%E5%9D%97%E9%93%BE%E6%99%BA%E8%83%BD%E5%90%88%E7%BA%A6%E5%BD%A2%E5%BC%8F%E5%8C%96%E8%A1%A8%E8%BE%BE|智能法律合约<br />
** https://www.smartlegalcontract.cn/mediawiki/index.php/T/CIE_095-2020|Smart Legal Contract<br />
** https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC | 托管合约语言设计<br />
** http://39.107.64.13:8080/spescabac/ | SPESC-ABAC<br />
<br />
<br />
* 应用<br />
**http://123.56.246.148:8080/ |公益遗嘱链<br />
**http://smpc.smartlegalcontract.cn/ |计算管理平台<br />
**https://api.smartlegalcontract.cn/web/index.html |畜牧问答平台<br />
*样例<br />
**https://www.smartlegalcontract.cn/mediawiki/index.php/Examples|智能法律合约样例<br />
* SEARCH<br />
* TOOLBOX<br />
* LANGUAGES</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=545
CBAC
2026-09-03T01:08:50Z
<p>20260503：</p>
<hr />
<div><br />
<meta charset="utf-8" /><br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="47b34894dfcc793815ae7ed1a7708a06e76c11c8" /><br />
<meta property="dc:modified" content="2026-09-03T01:05:36.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]--><br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
<br />
<meta charset="utf-8" /><br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="c14026e9edf9ff3dd34d05da43c296c7fa910e7e" /><br />
<meta property="dc:modified" content="2026-09-03T00:50:26.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
meta<br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="c14026e9edf9ff3dd34d05da43c296c7fa910e7e" /><br />
<meta property="dc:modified" content="2026-09-03T00:50:26.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC] pro[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]perty="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" /><br />
<meta property="dc:modified" content="2026-08-30T23:12:55.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<br />
<br />
<br />
<br />
<br />
<br />
<nowiki>= 总体顺序 =</nowiki><br />
<br />
target term<br />
<br />
│ 只做资源级适用性判断，不引用具体 comb<br />
<br />
▼ （编译器自动按 Request::Act.actionId 查找对应 comb； （无 comb 则找同动作 rule_target））<br />
<br />
comb term（组合入口，针对一类动作）<br />
<br />
│ 在 when 中 evalTerm(rule_target, Request) = Permit<br />
<br />
▼<br />
<br />
rule_target term（动作、rule级obligation、rule级target、伴随、后置）<br />
<br />
│ 在 when 中 evalTerm(rule_condition, Request) = Permit<br />
<br />
▼<br />
<br />
rule_condition term（condition和返回）<br />
<br />
<br />
=例1：sample6=<br />
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/<br />
<br />
说明：多rule合并<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" <br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"><br />
<Description>Test Or</Description><br />
<Target></Target><br />
<Rule Effect="Permit" RuleId="primary-group-emps-rule"> <br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" <br />
Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Permit" RuleId="primary-user-rule"> <br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Deny" RuleId="deny-rule"></Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy (组合: first-applicable) <br />
<br />
├── Target = 空<br />
<br />
├── Rule1 (Permit)<br />
<br />
│ ├── Target: action-id = read<br />
<br />
│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集<br />
<br />
├── Rule2 (Permit)<br />
<br />
│ ├── Target: 无<br />
<br />
│ └── Condition: resource-id 与 {<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>, <nowiki>http://localhost:8280/services/Customers/getVersion2}</nowiki> 有交集<br />
<br />
└── Rule3 (Deny) 兜底<br />
<br />
==原始请求等效json：==<br />
{<br />
"sub": {<br />
"subjectId": "anyone",<br />
"groups": []<br />
},<br />
"act": {<br />
"actionId": "read"<br />
},<br />
"obj": {<br />
"resourceId": "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>"<br />
}<br />
}<br />
<br />
==转换版：==<br />
contract Sample6_RoleAccess {<br />
<br />
party Platform {<br />
<br />
name: String<br />
<br />
targetMatch(Request)<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
resourceId: String<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
## Type(match)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
when true<br />
<br />
where return Permit<br />
<br />
## Type(comb)<br />
<br />
term policy_comb: Sub can access Resource<br />
<br />
when some of(evalTerm(rule_target_1, Request),<br />
<br />
evalTerm(rule_target_2, Request)) = Permit<br />
<br />
where return Permit<br />
<br />
term rule_target_1: Sub can read Resource<br />
<br />
when ATTR(Request::Act, actionId) = "read"<br />
<br />
and "admin_emps" in ATTR(Request::Sub, groups)<br />
<br />
where return Permit<br />
<br />
term rule_target_2: Sub can access Resource<br />
<br />
when when ATTR(Request::Obj, resourceId) in {<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion2</nowiki>"<br />
<br />
}<br />
<br />
where return Permit<br />
<br />
}<br />
<br />
<br />
=例2：OASIS 3-4=<br />
来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502<br />
<br />
语法：双target，有obligation<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"<br />
PolicyId="copyright-approve"<br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"<br />
Version="1"><br />
<Description>Example copyright material policy</Description><br />
<br />
<!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant --><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/><br />
</Match><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- 规则级 Target：资源 ip-owner = Acme --><br />
<Rule Effect="Permit" RuleId="Right to use copyrighted material match"><br />
<Description>Allow if subject's association to the designated custodian of the copyright agrees</Description><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- Condition：以下 5 个条件全部成立才 Permit --><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and"><br />
<!-- ① 请求方组织 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ② 主体协议号 = 资源协议号 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ③ 资源被许可方 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ④ 当前时间 >= 生效时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ⑤ 当前时间 < 过期时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<br />
<!-- Permit 时要求 PEP：加标记 + 加密 --><br />
<ObligationExpressions><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit"><br />
<AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue><br />
</AttributeAssignmentExpression><br />
</ObligationExpression><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/><br />
</ObligationExpressions><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy copyright-approve (deny-overrides) <br />
<br />
├── Target: resource:copyright = true<br />
<br />
│ AND resource:agreement-type = <nowiki>urn:...:copyright-grant</nowiki><br />
<br />
└── Rule "Right to use copyrighted material match" (Permit)<br />
<br />
| ├── Target: resource:ip-owner = "Acme"<br />
<br />
| └── Condition (AND):<br />
<br />
| ├── subject:organization = "Wiley Corp"<br />
<br />
| ├── subject:agreement-id = resource:agreement-id<br />
<br />
| ├── resource:ip-licensee = "Wiley Corp"<br />
<br />
| ├── current-dateTime >= resource:effective-date<br />
<br />
| └── current-dateTime 小于 resource:expiration-date<br />
<br />
└── Obligations (Permit):<br />
<br />
├── marking(text = "Copyright 2011 Acme")<br />
<br />
└── encrypt<br />
<br />
==原始请求等效json： ==<br />
{<br />
"sub": {<br />
"organization": "Wiley Corp",<br />
"agreementId": "A-001"<br />
},<br />
"obj": {<br />
"copyright": true,<br />
"ipOwner": "Acme",<br />
"ipLicensee": "Wiley Corp",<br />
"agreementType": "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>",<br />
"agreementId": "A-001",<br />
"effectiveDate": "2020-01-01T00:00:00",<br />
"expirationDate": "2030-01-01T00:00:00"<br />
},<br />
"act": {<br />
"actionId": "use"<br />
},<br />
"env": {<br />
"currentDateTime": "2024-06-01T12:00:00"<br />
}<br />
}<br />
<br />
==转换版：==<br />
<br />
contract CopyrightApprove {<br />
<br />
party Owner {<br />
<br />
name: String<br />
<br />
}<br />
<br />
party Platform {<br />
<br />
name: String<br />
<br />
targetMatch(Request)<br />
<br />
marking(text: String)<br />
<br />
encrypt()<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
resourceId: String<br />
<br />
copyright: Boolean<br />
<br />
agreementType: String<br />
<br />
ipOwner: String<br />
<br />
ipLicensee: String<br />
<br />
agreementId: String<br />
<br />
effectiveDate: dateTime<br />
<br />
expirationDate: dateTime<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
addition fn {<br />
<br />
oneAndOnly(x: String): String<br />
<br />
oneAndOnly(x: dateTime): dateTime<br />
<br />
}<br />
<br />
## Type(match)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
when ATTR(Request::Obj, copyright) = true<br />
<br />
and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"<br />
<br />
where return Permit<br />
<br />
## Type(comb)<br />
<br />
term policy_comb: Sub can access Resource<br />
<br />
when evalTerm(rule_target, Request) = Permit<br />
<br />
where evalTerm(obligation_mark, Request) AND evalTerm(obligation_encrypt, Request)<br />
<br />
AND return Permit<br />
<br />
term rule_target: Sub can use Resource<br />
<br />
when ATTR(Request::Obj, ipOwner) = "Acme"<br />
<br />
and ATTR(Request::Sub, organization) = "Wiley Corp"<br />
<br />
and fn::string::oneAndOnly(ATTR(Request::Sub, agreementId)) =<br />
<br />
fn::string::oneAndOnly(ATTR(Request::Obj, agreementId))<br />
<br />
and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"<br />
<br />
and now >= fn::dateTime::oneAndOnly(ATTR(Request::Obj, effectiveDate))<br />
<br />
and now < fn::dateTime::oneAndOnly(ATTR(Request::Obj, expirationDate))<br />
<br />
where return Permit<br />
<br />
term obligation_mark: Platform must marking("Copyright 2011 Acme")<br />
<br />
when true<br />
<br />
term obligation_encrypt: Platform must encrypt()<br />
<br />
when true<br />
<br />
}<br />
*</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=544
CBAC
2026-09-03T01:05:36Z
<p>20260503：</p>
<hr />
<div><meta charset="utf-8" /><br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="c14026e9edf9ff3dd34d05da43c296c7fa910e7e" /><br />
<meta property="dc:modified" content="2026-09-03T00:50:26.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
meta<br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="c14026e9edf9ff3dd34d05da43c296c7fa910e7e" /><br />
<meta property="dc:modified" content="2026-09-03T00:50:26.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC] pro[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]perty="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" /><br />
<meta property="dc:modified" content="2026-08-30T23:12:55.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<br />
<br />
<br />
<br />
<br />
<nowiki>= 总体顺序 =</nowiki><br />
<br />
target term<br />
<br />
│ 只做资源级适用性判断，不引用具体 comb<br />
<br />
▼ （编译器自动按 Request::Act.actionId 查找对应 comb； （无 comb 则找同动作 rule_target））<br />
<br />
comb term（组合入口，针对一类动作）<br />
<br />
│ 在 when 中 evalTerm(rule_target, Request) = Permit<br />
<br />
▼<br />
<br />
rule_target term（动作、rule级obligation、rule级target、伴随、后置）<br />
<br />
│ 在 when 中 evalTerm(rule_condition, Request) = Permit<br />
<br />
▼<br />
<br />
rule_condition term（condition和返回）<br />
<br />
<br />
=例1：sample6=<br />
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/<br />
<br />
说明：多rule合并<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" <br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"><br />
<Description>Test Or</Description><br />
<Target></Target><br />
<Rule Effect="Permit" RuleId="primary-group-emps-rule"> <br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" <br />
Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Permit" RuleId="primary-user-rule"> <br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Deny" RuleId="deny-rule"></Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy (组合: first-applicable) <br />
<br />
├── Target = 空<br />
<br />
├── Rule1 (Permit)<br />
<br />
│ ├── Target: action-id = read<br />
<br />
│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集<br />
<br />
├── Rule2 (Permit)<br />
<br />
│ ├── Target: 无<br />
<br />
│ └── Condition: resource-id 与 {<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>, <nowiki>http://localhost:8280/services/Customers/getVersion2}</nowiki> 有交集<br />
<br />
└── Rule3 (Deny) 兜底<br />
<br />
==原始请求等效json：==<br />
{<br />
"sub": {<br />
"subjectId": "anyone",<br />
"groups": []<br />
},<br />
"act": {<br />
"actionId": "read"<br />
},<br />
"obj": {<br />
"resourceId": "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>"<br />
}<br />
}<br />
<br />
==转换版：==<br />
contract Sample6_RoleAccess {<br />
<br />
party Platform {<br />
<br />
name: String<br />
<br />
targetMatch(Request)<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
resourceId: String<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
## Type(match)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
when true<br />
<br />
where return Permit<br />
<br />
## Type(comb)<br />
<br />
term policy_comb: Sub can access Resource<br />
<br />
when some of(evalTerm(rule_target_1, Request),<br />
<br />
evalTerm(rule_target_2, Request)) = Permit<br />
<br />
where return Permit<br />
<br />
term rule_target_1: Sub can read Resource<br />
<br />
when ATTR(Request::Act, actionId) = "read"<br />
<br />
and "admin_emps" belong ATTR(Request::Sub, groups)<br />
<br />
where return Permit<br />
<br />
term rule_target_2: Sub can access Resource<br />
<br />
when when ATTR(Request::Obj, resourceId) in {<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion2</nowiki>"<br />
<br />
}<br />
<br />
where return Permit<br />
<br />
}<br />
<br />
<br />
=例2：OASIS 3-4=<br />
来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502<br />
<br />
语法：双target，有obligation<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"<br />
PolicyId="copyright-approve"<br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"<br />
Version="1"><br />
<Description>Example copyright material policy</Description><br />
<br />
<!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant --><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/><br />
</Match><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- 规则级 Target：资源 ip-owner = Acme --><br />
<Rule Effect="Permit" RuleId="Right to use copyrighted material match"><br />
<Description>Allow if subject's association to the designated custodian of the copyright agrees</Description><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- Condition：以下 5 个条件全部成立才 Permit --><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and"><br />
<!-- ① 请求方组织 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ② 主体协议号 = 资源协议号 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ③ 资源被许可方 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ④ 当前时间 >= 生效时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ⑤ 当前时间 < 过期时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<br />
<!-- Permit 时要求 PEP：加标记 + 加密 --><br />
<ObligationExpressions><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit"><br />
<AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue><br />
</AttributeAssignmentExpression><br />
</ObligationExpression><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/><br />
</ObligationExpressions><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy copyright-approve (deny-overrides) <br />
<br />
├── Target: resource:copyright = true<br />
<br />
│ AND resource:agreement-type = <nowiki>urn:...:copyright-grant</nowiki><br />
<br />
└── Rule "Right to use copyrighted material match" (Permit)<br />
<br />
| ├── Target: resource:ip-owner = "Acme"<br />
<br />
| └── Condition (AND):<br />
<br />
| ├── subject:organization = "Wiley Corp"<br />
<br />
| ├── subject:agreement-id = resource:agreement-id<br />
<br />
| ├── resource:ip-licensee = "Wiley Corp"<br />
<br />
| ├── current-dateTime >= resource:effective-date<br />
<br />
| └── current-dateTime 小于 resource:expiration-date<br />
<br />
└── Obligations (Permit):<br />
<br />
├── marking(text = "Copyright 2011 Acme")<br />
<br />
└── encrypt<br />
<br />
==原始请求等效json： ==<br />
{<br />
"sub": {<br />
"organization": "Wiley Corp",<br />
"agreementId": "A-001"<br />
},<br />
"obj": {<br />
"copyright": true,<br />
"ipOwner": "Acme",<br />
"ipLicensee": "Wiley Corp",<br />
"agreementType": "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>",<br />
"agreementId": "A-001",<br />
"effectiveDate": "2020-01-01T00:00:00",<br />
"expirationDate": "2030-01-01T00:00:00"<br />
},<br />
"act": {<br />
"actionId": "use"<br />
},<br />
"env": {<br />
"currentDateTime": "2024-06-01T12:00:00"<br />
}<br />
}<br />
<br />
==转换版：==<br />
<br />
contract CopyrightApprove {<br />
<br />
party Owner {<br />
<br />
name: String<br />
<br />
}<br />
<br />
party Platform {<br />
<br />
name: String<br />
<br />
targetMatch(Request)<br />
<br />
marking(text: String)<br />
<br />
encrypt()<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
resourceId: String<br />
<br />
copyright: Boolean<br />
<br />
agreementType: String<br />
<br />
ipOwner: String<br />
<br />
ipLicensee: String<br />
<br />
agreementId: String<br />
<br />
effectiveDate: dateTime<br />
<br />
expirationDate: dateTime<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
addition fn {<br />
<br />
oneAndOnly(x: String): String<br />
<br />
oneAndOnly(x: dateTime): dateTime<br />
<br />
}<br />
<br />
## Type(match)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
when ATTR(Request::Obj, copyright) = true<br />
<br />
and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"<br />
<br />
where return Permit<br />
<br />
## Type(comb)<br />
<br />
term policy_comb: Sub can access Resource<br />
<br />
when evalTerm(rule_target, Request) = Permit<br />
<br />
where evalTerm(obligation_mark, Request) AND evalTerm(obligation_encrypt, Request)<br />
<br />
AND return Permit<br />
<br />
term rule_target: Sub can use Resource<br />
<br />
when ATTR(Request::Obj, ipOwner) = "Acme"<br />
<br />
and ATTR(Request::Sub, organization) = "Wiley Corp"<br />
<br />
and fn::string::oneAndOnly(ATTR(Request::Sub, agreementId)) =<br />
<br />
fn::string::oneAndOnly(ATTR(Request::Obj, agreementId))<br />
<br />
and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"<br />
<br />
and now >= fn::dateTime::oneAndOnly(ATTR(Request::Obj, effectiveDate))<br />
<br />
and now < fn::dateTime::oneAndOnly(ATTR(Request::Obj, expirationDate))<br />
<br />
where return Permit<br />
<br />
term obligation_mark: Platform must marking("Copyright 2011 Acme")<br />
<br />
when true<br />
<br />
term obligation_encrypt: Platform must encrypt()<br />
<br />
when true<br />
<br />
}<br />
*</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=543
CBAC
2026-09-03T00:50:26Z
<p>20260503：</p>
<hr />
<div><br />
<meta charset="utf-8" /><br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="4c9dca79b50e053e3f7764f329c8ffbeb56d198a" /><br />
<meta property="dc:modified" content="2026-09-03T00:47:57.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]--><br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
<br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" /><br />
<meta property="dc:modified" content="2026-08-30T23:12:55.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
<meta charset="utf-8" /><br />
<br />
= <br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" /><br />
<meta property="dc:modified" content="2026-08-30T23:12:55.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]顺序 =<br />
<br />
target term<br />
<br />
│ 只做资源级适用性判断，不引用具体 comb<br />
<br />
▼ （编译器自动按 Request::Act.actionId 查找对应 comb； （无 comb 则找同动作 rule_target））<br />
<br />
comb term（组合入口，针对一类动作）<br />
<br />
│ 在 when 中 evalTerm(rule_target, Request) = Permit<br />
<br />
▼<br />
<br />
rule_target term（动作、rule级obligation、rule级target、伴随、后置）<br />
<br />
│ 在 when 中 evalTerm(rule_condition, Request) = Permit<br />
<br />
▼<br />
<br />
rule_condition term（condition和返回）<br />
<br />
<br />
=例1：sample6=<br />
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/<br />
<br />
说明：多rule合并<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" <br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"><br />
<Description>Test Or</Description><br />
<Target></Target><br />
<Rule Effect="Permit" RuleId="primary-group-emps-rule"> <br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" <br />
Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Permit" RuleId="primary-user-rule"> <br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Deny" RuleId="deny-rule"></Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy (组合: first-applicable) <br />
<br />
├── Target = 空<br />
<br />
├── Rule1 (Permit)<br />
<br />
│ ├── Target: action-id = read<br />
<br />
│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集<br />
<br />
├── Rule2 (Permit)<br />
<br />
│ ├── Target: 无<br />
<br />
│ └── Condition: resource-id 与 {<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>, <nowiki>http://localhost:8280/services/Customers/getVersion2}</nowiki> 有交集<br />
<br />
└── Rule3 (Deny) 兜底<br />
<br />
==原始请求等效json：==<br />
{<br />
"sub": {<br />
"subjectId": "anyone",<br />
"groups": []<br />
},<br />
"act": {<br />
"actionId": "read"<br />
},<br />
"obj": {<br />
"resourceId": "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>"<br />
}<br />
}<br />
<br />
==转换版：==<br />
contract Sample6_RoleAccess {<br />
<br />
party Platform {<br />
<br />
name: String<br />
<br />
targetMatch(Request)<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
resourceId: String<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
## Type(match)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
when true<br />
<br />
where return Permit<br />
<br />
<br />
## Type(comb)<br />
<br />
term policy_comb: Sub can access Resource<br />
<br />
when some of(evalTerm(rule_target_1, Request),<br />
<br />
evalTerm(rule_target_2, Request)) = Permit<br />
<br />
where return Permit<br />
<br />
<br />
term rule_target_1: Sub can read Resource<br />
<br />
when ATTR(Request::Act, actionId) = "read"<br />
<br />
and evalTerm(rule_condition_1, Request) = Permit<br />
<br />
where return Permit<br />
<br />
<br />
term rule_condition_1:<br />
<br />
when some g in ATTR(Request::Sub, groups)<br />
<br />
such that g = "admin_emps" or g = "admin"<br />
<br />
where return Permit<br />
<br />
<br />
term rule_target_2: Sub can access Resource<br />
<br />
when evalTerm(rule_condition_2, Request) = Permit<br />
<br />
where return Permit<br />
<br />
<br />
term rule_condition_2:<br />
<br />
when ATTR(Request::Obj, resourceId) in {<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion2</nowiki>"<br />
<br />
}<br />
<br />
where return Permit<br />
<br />
}<br />
<br />
<br />
=例2：OASIS 3-4=<br />
来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502<br />
<br />
语法：双target，有obligation<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"<br />
PolicyId="copyright-approve"<br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"<br />
Version="1"><br />
<Description>Example copyright material policy</Description><br />
<br />
<!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant --><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/><br />
</Match><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- 规则级 Target：资源 ip-owner = Acme --><br />
<Rule Effect="Permit" RuleId="Right to use copyrighted material match"><br />
<Description>Allow if subject's association to the designated custodian of the copyright agrees</Description><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- Condition：以下 5 个条件全部成立才 Permit --><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and"><br />
<!-- ① 请求方组织 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ② 主体协议号 = 资源协议号 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ③ 资源被许可方 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ④ 当前时间 >= 生效时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ⑤ 当前时间 < 过期时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<br />
<!-- Permit 时要求 PEP：加标记 + 加密 --><br />
<ObligationExpressions><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit"><br />
<AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue><br />
</AttributeAssignmentExpression><br />
</ObligationExpression><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/><br />
</ObligationExpressions><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy copyright-approve (deny-overrides) <br />
<br />
├── Target: resource:copyright = true<br />
<br />
│ AND resource:agreement-type = <nowiki>urn:...:copyright-grant</nowiki><br />
<br />
└── Rule "Right to use copyrighted material match" (Permit)<br />
<br />
| ├── Target: resource:ip-owner = "Acme"<br />
<br />
| └── Condition (AND):<br />
<br />
| ├── subject:organization = "Wiley Corp"<br />
<br />
| ├── subject:agreement-id = resource:agreement-id<br />
<br />
| ├── resource:ip-licensee = "Wiley Corp"<br />
<br />
| ├── current-dateTime >= resource:effective-date<br />
<br />
| └── current-dateTime 小于 resource:expiration-date<br />
<br />
└── Obligations (Permit):<br />
<br />
├── marking(text = "Copyright 2011 Acme")<br />
<br />
└── encrypt<br />
<br />
==原始请求等效json： ==<br />
{<br />
"sub": {<br />
"organization": "Wiley Corp",<br />
"agreementId": "A-001"<br />
},<br />
"obj": {<br />
"copyright": true,<br />
"ipOwner": "Acme",<br />
"ipLicensee": "Wiley Corp",<br />
"agreementType": "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>",<br />
"agreementId": "A-001",<br />
"effectiveDate": "2020-01-01T00:00:00",<br />
"expirationDate": "2030-01-01T00:00:00"<br />
},<br />
"act": {<br />
"actionId": "use"<br />
},<br />
"env": {<br />
"currentDateTime": "2024-06-01T12:00:00"<br />
}<br />
}<br />
<br />
==转换版：==<br />
<br />
<br />
<br />
contract CopyrightApprove {<br />
<br />
party Owner {<br />
<br />
name: String<br />
<br />
}<br />
<br />
party Platform {<br />
<br />
name: String<br />
<br />
targetMatch(Request)<br />
<br />
marking(text: String)<br />
<br />
encrypt()<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
resourceId: String<br />
<br />
copyright: Boolean<br />
<br />
agreementType: String<br />
<br />
ipOwner: String<br />
<br />
ipLicensee: String<br />
<br />
agreementId: String<br />
<br />
effectiveDate: dateTime<br />
<br />
expirationDate: dateTime<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
addition fn {<br />
<br />
oneAndOnly(x: String): String<br />
<br />
oneAndOnly(x: dateTime): dateTime<br />
<br />
}<br />
<br />
<br />
## Type(match)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
when ATTR(Request::Obj, copyright) = true<br />
<br />
and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"<br />
<br />
where return Permit <br />
<br />
<br />
## Type(comb)<br />
<br />
term policy_comb: Sub can access Resource<br />
<br />
when evalTerm(rule_target, Request) = Permit<br />
<br />
where evalTerm(obligation_mark, Request) AND evalTerm(obligation_encrypt, Request) return Permit<br />
<br />
<br />
term rule_target: Sub can use Resource<br />
<br />
when ATTR(Request::Obj, ipOwner) = "Acme"<br />
<br />
and evalTerm(rule_condition, Request) = Permit<br />
<br />
where return Permit<br />
<br />
<br />
term rule_condition:<br />
<br />
when ATTR(Request::Sub, organization) = "Wiley Corp"<br />
<br />
and fn::string::oneAndOnly(ATTR(Request::Sub, agreementId)) =<br />
<br />
fn::string::oneAndOnly(ATTR(Request::Obj, agreementId))<br />
<br />
and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"<br />
<br />
and now >= fn::dateTime::oneAndOnly(ATTR(Request::Obj, effectiveDate))<br />
<br />
and now < fn::dateTime::oneAndOnly(ATTR(Request::Obj, expirationDate))<br />
<br />
where return Permit<br />
<br />
<br />
term obligation_mark: Platform must marking("Copyright 2011 Acme")<br />
<br />
when True<br />
<br />
<br />
term obligation_encrypt: Platform must encrypt()<br />
<br />
when True<br />
<br />
}<br />
<br />
*</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=542
CBAC
2026-09-03T00:47:57Z
<p>20260503：</p>
<hr />
<div><meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" /><br />
<meta property="dc:modified" content="2026-08-30T23:12:55.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
<meta charset="utf-8" /><br />
<br />
= <br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" /><br />
<meta property="dc:modified" content="2026-08-30T23:12:55.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]顺序 =<br />
<br />
target term<br />
<br />
│ 只做资源级适用性判断，不引用具体 comb<br />
<br />
▼ （编译器自动按 Request::Act.actionId 查找对应 comb； （无 comb 则找同动作 rule_target））<br />
<br />
comb term（组合入口，针对一类动作）<br />
<br />
│ 在 when 中 evalTerm(rule_target, Request) = Permit<br />
<br />
▼<br />
<br />
rule_target term（动作、rule级obligation、rule级target、伴随、后置）<br />
<br />
│ 在 when 中 evalTerm(rule_condition, Request) = Permit<br />
<br />
▼<br />
<br />
rule_condition term（condition和返回）<br />
<br />
<br />
=例1：sample6=<br />
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/<br />
<br />
说明：多rule合并<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" <br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"><br />
<Description>Test Or</Description><br />
<Target></Target><br />
<Rule Effect="Permit" RuleId="primary-group-emps-rule"> <br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" <br />
Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Permit" RuleId="primary-user-rule"> <br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" <br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Deny" RuleId="deny-rule"></Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy (组合: first-applicable) <br />
<br />
├── Target = 空<br />
<br />
├── Rule1 (Permit)<br />
<br />
│ ├── Target: action-id = read<br />
<br />
│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集<br />
<br />
├── Rule2 (Permit)<br />
<br />
│ ├── Target: 无<br />
<br />
│ └── Condition: resource-id 与 {<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>, <nowiki>http://localhost:8280/services/Customers/getVersion2}</nowiki> 有交集<br />
<br />
└── Rule3 (Deny) 兜底<br />
<br />
==原始请求等效json：==<br />
{<br />
"sub": {<br />
"subjectId": "anyone",<br />
"groups": []<br />
},<br />
"act": {<br />
"actionId": "read"<br />
},<br />
"obj": {<br />
"resourceId": "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>"<br />
}<br />
}<br />
<br />
==转换版：==<br />
contract Sample6_RoleAccess {<br />
<br />
party Platform {<br />
<br />
name: String<br />
<br />
targetMatch(Request)<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
resourceId: String<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
## Type(match)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
when true<br />
<br />
where return Permit<br />
<br />
<br />
## Type(comb)<br />
<br />
term policy_comb: Sub can access Resource<br />
<br />
when some of(evalTerm(rule_target_1, Request),<br />
<br />
evalTerm(rule_target_2, Request)) = Permit<br />
<br />
where return Permit<br />
<br />
<br />
term rule_target_1: Sub can read Resource<br />
<br />
when ATTR(Request::Act, actionId) = "read"<br />
<br />
and evalTerm(rule_condition_1, Request) = Permit<br />
<br />
where return Permit<br />
<br />
<br />
term rule_condition_1:<br />
<br />
when some g in ATTR(Request::Sub, groups)<br />
<br />
such that g = "admin_emps" or g = "admin"<br />
<br />
where return Permit<br />
<br />
<br />
term rule_target_2: Sub can access Resource<br />
<br />
when evalTerm(rule_condition_2, Request) = Permit<br />
<br />
where return Permit<br />
<br />
<br />
term rule_condition_2:<br />
<br />
when ATTR(Request::Obj, resourceId) in {<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",<br />
<br />
"<nowiki>http://localhost:8280/services/Customers/getVersion2</nowiki>"<br />
<br />
}<br />
<br />
where return Permit<br />
<br />
}<br />
<br />
<br />
=例2：OASIS 3-4=<br />
来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502<br />
<br />
语法：双target，有obligation<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"<br />
PolicyId="copyright-approve"<br />
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"<br />
Version="1"><br />
<Description>Example copyright material policy</Description><br />
<br />
<!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant --><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/><br />
</Match><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- 规则级 Target：资源 ip-owner = Acme --><br />
<Rule Effect="Permit" RuleId="Right to use copyrighted material match"><br />
<Description>Allow if subject's association to the designated custodian of the copyright agrees</Description><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<br />
<!-- Condition：以下 5 个条件全部成立才 Permit --><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and"><br />
<!-- ① 请求方组织 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ② 主体协议号 = 资源协议号 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ③ 资源被许可方 = Wiley Corp --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ④ 当前时间 >= 生效时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
<!-- ⑤ 当前时间 < 过期时间 --><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than"><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"<br />
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"<br />
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/><br />
</Apply><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<br />
<!-- Permit 时要求 PEP：加标记 + 加密 --><br />
<ObligationExpressions><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit"><br />
<AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue><br />
</AttributeAssignmentExpression><br />
</ObligationExpression><br />
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/><br />
</ObligationExpressions><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy copyright-approve (deny-overrides) <br />
<br />
├── Target: resource:copyright = true<br />
<br />
│ AND resource:agreement-type = <nowiki>urn:...:copyright-grant</nowiki><br />
<br />
└── Rule "Right to use copyrighted material match" (Permit)<br />
<br />
| ├── Target: resource:ip-owner = "Acme"<br />
<br />
| └── Condition (AND):<br />
<br />
| ├── subject:organization = "Wiley Corp"<br />
<br />
| ├── subject:agreement-id = resource:agreement-id<br />
<br />
| ├── resource:ip-licensee = "Wiley Corp"<br />
<br />
| ├── current-dateTime >= resource:effective-date<br />
<br />
| └── current-dateTime 小于 resource:expiration-date<br />
<br />
└── Obligations (Permit):<br />
<br />
├── marking(text = "Copyright 2011 Acme")<br />
<br />
└── encrypt<br />
<br />
==原始请求等效json： ==<br />
{<br />
"sub": {<br />
"organization": "Wiley Corp",<br />
"agreementId": "A-001"<br />
},<br />
"obj": {<br />
"copyright": true,<br />
"ipOwner": "Acme",<br />
"ipLicensee": "Wiley Corp",<br />
"agreementType": "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>",<br />
"agreementId": "A-001",<br />
"effectiveDate": "2020-01-01T00:00:00",<br />
"expirationDate": "2030-01-01T00:00:00"<br />
},<br />
"act": {<br />
"actionId": "use"<br />
},<br />
"env": {<br />
"currentDateTime": "2024-06-01T12:00:00"<br />
}<br />
}<br />
<br />
==转换版：==<br />
<br />
<br />
contract CopyrightApprove {<br />
<br />
party Owner {<br />
<br />
name: String<br />
<br />
}<br />
<br />
party Platform {<br />
<br />
name: String<br />
<br />
targetMatch(Request)<br />
<br />
marking(text: String)<br />
<br />
encrypt()<br />
<br />
}<br />
<br />
asset Resource {<br />
<br />
resourceId: String<br />
<br />
copyright: Boolean<br />
<br />
agreementType: String<br />
<br />
ipOwner: String<br />
<br />
ipLicensee: String<br />
<br />
agreementId: String<br />
<br />
effectiveDate: dateTime<br />
<br />
expirationDate: dateTime<br />
<br />
}<br />
<br />
addition Request {<br />
<br />
Sub: Subject<br />
<br />
Obj: Resource<br />
<br />
Act: Action<br />
<br />
}<br />
<br />
addition fn {<br />
<br />
fn::string::oneAndOnly(x: String): String<br />
<br />
fn::dateTime::oneAndOnly(x: dateTime): dateTime<br />
<br />
}<br />
<br />
<br />
## Type(match)<br />
<br />
term policy_target: Platform must targetMatch(Request)<br />
<br />
when ATTR(Request::Obj, copyright) = true<br />
<br />
and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"<br />
<br />
where return Permit <br />
<br />
<br />
## Type(comb)<br />
<br />
term policy_comb: Sub can access Resource<br />
<br />
when evalTerm(rule_target, Request) = Permit<br />
<br />
where evalTerm(obligation_mark, Request) AND evalTerm(obligation_encrypt, Request) return Permit<br />
<br />
<br />
term rule_target: Sub can use Resource<br />
<br />
when ATTR(Request::Obj, ipOwner) = "Acme"<br />
<br />
and evalTerm(rule_condition, Request) = Permit<br />
<br />
where return Permit<br />
<br />
<br />
term rule_condition:<br />
<br />
when ATTR(Request::Sub, organization) = "Wiley Corp"<br />
<br />
and fn::string::oneAndOnly(ATTR(Request::Sub, agreementId)) =<br />
<br />
fn::string::oneAndOnly(ATTR(Request::Obj, agreementId))<br />
<br />
and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"<br />
<br />
and now >= fn::dateTime::oneAndOnly(ATTR(Request::Obj, effectiveDate))<br />
<br />
and now < fn::dateTime::oneAndOnly(ATTR(Request::Obj, expirationDate))<br />
<br />
where return Permit<br />
<br />
<br />
term obligation_mark: Platform must marking("Copyright 2011 Acme")<br />
<br />
when true<br />
<br />
<br />
term obligation_encrypt: Platform must encrypt()<br />
<br />
when true<br />
<br />
}<br />
<br />
*</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=541
CBAC
2026-08-30T23:12:55Z
<p>20260503：</p>
<hr />
<div><meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="256a4cfa7999ae45eb97cc5690cc00c9c38a6705" /><br />
<meta property="dc:modified" content="2026-08-30T23:08:30.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
= 概述<br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="256a4cfa7999ae45eb97cc5690cc00c9c38a6705" /><br />
<meta property="dc:modified" content="2026-08-30T23:08:30.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC] =<br />
<br />
[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]1、主体<br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="256a4cfa7999ae45eb97cc5690cc00c9c38a6705" /><br />
<meta property="dc:modified" content="2026-08-30T23:08:30.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]注册时签[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]主体合约，资源托管时签客体合约；两份合约放入同一个 policySet，按业务场景组合<br />
<br />
- policySet 是未签署的组合框架，policy 是一份已签署合约<br />
<br />
- CBAC 是主文档，主体合约 + 客体合约，两份都签署<br />
<br />
- SPESC 是执行投影。判决投影管 Permit/Deny，执行投影管付费、分账、违约<br />
<br />
- 因为 SPESC 本身只有立约和付款，装不下访问控制和角色派生，CBAC 补这一层<br />
<br />
2、原始 SPESC 格式不能破坏，只能追加：<br />
<br />
- party / asset / term 原样保留<br />
<br />
- term 管法律权利义务<br />
<br />
- access 管访问控制判决<br />
<br />
3、关联：<br />
<br />
- policy 里的 party / asset 是属性字典，给 access 提供 subject.role、resource.type 这类取值<br />
<br />
- policySet 里的 request 是统一输入，告诉引擎 subject 对应谁、resource 对应谁<br />
<br />
- 授权/角色派生 SPESC 没有，所以 term 动作带实参，是显式扩展。<br />
<br />
- term 的授权动作调用先执行，把角色派生结果交给 access 用<br />
<br />
4、找到的xacml没有托管合约下的语义，于是Platform 义务按需补，简单例子就只留 party/asset/term/access。<br />
<br />
5、后续使用：<br />
<br />
- 授权中心按 sub/obj 找到两份合约<br />
<br />
- 请求只带 Subid / Objid / Act<br />
<br />
- 判决引擎只读 access和授权动作调用派生的属性，不读 term 的 must / while / where / breach<br />
<br />
- term 的付费、分账、违约留给 SPESC 投影<br />
<br />
- Permit 后生成具体 SPESC，再发 token；资源中心验 token 放行；放行后触发链上具体 SPESC 执行<br />
<br />
- 判决和执行读同一份主文档，但读的部分不同，所以视图一致性用双 AST 检查兜底<br />
<br />
<meta charset="utf-8" /><br />
<title>CBAC</title><br />
<br />
=例1：基础policy，OASIS 规范正式例子的起点=<br />
来源：https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html#_Toc325047096<br />
<br />
语法：单条 Policy + 单条 Rule，Policy 级 Target 为空，Rule 级 Target 用 rfc822Name-match 对请求里的 subject-id 做邮箱域匹配；没有 Condition、Obligation、PolicySet。相比 WSO2 的 string-equal/集合比较，这里第一次出现“带类型的函数语义”（RFC822 邮箱域名匹配）<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<?xml version="1.0" encoding="UTF-8"?><br />
<Policy<br />
xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"<br />
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"<br />
xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17<br />
http://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd"<br />
PolicyId="urn:oasis:names:tc:xacml:3.0:example:SimplePolicy1"<br />
Version="1.0"<br />
RuleCombiningAlgId="identifier:rule-combining-algorithm:deny-overrides"><br />
<Description><br />
Medi Corp access control policy<br />
</Description><br />
<Target/><br />
<Rule<br />
RuleId="urn:oasis:names:tc:xacml:3.0:example:SimpleRule1"<br />
Effect="Permit"><br />
<Description><br />
Any subject with an e-mail name in the med.example.com domain<br />
can perform any action on any resource.<br />
</Description><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match<br />
MatchId="urn:oasis:names:tc:xacml:1.0:function:rfc822Name-match"><br />
<AttributeValue<br />
DataType="http://www.w3.org/2001/XMLSchema#string"<br />
>med.example.com</AttributeValue><br />
<AttributeDesignator<br />
MustBePresent="false"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"<br />
DataType="urn:oasis:names:tc:xacml:1.0:data-type:rfc822Name"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
</Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy SimplePolicy1 (deny-overrides) <br />
<br />
├── Target = 空（适用于所有请求）<br />
<br />
└── Rule SimpleRule1 (Permit)<br />
<br />
├── 描述：med.example.com 域内的邮箱主体可以对任意资源执行任意动作<br />
<br />
└── Target: subject-id (rfc822Name) 匹配 "med.example.com"<br />
==属性表：==<br />
| `subject-id` | access-subject | `rfc822Name` |<br />
<br />
==原始请求等效json：==<br />
{<br />
"sub": {<br />
"subjectId": "bart.simpson@med.example.com"<br />
},<br />
"obj": {<br />
"resourceId": "file://example/med/record/patient/BartSimpson"<br />
},<br />
"act": {<br />
"actionId": "read"<br />
}<br />
}<br />
==转换版说明：==<br />
- 原例是单一企业内部访问策略，不是本课题“平台托管双合约”场景。为自圆其说，将其置于“Medi Corp 内部医疗资源平台”语境： <br />
<br />
-- Platform 承担身份/角色管理、核心业务授权、安全合规、生命周期治理义务；<br />
<br />
- 原 XACML 只有主体域约束，因此本文件只含一份 policy，不强行拆两份合约。 <br />
<br />
- 映射： rfc822Name-match("med.example.com", subject-id) -> subject.subjectId endsWith "@med.example.com" <br />
<br />
- 原始请求之外需要获取的其它信息：<br />
==转换版：==<br />
policySet "OASIS3_5_MediCorpAccess" {<br />
<br />
// CBAC 追加：请求模型（判决引擎统一输入）<br />
<br />
request AuthorizationRequest {<br />
<br />
subject: Subject<br />
<br />
resource: Resource<br />
<br />
action: Action<br />
<br />
environment: Environment<br />
<br />
}<br />
<br />
combine denyOverrides // XACML 上层组合逻辑<br />
<br />
policy "MediCorpInternalAccess" signedBy [Subject, Platform] {<br />
<br />
party Subject { // SPESC 原生参与方 ----<br />
<br />
subjectId: rfc822Name<br />
<br />
name: String<br />
<br />
department: String<br />
<br />
employmentStatus: String<br />
<br />
}<br />
<br />
party Platform { // Platform 的“系统设计义务”，由 SPESC term 声明。<br />
<br />
account: String<br />
<br />
authorize(role: String, subjectId: String) // 身份/角色管理<br />
<br />
audit(actionId: String, subjectId: String) // 安全/合规执行<br />
<br />
suspend(subjectId: String) // 治理/处罚<br />
<br />
revoke(subjectId: String) // 生命周期终止<br />
<br />
}<br />
<br />
// ---- SPESC 原生：资产 ----<br />
<br />
asset Resource {<br />
<br />
info {<br />
<br />
resourceId: String<br />
<br />
resourceType: String<br />
<br />
department: String<br />
<br />
}<br />
<br />
right { }<br />
<br />
}<br />
<br />
// ---- SPESC term：法律/义务声明（不参与 Permit/Deny）---<br />
<br />
// 身份与角色管理：平台有义务为域内用户派生 internal-user 角色<br />
<br />
term IdentityRoleManagement: Platform must authorize("internal-user", Subject::subjectId)<br />
<br />
when Subject::subjectId endsWith "@med.example.com".<br />
<br />
// 安全与合规执行：平台有义务对访问动作审计<br />
<br />
term SecurityComplianceAudit: Platform must audit(action.actionId, Subject::subjectId)<br />
<br />
when action.actionId in ["read", "download", "export"].<br />
<br />
// 生命周期治理：员工离岗时平台有义务吊销访问资格<br />
<br />
term LifecycleRevoke: Platform must revoke(Subject::subjectId)<br />
<br />
when Subject::employmentStatus = "terminated".<br />
<br />
combine permitOverrides // XACML 下层组合逻辑<br />
<br />
access "AnyMedDomainUserAnyAction" { // 原始 XACML 规则：域内用户可对任何资源执行任何动作<br />
<br />
target {<br />
<br />
subject.subjectId endsWith "@med.example.com"<br />
<br />
}<br />
<br />
effect Permit<br />
<br />
}<br />
<br />
signature { algorithm "ECDSA"; keyId "medi-subject-template-001"; digest "sha256:..." }<br />
<br />
signature { algorithm "ECDSA"; keyId "medi-platform-001"; digest "sha256:..." }<br />
<br />
}<br />
<br />
}<br />
<br />
<br />
=例2：rbac组合=<br />
来源：https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html#_Toc325047096 语法：单条 Policy + 单条 Rule，Policy 级 Target 为空，Rule 级 Target 用 rfc822Name-match 对请求里的 subject-id 做邮箱域匹配；没有 Condition、Obligation、PolicySet。相比 WSO2 的 string-equal/集合比较，这里第一次出现“带类型的函数语义”（RFC822 邮箱域名匹配）<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"><br />
<Description>Test Or</Description><br />
<Target></Target><br />
<Rule Effect="Permit" RuleId="primary-group-emps-rule"> //Rule1：read + 组命中 admin_emps/admin → 保护接口<br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Permit" RuleId="primary-user-rule"> //Rule2：公开版本接口，任何用户<br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Deny" RuleId="deny-rule"></Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy (组合: first-applicable) <br />
<br />
├── Target = 空 <br />
<br />
├── Rule1 (Permit) <br />
<br />
│ ├── Target: action-id = read <br />
<br />
│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集<br />
<br />
├── Rule2 (Permit) <br />
<br />
│ ├── Target: 无 <br />
<br />
│ └── Condition: resource-id 与 {http://localhost:8280/services/Customers/getVersion1, http://localhost:8280/services/Customers/getVersion2} 有交集 <br />
<br />
└── Rule3 (Deny) 兜底<br />
==属性表：==<br />
| `action-id` | `action` | string | <br />
<br />
| `group` | `group` | string |<br />
<br />
| `resource-id` | `resource` | string |<br />
==原始请求等效json： ==<br />
{<br />
"sub": {<br />
"subjectId": "alice",<br />
"groups": ["admin"]<br />
},<br />
"obj": {<br />
"resourceId": "http://localhost:8280/services/Customers/getVersion1"<br />
},<br />
"act": {<br />
"actionId": "read"<br />
}<br />
}<br />
==转换版说明：==<br />
把原策略的 3 条 Rule 直接翻成 3 条 access，没有加任何 Platform 义务<br />
==转换版：==<br />
policySet "WSO2_Sample6_TestOr" {<br />
request AuthorizationRequest {<br />
subject: Subject<br />
resource: Resource<br />
action: Action<br />
environment: Environment<br />
}<br />
type Action {<br />
actionId: string<br />
}<br />
type Environment {<br />
currentTime: dateTime<br />
}<br />
combine firstApplicable<br />
policy "testOr" {<br />
party Subject {<br />
subjectId: string<br />
groups: string[] // 原 XACML 的 group category<br />
readResource() // 动作声明<br />
}<br />
asset Resource {<br />
info {<br />
resourceId: string<br />
}<br />
right { }<br />
}<br />
term PublicVersionRead: Subject can readResource<br />
when Resource::resourceId in [<br />
"http://localhost:8280/services/Customers/getVersion1",<br />
"http://localhost:8280/services/Customers/getVersion2"<br />
].<br />
combine firstApplicable<br />
access "PrimaryGroupEmpsRule" {<br />
target {<br />
action.actionId = "read"<br />
}<br />
condition {<br />
some g in subject.groups<br />
such that g in ["admin_emps", "admin"]<br />
}<br />
effect Permit<br />
}<br />
access "PrimaryUserRule" {<br />
condition {<br />
resource.resourceId in [<br />
"http://localhost:8280/services/Customers/getVersion1",<br />
"http://localhost:8280/services/Customers/getVersion2"<br />
]<br />
}<br />
effect Permit<br />
}<br />
access "DenyRule" {<br />
effect Deny<br />
}<br />
}<br />
}<br />
*</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=MediaWiki:Sidebar&diff=540
MediaWiki:Sidebar
2026-08-30T23:10:29Z
<p>20260503：</p>
<hr />
<div><br />
* 导航<br />
** http://39.106.77.250:8090/index.html|crypto202<br />
<br />
* navigation<br />
** mainpage|智能合约<br />
** recentchanges-url|recentchanges<br />
** SPESC|SPESC<br />
** helppage|help-mediawiki<br />
* 语言<br />
** https://www.smartlegalcontract.cn/mediawiki/index.php/%E5%8C%BA%E5%9D%97%E9%93%BE%E6%99%BA%E8%83%BD%E5%90%88%E7%BA%A6%E5%BD%A2%E5%BC%8F%E5%8C%96%E8%A1%A8%E8%BE%BE|智能法律合约<br />
** https://www.smartlegalcontract.cn/mediawiki/index.php/T/CIE_095-2020|Smart Legal Contract<br />
** https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC | 托管合约语言设计<br />
<br />
<br />
* 应用<br />
**http://123.56.246.148:8080/ |公益遗嘱链<br />
**http://smpc.smartlegalcontract.cn/ |计算管理平台<br />
**https://api.smartlegalcontract.cn/web/index.html |畜牧问答平台<br />
*样例<br />
**https://www.smartlegalcontract.cn/mediawiki/index.php/Examples|智能法律合约样例<br />
* SEARCH<br />
* TOOLBOX<br />
* LANGUAGES</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=539
CBAC
2026-08-30T23:08:30Z
<p>20260503：</p>
<hr />
<div><meta charset="utf-8" /><br />
= 概述<br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="58c2f9929966cca5fff2c61922f72d8e94d9c300" /><br />
<meta property="dc:modified" content="2026-08-30T22:58:04.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC] =<br />
<br />
[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]主体注册时签主体合约，资源托管时签客体合约；两份合约放入同一个 policySet，按业务场景组合<br />
<br />
policySet 是未签署的组合框架，policy 是一份已签署合约<br />
<br />
CBAC 是主文档，主体合约 + 客体合约，两份都签署<br />
<br />
SPESC 是执行投影。判决投影管 Permit/Deny，执行投影管付费、分账、违约<br />
<br />
因为 SPESC 本身只有立约和付款，装不下访问控制和角色派生，CBAC 补这一层<br />
<br />
原始 SPESC 格式不能破坏，只能追加：<br />
<br />
party / asset / term 原样保留<br />
<br />
term 管法律权利义务<br />
<br />
access 管访问控制判决<br />
<br />
关联：<br />
<br />
policy 里的 party / asset 是属性字典，给 access 提供 subject.role、resource.type 这类取值<br />
<br />
policySet 里的 request 是统一输入，告诉引擎 subject 对应谁、resource 对应谁<br />
<br />
授权/角色派生 SPESC 没有，所以 term 动作带实参，是显式扩展。<br />
<br />
term 的授权动作调用先执行，把角色派生结果交给 access 用<br />
<br />
<br />
找到的xacml没有托管合约下的语义，于是Platform 义务按需补，简单例子就只留 party/asset/term/access。<br />
<br />
<br />
后续使用：<br />
<br />
请求只带 Subid / Objid / Act<br />
<br />
授权中心按 sub/obj 找到两份合约<br />
<br />
判决引擎只读 access和授权动作调用派生的属性，不读 term 的 must / while / where / breach<br />
<br />
term 的付费、分账、违约留给 SPESC 投影<br />
<br />
Permit 后生成具体 SPESC，再发 token；资源中心验 token 放行；放行后触发链上具体 SPESC 执行<br />
<br />
判决和执行读同一份主文档，但读的部分不同，所以视图一致性用双 AST 检查兜底<br />
<br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
<br />
=例1：基础policy，OASIS 规范正式例子的起点=<br />
来源：https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html#_Toc325047096<br />
<br />
语法：单条 Policy + 单条 Rule，Policy 级 Target 为空，Rule 级 Target 用 rfc822Name-match 对请求里的 subject-id 做邮箱域匹配；没有 Condition、Obligation、PolicySet。相比 WSO2 的 string-equal/集合比较，这里第一次出现“带类型的函数语义”（RFC822 邮箱域名匹配）<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<?xml version="1.0" encoding="UTF-8"?><br />
<Policy<br />
xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"<br />
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"<br />
xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17<br />
http://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd"<br />
PolicyId="urn:oasis:names:tc:xacml:3.0:example:SimplePolicy1"<br />
Version="1.0"<br />
RuleCombiningAlgId="identifier:rule-combining-algorithm:deny-overrides"><br />
<Description><br />
Medi Corp access control policy<br />
</Description><br />
<Target/><br />
<Rule<br />
RuleId="urn:oasis:names:tc:xacml:3.0:example:SimpleRule1"<br />
Effect="Permit"><br />
<Description><br />
Any subject with an e-mail name in the med.example.com domain<br />
can perform any action on any resource.<br />
</Description><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match<br />
MatchId="urn:oasis:names:tc:xacml:1.0:function:rfc822Name-match"><br />
<AttributeValue<br />
DataType="http://www.w3.org/2001/XMLSchema#string"<br />
>med.example.com</AttributeValue><br />
<AttributeDesignator<br />
MustBePresent="false"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"<br />
DataType="urn:oasis:names:tc:xacml:1.0:data-type:rfc822Name"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
</Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy SimplePolicy1 (deny-overrides) <br />
<br />
├── Target = 空（适用于所有请求）<br />
<br />
└── Rule SimpleRule1 (Permit)<br />
<br />
├── 描述：med.example.com 域内的邮箱主体可以对任意资源执行任意动作<br />
<br />
└── Target: subject-id (rfc822Name) 匹配 "med.example.com"<br />
==属性表：==<br />
| `subject-id` | access-subject | `rfc822Name` |<br />
<br />
==原始请求等效json：==<br />
{<br />
"sub": {<br />
"subjectId": "bart.simpson@med.example.com"<br />
},<br />
"obj": {<br />
"resourceId": "file://example/med/record/patient/BartSimpson"<br />
},<br />
"act": {<br />
"actionId": "read"<br />
}<br />
}<br />
==转换版说明：==<br />
- 原例是单一企业内部访问策略，不是本课题“平台托管双合约”场景。为自圆其说，将其置于“Medi Corp 内部医疗资源平台”语境： <br />
<br />
-- Platform 承担身份/角色管理、核心业务授权、安全合规、生命周期治理义务；<br />
<br />
- 原 XACML 只有主体域约束，因此本文件只含一份 policy，不强行拆两份合约。 <br />
<br />
- 映射： rfc822Name-match("med.example.com", subject-id) -> subject.subjectId endsWith "@med.example.com" <br />
<br />
- 原始请求之外需要获取的其它信息：<br />
==转换版：==<br />
policySet "OASIS3_5_MediCorpAccess" {<br />
<br />
// CBAC 追加：请求模型（判决引擎统一输入）<br />
<br />
request AuthorizationRequest {<br />
<br />
subject: Subject<br />
<br />
resource: Resource<br />
<br />
action: Action<br />
<br />
environment: Environment<br />
<br />
}<br />
<br />
combine denyOverrides // XACML 上层组合逻辑<br />
<br />
policy "MediCorpInternalAccess" signedBy [Subject, Platform] {<br />
<br />
party Subject { // SPESC 原生参与方 ----<br />
<br />
subjectId: rfc822Name<br />
<br />
name: String<br />
<br />
department: String<br />
<br />
employmentStatus: String<br />
<br />
}<br />
<br />
party Platform { // Platform 的“系统设计义务”，由 SPESC term 声明。<br />
<br />
account: String<br />
<br />
authorize(role: String, subjectId: String) // 身份/角色管理<br />
<br />
audit(actionId: String, subjectId: String) // 安全/合规执行<br />
<br />
suspend(subjectId: String) // 治理/处罚<br />
<br />
revoke(subjectId: String) // 生命周期终止<br />
<br />
}<br />
<br />
// ---- SPESC 原生：资产 ----<br />
<br />
asset Resource {<br />
<br />
info {<br />
<br />
resourceId: String<br />
<br />
resourceType: String<br />
<br />
department: String<br />
<br />
}<br />
<br />
right { }<br />
<br />
}<br />
<br />
// ---- SPESC term：法律/义务声明（不参与 Permit/Deny）---<br />
<br />
// 身份与角色管理：平台有义务为域内用户派生 internal-user 角色<br />
<br />
term IdentityRoleManagement: Platform must authorize("internal-user", Subject::subjectId)<br />
<br />
when Subject::subjectId endsWith "@med.example.com".<br />
<br />
// 安全与合规执行：平台有义务对访问动作审计<br />
<br />
term SecurityComplianceAudit: Platform must audit(action.actionId, Subject::subjectId)<br />
<br />
when action.actionId in ["read", "download", "export"].<br />
<br />
// 生命周期治理：员工离岗时平台有义务吊销访问资格<br />
<br />
term LifecycleRevoke: Platform must revoke(Subject::subjectId)<br />
<br />
when Subject::employmentStatus = "terminated".<br />
<br />
combine permitOverrides // XACML 下层组合逻辑<br />
<br />
access "AnyMedDomainUserAnyAction" { // 原始 XACML 规则：域内用户可对任何资源执行任何动作<br />
<br />
target {<br />
<br />
subject.subjectId endsWith "@med.example.com"<br />
<br />
}<br />
<br />
effect Permit<br />
<br />
}<br />
<br />
signature { algorithm "ECDSA"; keyId "medi-subject-template-001"; digest "sha256:..." }<br />
<br />
signature { algorithm "ECDSA"; keyId "medi-platform-001"; digest "sha256:..." }<br />
<br />
}<br />
<br />
}<br />
<br />
<br />
=例2：rbac组合=<br />
来源：https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html#_Toc325047096 语法：单条 Policy + 单条 Rule，Policy 级 Target 为空，Rule 级 Target 用 rfc822Name-match 对请求里的 subject-id 做邮箱域匹配；没有 Condition、Obligation、PolicySet。相比 WSO2 的 string-equal/集合比较，这里第一次出现“带类型的函数语义”（RFC822 邮箱域名匹配）<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"><br />
<Description>Test Or</Description><br />
<Target></Target><br />
<Rule Effect="Permit" RuleId="primary-group-emps-rule"> //Rule1：read + 组命中 admin_emps/admin → 保护接口<br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Permit" RuleId="primary-user-rule"> //Rule2：公开版本接口，任何用户<br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Deny" RuleId="deny-rule"></Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy (组合: first-applicable) <br />
<br />
├── Target = 空 <br />
<br />
├── Rule1 (Permit) <br />
<br />
│ ├── Target: action-id = read <br />
<br />
│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集<br />
<br />
├── Rule2 (Permit) <br />
<br />
│ ├── Target: 无 <br />
<br />
│ └── Condition: resource-id 与 {http://localhost:8280/services/Customers/getVersion1, http://localhost:8280/services/Customers/getVersion2} 有交集 <br />
<br />
└── Rule3 (Deny) 兜底<br />
==属性表：==<br />
| `action-id` | `action` | string | <br />
<br />
| `group` | `group` | string |<br />
<br />
| `resource-id` | `resource` | string |<br />
==原始请求等效json： ==<br />
{<br />
"sub": {<br />
"subjectId": "alice",<br />
"groups": ["admin"]<br />
},<br />
"obj": {<br />
"resourceId": "http://localhost:8280/services/Customers/getVersion1"<br />
},<br />
"act": {<br />
"actionId": "read"<br />
}<br />
}<br />
==转换版说明：==<br />
把原策略的 3 条 Rule 直接翻成 3 条 access，没有加任何 Platform 义务<br />
==转换版：==<br />
policySet "WSO2_Sample6_TestOr" {<br />
request AuthorizationRequest {<br />
subject: Subject<br />
resource: Resource<br />
action: Action<br />
environment: Environment<br />
}<br />
type Action {<br />
actionId: string<br />
}<br />
type Environment {<br />
currentTime: dateTime<br />
}<br />
combine firstApplicable<br />
policy "testOr" {<br />
party Subject {<br />
subjectId: string<br />
groups: string[] // 原 XACML 的 group category<br />
readResource() // 动作声明<br />
}<br />
asset Resource {<br />
info {<br />
resourceId: string<br />
}<br />
right { }<br />
}<br />
term PublicVersionRead: Subject can readResource<br />
when Resource::resourceId in [<br />
"http://localhost:8280/services/Customers/getVersion1",<br />
"http://localhost:8280/services/Customers/getVersion2"<br />
].<br />
combine firstApplicable<br />
access "PrimaryGroupEmpsRule" {<br />
target {<br />
action.actionId = "read"<br />
}<br />
condition {<br />
some g in subject.groups<br />
such that g in ["admin_emps", "admin"]<br />
}<br />
effect Permit<br />
}<br />
access "PrimaryUserRule" {<br />
condition {<br />
resource.resourceId in [<br />
"http://localhost:8280/services/Customers/getVersion1",<br />
"http://localhost:8280/services/Customers/getVersion2"<br />
]<br />
}<br />
effect Permit<br />
}<br />
access "DenyRule" {<br />
effect Deny<br />
}<br />
}<br />
}<br />
*</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=538
CBAC
2026-08-30T22:58:04Z
<p>20260503：</p>
<hr />
<div><br />
<meta charset="utf-8" /><br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="bf1c03a2d44cfeb75e2c20c883f923ab8538d29f" /><br />
<meta property="dc:modified" content="2026-08-30T22:31:17.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]--><br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
<br />
<br />
<meta charset="utf-8" /><br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="ecb6fc1a18535197780f8c3448dcf9329df00611" /><br />
<meta property="dc:modified" content="2026-08-30T19:12:37.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]--><br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
<br />
<br />
<br />
=例1：基础policy，OASIS 规范正式例子的起点=<br />
来源：https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html#_Toc325047096<br />
<br />
语法：单条 Policy + 单条 Rule，Policy 级 Target 为空，Rule 级 Target 用 rfc822Name-match 对请求里的 subject-id 做邮箱域匹配；没有 Condition、Obligation、PolicySet。相比 WSO2 的 string-equal/集合比较，这里第一次出现“带类型的函数语义”（RFC822 邮箱域名匹配）<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<?xml version="1.0" encoding="UTF-8"?><br />
<Policy<br />
xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"<br />
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"<br />
xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17<br />
http://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd"<br />
PolicyId="urn:oasis:names:tc:xacml:3.0:example:SimplePolicy1"<br />
Version="1.0"<br />
RuleCombiningAlgId="identifier:rule-combining-algorithm:deny-overrides"><br />
<Description><br />
Medi Corp access control policy<br />
</Description><br />
<Target/><br />
<Rule<br />
RuleId="urn:oasis:names:tc:xacml:3.0:example:SimpleRule1"<br />
Effect="Permit"><br />
<Description><br />
Any subject with an e-mail name in the med.example.com domain<br />
can perform any action on any resource.<br />
</Description><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match<br />
MatchId="urn:oasis:names:tc:xacml:1.0:function:rfc822Name-match"><br />
<AttributeValue<br />
DataType="http://www.w3.org/2001/XMLSchema#string"<br />
>med.example.com</AttributeValue><br />
<AttributeDesignator<br />
MustBePresent="false"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"<br />
DataType="urn:oasis:names:tc:xacml:1.0:data-type:rfc822Name"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
</Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy SimplePolicy1 (deny-overrides) <br />
<br />
├── Target = 空（适用于所有请求）<br />
<br />
└── Rule SimpleRule1 (Permit)<br />
<br />
├── 描述：med.example.com 域内的邮箱主体可以对任意资源执行任意动作<br />
<br />
└── Target: subject-id (rfc822Name) 匹配 "med.example.com"<br />
==属性表：==<br />
| `subject-id` | access-subject | `rfc822Name` |<br />
<br />
==原始请求等效json：==<br />
{<br />
"sub": {<br />
"subjectId": "bart.simpson@med.example.com"<br />
},<br />
"obj": {<br />
"resourceId": "file://example/med/record/patient/BartSimpson"<br />
},<br />
"act": {<br />
"actionId": "read"<br />
}<br />
}<br />
==转换版说明：==<br />
- 原例是单一企业内部访问策略，不是本课题“平台托管双合约”场景。为自圆其说，将其置于“Medi Corp 内部医疗资源平台”语境： <br />
<br />
-- Platform 承担身份/角色管理、核心业务授权、安全合规、生命周期治理义务；<br />
<br />
- 原 XACML 只有主体域约束，因此本文件只含一份 policy，不强行拆两份合约。 <br />
<br />
- 映射： rfc822Name-match("med.example.com", subject-id) -> subject.subjectId endsWith "@med.example.com" <br />
<br />
- 原始请求之外需要获取的其它信息：<br />
==转换版：==<br />
policySet "OASIS3_5_MediCorpAccess" {<br />
<br />
// CBAC 追加：请求模型（判决引擎统一输入）<br />
<br />
request AuthorizationRequest {<br />
<br />
subject: Subject<br />
<br />
resource: Resource<br />
<br />
action: Action<br />
<br />
environment: Environment<br />
<br />
}<br />
<br />
combine denyOverrides // XACML 上层组合逻辑<br />
<br />
policy "MediCorpInternalAccess" signedBy [Subject, Platform] {<br />
<br />
party Subject { // SPESC 原生参与方 ----<br />
<br />
subjectId: rfc822Name<br />
<br />
name: String<br />
<br />
department: String<br />
<br />
employmentStatus: String<br />
<br />
}<br />
<br />
party Platform { // Platform 的“系统设计义务”，由 SPESC term 声明。<br />
<br />
account: String<br />
<br />
authorize(role: String, subjectId: String) // 身份/角色管理<br />
<br />
audit(actionId: String, subjectId: String) // 安全/合规执行<br />
<br />
suspend(subjectId: String) // 治理/处罚<br />
<br />
revoke(subjectId: String) // 生命周期终止<br />
<br />
}<br />
<br />
// ---- SPESC 原生：资产 ----<br />
<br />
asset Resource {<br />
<br />
info {<br />
<br />
resourceId: String<br />
<br />
resourceType: String<br />
<br />
department: String<br />
<br />
}<br />
<br />
right { }<br />
<br />
}<br />
<br />
// ---- SPESC term：法律/义务声明（不参与 Permit/Deny）---<br />
<br />
// 身份与角色管理：平台有义务为域内用户派生 internal-user 角色<br />
<br />
term IdentityRoleManagement: Platform must authorize("internal-user", Subject::subjectId)<br />
<br />
when Subject::subjectId endsWith "@med.example.com".<br />
<br />
// 安全与合规执行：平台有义务对访问动作审计<br />
<br />
term SecurityComplianceAudit: Platform must audit(action.actionId, Subject::subjectId)<br />
<br />
when action.actionId in ["read", "download", "export"].<br />
<br />
// 生命周期治理：员工离岗时平台有义务吊销访问资格<br />
<br />
term LifecycleRevoke: Platform must revoke(Subject::subjectId)<br />
<br />
when Subject::employmentStatus = "terminated".<br />
<br />
combine permitOverrides // XACML 下层组合逻辑<br />
<br />
access "AnyMedDomainUserAnyAction" { // 原始 XACML 规则：域内用户可对任何资源执行任何动作<br />
<br />
target {<br />
<br />
subject.subjectId endsWith "@med.example.com"<br />
<br />
}<br />
<br />
effect Permit<br />
<br />
}<br />
<br />
signature { algorithm "ECDSA"; keyId "medi-subject-template-001"; digest "sha256:..." }<br />
<br />
signature { algorithm "ECDSA"; keyId "medi-platform-001"; digest "sha256:..." }<br />
<br />
}<br />
<br />
}<br />
<br />
<br />
=例2：rbac组合=<br />
来源：https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html#_Toc325047096 语法：单条 Policy + 单条 Rule，Policy 级 Target 为空，Rule 级 Target 用 rfc822Name-match 对请求里的 subject-id 做邮箱域匹配；没有 Condition、Obligation、PolicySet。相比 WSO2 的 string-equal/集合比较，这里第一次出现“带类型的函数语义”（RFC822 邮箱域名匹配）<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"><br />
<Description>Test Or</Description><br />
<Target></Target><br />
<Rule Effect="Permit" RuleId="primary-group-emps-rule"> //Rule1：read + 组命中 admin_emps/admin → 保护接口<br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Permit" RuleId="primary-user-rule"> //Rule2：公开版本接口，任何用户<br />
<Condition><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><br />
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/><br />
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue><br />
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue><br />
</Apply><br />
</Apply><br />
</Condition><br />
</Rule><br />
<Rule Effect="Deny" RuleId="deny-rule"></Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy (组合: first-applicable) <br />
<br />
├── Target = 空 <br />
<br />
├── Rule1 (Permit) <br />
<br />
│ ├── Target: action-id = read <br />
<br />
│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集<br />
<br />
├── Rule2 (Permit) <br />
<br />
│ ├── Target: 无 <br />
<br />
│ └── Condition: resource-id 与 {http://localhost:8280/services/Customers/getVersion1, http://localhost:8280/services/Customers/getVersion2} 有交集 <br />
<br />
└── Rule3 (Deny) 兜底<br />
==属性表：==<br />
| `action-id` | `action` | string | <br />
<br />
| `group` | `group` | string |<br />
<br />
| `resource-id` | `resource` | string |<br />
==原始请求等效json： ==<br />
{<br />
"sub": {<br />
"subjectId": "alice",<br />
"groups": ["admin"]<br />
},<br />
"obj": {<br />
"resourceId": "http://localhost:8280/services/Customers/getVersion1"<br />
},<br />
"act": {<br />
"actionId": "read"<br />
}<br />
}<br />
==转换版说明：==<br />
把原策略的 3 条 Rule 直接翻成 3 条 access，没有加任何 Platform 义务<br />
==转换版：==<br />
policySet "WSO2_Sample6_TestOr" {<br />
request AuthorizationRequest {<br />
subject: Subject<br />
resource: Resource<br />
action: Action<br />
environment: Environment<br />
}<br />
type Action {<br />
actionId: string<br />
}<br />
type Environment {<br />
currentTime: dateTime<br />
}<br />
combine firstApplicable<br />
policy "testOr" {<br />
party Subject {<br />
subjectId: string<br />
groups: string[] // 原 XACML 的 group category<br />
readResource() // 动作声明<br />
}<br />
asset Resource {<br />
info {<br />
resourceId: string<br />
}<br />
right { }<br />
}<br />
term PublicVersionRead: Subject can readResource<br />
when Resource::resourceId in [<br />
"http://localhost:8280/services/Customers/getVersion1",<br />
"http://localhost:8280/services/Customers/getVersion2"<br />
].<br />
combine firstApplicable<br />
access "PrimaryGroupEmpsRule" {<br />
target {<br />
action.actionId = "read"<br />
}<br />
condition {<br />
some g in subject.groups<br />
such that g in ["admin_emps", "admin"]<br />
}<br />
effect Permit<br />
}<br />
access "PrimaryUserRule" {<br />
condition {<br />
resource.resourceId in [<br />
"http://localhost:8280/services/Customers/getVersion1",<br />
"http://localhost:8280/services/Customers/getVersion2"<br />
]<br />
}<br />
effect Permit<br />
}<br />
access "DenyRule" {<br />
effect Deny<br />
}<br />
}<br />
}<br />
*</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=537
CBAC
2026-08-30T22:31:17Z
<p>20260503：</p>
<hr />
<div><br />
<meta charset="utf-8" /><br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="ecb6fc1a18535197780f8c3448dcf9329df00611" /><br />
<meta property="dc:modified" content="2026-08-30T19:12:37.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]--><br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
<br />
<br />
<br />
=例1：基础policy，OASIS 规范正式例子的起点=<br />
来源：https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html#_Toc325047096<br />
<br />
语法：单条 Policy + 单条 Rule，Policy 级 Target 为空，Rule 级 Target 用 rfc822Name-match 对请求里的 subject-id 做邮箱域匹配；没有 Condition、Obligation、PolicySet。相比 WSO2 的 string-equal/集合比较，这里第一次出现“带类型的函数语义”（RFC822 邮箱域名匹配）<br />
==原文：==<br />
<syntaxhighlight lang="xml"><br />
<?xml version="1.0" encoding="UTF-8"?><br />
<Policy<br />
xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"<br />
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"<br />
xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17<br />
http://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd"<br />
PolicyId="urn:oasis:names:tc:xacml:3.0:example:SimplePolicy1"<br />
Version="1.0"<br />
RuleCombiningAlgId="identifier:rule-combining-algorithm:deny-overrides"><br />
<Description><br />
Medi Corp access control policy<br />
</Description><br />
<Target/><br />
<Rule<br />
RuleId="urn:oasis:names:tc:xacml:3.0:example:SimpleRule1"<br />
Effect="Permit"><br />
<Description><br />
Any subject with an e-mail name in the med.example.com domain<br />
can perform any action on any resource.<br />
</Description><br />
<Target><br />
<AnyOf><br />
<AllOf><br />
<Match<br />
MatchId="urn:oasis:names:tc:xacml:1.0:function:rfc822Name-match"><br />
<AttributeValue<br />
DataType="http://www.w3.org/2001/XMLSchema#string"<br />
>med.example.com</AttributeValue><br />
<AttributeDesignator<br />
MustBePresent="false"<br />
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"<br />
AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"<br />
DataType="urn:oasis:names:tc:xacml:1.0:data-type:rfc822Name"/><br />
</Match><br />
</AllOf><br />
</AnyOf><br />
</Target><br />
</Rule><br />
</Policy><br />
</syntaxhighlight><br />
==逻辑结构：==<br />
Policy SimplePolicy1 (deny-overrides) ├── Target = 空（适用于所有请求） └── Rule SimpleRule1 (Permit)<br />
├── 描述：med.example.com 域内的邮箱主体可以对任意资源执行任意动作<br />
└── Target: subject-id (rfc822Name) 匹配 "med.example.com"<br />
==属性表：==<br />
（ AttributeId | Category | DataType | MustBePresent | 含义 ）<br />
<br />
| `subject-id` | access-subject | `rfc822Name` | false | 主体邮箱/标识；用于判断是否属于 `med.example.com` 域 |<br />
<br />
==原始请求等效json：==<br />
{<br />
"sub": {<br />
"subjectId": "bart.simpson@med.example.com"<br />
},<br />
"obj": {<br />
"resourceId": "file://example/med/record/patient/BartSimpson"<br />
},<br />
"act": {<br />
"actionId": "read"<br />
}<br />
}<br />
==转换版说明：==<br />
- 原例是单一企业内部访问策略，不是本课题“平台托管双合约”场景。为自圆其说，将其置于“Medi Corp 内部医疗资源平台”语境： <br />
<br />
-- Platform 承担身份/角色管理、核心业务授权、安全合规、生命周期治理义务；<br />
<br />
- 原 XACML 只有主体域约束，因此本文件只含一份 policy，不强行拆两份合约。 <br />
<br />
- 映射： rfc822Name-match("med.example.com", subject-id) -> subject.subjectId endsWith "@med.example.com" <br />
<br />
- 原始请求之外需要获取的其它信息：<br />
==转换版：==<br />
policySet "OASIS3_5_MediCorpAccess" {<br />
// CBAC 追加：请求模型（判决引擎统一输入）<br />
request AuthorizationRequest {<br />
subject: Subject<br />
resource: Resource<br />
action: Action<br />
environment: Environment<br />
}<br />
<br />
combine denyOverrides // XACML 上层组合逻辑<br />
<br />
policy "MediCorpInternalAccess" signedBy [Subject, Platform] {<br />
<br />
party Subject { // SPESC 原生参与方 ----<br />
subjectId: rfc822Name<br />
name: String<br />
department: String<br />
employmentStatus: String<br />
}<br />
<br />
party Platform { // Platform 的“系统设计义务”，由 SPESC term 声明。<br />
account: String<br />
authorize(role: String, subjectId: String) // 身份/角色管理<br />
audit(actionId: String, subjectId: String) // 安全/合规执行<br />
suspend(subjectId: String) // 治理/处罚<br />
revoke(subjectId: String) // 生命周期终止<br />
}<br />
<br />
// ---- SPESC 原生：资产 ----<br />
asset Resource {<br />
info {<br />
resourceId: String<br />
resourceType: String<br />
department: String<br />
}<br />
right { }<br />
}<br />
<br />
// ---- SPESC term：法律/义务声明（不参与 Permit/Deny）----<br />
<br />
// 身份与角色管理：平台有义务为域内用户派生 internal-user 角色<br />
term IdentityRoleManagement: Platform must authorize("internal-user", Subject::subjectId)<br />
when Subject::subjectId endsWith "@med.example.com".<br />
<br />
// 安全与合规执行：平台有义务对访问动作审计<br />
term SecurityComplianceAudit: Platform must audit(action.actionId, Subject::subjectId)<br />
when action.actionId in ["read", "download", "export"].<br />
<br />
// 生命周期治理：员工离岗时平台有义务吊销访问资格<br />
term LifecycleRevoke: Platform must revoke(Subject::subjectId)<br />
when Subject::employmentStatus = "terminated".<br />
<br />
combine permitOverrides // XACML 下层组合逻辑<br />
<br />
access "AnyMedDomainUserAnyAction" { // 原始 XACML 规则：域内用户可对任何资源执行任何动作<br />
target {<br />
subject.subjectId endsWith "@med.example.com"<br />
}<br />
effect Permit<br />
}<br />
<br />
signature { algorithm "ECDSA"; keyId "medi-subject-template-001"; digest "sha256:..." }<br />
signature { algorithm "ECDSA"; keyId "medi-platform-001"; digest "sha256:..." }<br />
}<br />
}<br />
*</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=536
CBAC
2026-08-30T19:12:37Z
<p>20260503：测试语法</p>
<hr />
<div><br />
<meta charset="utf-8" /><br />
<meta property="mw:pageId" content="75" /><br />
<meta property="mw:pageNamespace" content="0" /><br />
<br />
<meta property="mw:revisionSHA1" content="d5c6fed429426e4ae33ec0957e81d991bd027bbc" /><br />
<meta property="dc:modified" content="2026-08-30T19:06:42.000Z" /><br />
<meta property="mw:html:version" content="2.1.0" /><br />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]--><br />
<meta http-equiv="content-language" content="zh-cn" /><br />
<meta http-equiv="vary" content="Accept" /><br />
<br />
= 一级标题：项目总览=<br />
==二级标题：技术架构==<br />
===三级标题：配置文件示例===<br />
下面是系统的核心配置文件：<syntaxhighlight lang="xml"><br />
<?xml version="1.0" encoding="UTF-8"?><br />
<configuration><br />
<server><br />
<port>8080</port><br />
<host>localhost</host><br />
</server><br />
<database><br />
<driver>mysql</driver><br />
<url>jdbc:mysql://localhost:3306/myapp</url><br />
<username>root</username><br />
</database><br />
</configuration><br />
</syntaxhighlight><br />
*</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&diff=535
CBAC
2026-08-30T19:06:42Z
<p>20260503：建立内容为“* 导航栏一级标题 ** 页面名称|显示的文字 ** 另一个页面|另一个显示名 * 另一个一级标题 ** ...”的新页面</p>
<hr />
<div>* 导航栏一级标题<br />
** 页面名称|显示的文字<br />
** 另一个页面|另一个显示名<br />
* 另一个一级标题<br />
** ...</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=MediaWiki:Sidebar&diff=533
MediaWiki:Sidebar
2026-05-05T09:26:25Z
<p>20260503：</p>
<hr />
<div><br />
* 导航<br />
** http://39.106.77.250:8090/index.html|crypto202<br />
<br />
* navigation<br />
** mainpage|智能合约<br />
** recentchanges-url|recentchanges<br />
** SPESC|SPESC<br />
** helppage|help-mediawiki<br />
* 语言<br />
** https://www.smartlegalcontract.cn/mediawiki/index.php/%E5%8C%BA%E5%9D%97%E9%93%BE%E6%99%BA%E8%83%BD%E5%90%88%E7%BA%A6%E5%BD%A2%E5%BC%8F%E5%8C%96%E8%A1%A8%E8%BE%BE|智能法律合约<br />
** https://www.smartlegalcontract.cn/mediawiki/index.php/T/CIE_095-2020|Smart Legal Contract<br />
* 应用<br />
**http://123.56.246.148:8080/ |公益遗嘱链<br />
**http://www.smartlegalcontract.cn:8881/ |计算管理平台<br />
**https://api.smartlegalcontract.cn/web/index.html |首农畜牧<br />
*样例<br />
**https://www.smartlegalcontract.cn/mediawiki/index.php/Examples|智能法律合约样例<br />
* SEARCH<br />
* TOOLBOX<br />
* LANGUAGES</div>
20260503
https://www.smartlegalcontract.cn/mediawiki/index.php?title=MediaWiki:Sidebar&diff=532
MediaWiki:Sidebar
2026-05-03T09:46:31Z
<p>20260503：</p>
<hr />
<div><br />
* 导航<br />
** http://39.106.77.250:8090/index.html|crypto202<br />
<br />
* navigation<br />
** mainpage|智能合约<br />
** recentchanges-url|recentchanges<br />
** SPESC|SPESC<br />
** helppage|help-mediawiki<br />
* 语言<br />
** https://www.smartlegalcontract.cn/mediawiki/index.php/%E5%8C%BA%E5%9D%97%E9%93%BE%E6%99%BA%E8%83%BD%E5%90%88%E7%BA%A6%E5%BD%A2%E5%BC%8F%E5%8C%96%E8%A1%A8%E8%BE%BE|智能法律合约<br />
** https://www.smartlegalcontract.cn/mediawiki/index.php/T/CIE_095-2020|Smart Legal Contract<br />
* 应用<br />
**http://123.56.246.148:8080/ |公益遗嘱链<br />
**http://www.smartlegalcontract.cn:8881/ |计算管理平台<br />
*样例<br />
**https://www.smartlegalcontract.cn/mediawiki/index.php/Examples|智能法律合约样例<br />
* SEARCH<br />
* TOOLBOX<br />
* LANGUAGES</div>
20260503