“CBAC”的版本间的差异

来自智能法律合约
跳到导航 跳到搜索
第1行： 第1行：
−

+
<meta charset="utf-8" />
−
<meta charset="utf-8" />
 
 
<meta property="mw:pageId" content="75" />
 
<meta property="mw:pageId" content="75" />
 
<meta property="mw:pageNamespace" content="0" />
 
<meta property="mw:pageNamespace" content="0" />
  
−
<meta property="mw:revisionSHA1" content="47b34894dfcc793815ae7ed1a7708a06e76c11c8" />
+
<meta property="mw:revisionSHA1" content="6484283d6d9200fc6e16e86fda94ddc6c13a9b49" />
−
<meta property="dc:modified" content="2026-09-03T01:05:36.000Z" />
+
<meta property="dc:modified" content="2026-09-03T01:08:50.000Z" />
 
<meta property="mw:html:version" content="2.1.0" />
 
<meta property="mw:html:version" content="2.1.0" />
−
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]-->
+
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]
 
<meta http-equiv="content-language" content="zh-cn" />
 
<meta http-equiv="content-language" content="zh-cn" />
 
<meta http-equiv="vary" content="Accept" />
 
<meta http-equiv="vary" content="Accept" />
 +
----
 +
 +
== 概览 ==
 +
  
−
<meta charset="utf-8" />
+
更新时间：2026.9.4
−
<meta property="mw:pageId" content="75" />
 
−
<meta property="mw:pageNamespace" content="0" />
 
  
−
<meta property="mw:revisionSHA1" content="c14026e9edf9ff3dd34d05da43c296c7fa910e7e" />
+
将语言最简化，去除了将combination逻辑中，使用evalterm和逻辑谓词表达的方法。理由：在没有ifelse的情况下，无法表达其中某种组合逻辑。obligation的选取完全无法脱离if-else完成。
−
<meta property="dc:modified" content="2026-09-03T00:50:26.000Z" />
 
−
<meta property="mw:html:version" content="2.1.0" />
 
−
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]
 
−
<meta http-equiv="content-language" content="zh-cn" />
 
−
<meta http-equiv="vary" content="Accept" />
 
−
meta
 
−
<meta property="mw:pageId" content="75" />
 
−
<meta property="mw:pageNamespace" content="0" />
 
  
−
<meta property="mw:revisionSHA1" content="c14026e9edf9ff3dd34d05da43c296c7fa910e7e" />
+
成功转换了100+个从oasis官网获取的example
−
<meta property="dc:modified" content="2026-09-03T00:50:26.000Z" />
 
−
<meta property="mw:html:version" content="2.1.0" />
 
−
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC] pro[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]perty="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" />
 
−
<meta property="dc:modified" content="2026-08-30T23:12:55.000Z" />
 
−
<meta property="mw:html:version" content="2.1.0" />
 
−
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]
 
  
 +
下一步安排：在方磊制作的网页上上传10个精选版（周五夜里）
  
 +
下一步安排：寻找一些更复杂的例子（周五夜里）
  
 +
下一步安排：精进栈式判决测试，完善例子的输入，寻找xacml执行器并进行对比，在确认正确后进行效率测试（周六）
  
 +
一、基本结构
  
−
<nowiki>= 总体顺序 =</nowiki>
+
TODO
  
−
target term
 
  
−
               │ 只做资源级适用性判断，不引用具体 comb
+
二、执行顺序：
  
−
               ▼  （编译器自动按 Request::Act.actionId 查找对应 comb；  （无 comb 则找同动作 rule_target））
+
（1）Target Term，只做资源级适用性判断，包含when逻辑并调用
  
−
comb term（组合入口，针对一类动作）
+
（2）Authentic  Term：在运行前临时进行变量赋值逻辑
  
−
               │ 在 when 中 evalTerm(rule_target, Request) = Permit
+
when 条件
  
−
               ▼
+
while 赋值
  
−
rule_target term（动作、rule级obligation、rule级target、伴随、后置）
+
（3）rule_term
  
−
              │ 在 when 中 evalTerm(rule_condition, Request) = Permit
+
when：rule级target
  
−
             ▼
+
where：condition
  
−
rule_condition term（condition和返回）
+
while：rule级obligation
  
 +
(4)  obligation_term：policy级的义务，在最后执行
  
 +
使用while调用platform的函数
 
=例1：sample6=
 
=例1：sample6=
 
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/
 
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/
−
 
−
说明：多rule合并
 
 
==原文：==
 
==原文：==
 
<syntaxhighlight lang="xml">
 
<syntaxhighlight lang="xml">
第144行： 第134行：
 
contract Sample6_RoleAccess {
 
contract Sample6_RoleAccess {
  
−
    party Platform {
+
    party Sub {
  
−
        name: String
+
        subjectId: String
  
−
        targetMatch(Request)
+
        groups: set String
  
 
    }
 
    }
第168行： 第158行：
 
    }
 
    }
  
−
    ## Type(match)
+
    addition fn {
  
−
    term policy_target: Platform must targetMatch(Request)
+
        regexpMatch(value: String, pattern: String): Boolean
  
−
        when true
+
    }
  
−
        where return Permit
+
    combineAlgorithm = first-applicable
  
−
    ## Type(comb)
+
    ## Type(target)
  
−
    term policy_comb: Sub can access Resource
+
    term policy_target: Platform must targetMatch(Request)
  
−
        when some of(evalTerm(rule_target_1, Request),
+
    term primaryGroupEmpsRule: Sub can read Resource
−
 
 
−
                     evalTerm(rule_target_2, Request)) = Permit
 
−
 
 
−
        where return Permit
 
−
 
 
−
    term rule_target_1: Sub can read Resource
 
  
 
        when ATTR(Request::Act, actionId) = "read"
 
        when ATTR(Request::Act, actionId) = "read"
  
−
          and "admin_emps"  in  ATTR(Request::Sub, groups)
+
        where ATTR(Request::Sub, groups) overlaps {"admin_emps", "admin"}
  
−
        where return Permit
+
    term primaryUserRule: Sub can access Resource
  
−
    term rule_target_2: Sub can access Resource
+
        where ATTR(Request::Obj, resourceId) belong {
−
 
 
−
        when when ATTR(Request::Obj, resourceId) in {
 
  
 
            "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",
 
            "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",
第204行： 第186行：
 
        }
 
        }
  
−
        where return Permit
+
    term denyRule: Sub cannot access Resource
  
 
}
 
}
第388行： 第370行：
 
contract CopyrightApprove {
 
contract CopyrightApprove {
  
−
    party Owner {
+
    party Sub {
 +
 
 +
        organization: String
  
−
        name: String
+
        agreementId: String
  
 
    }
 
    }
第396行： 第380行：
 
    party Platform {
 
    party Platform {
  
−
        name: String
+
        marking(trigger: OrderState, text: String)
  
−
        targetMatch(Request)
+
        encrypt(trigger: OrderState)
−
 
 
−
        marking(text: String)
 
−
 
 
−
        encrypt()
 
  
 
    }
 
    }
  
 
    asset Resource {
 
    asset Resource {
−
 
−
        resourceId: String
 
  
 
        copyright: Boolean
 
        copyright: Boolean
第444行： 第422行：
 
    }
 
    }
  
−
    ## Type(match)
+
    enum OrderState {
  
−
    term policy_target: Platform must targetMatch(Request)
+
        Permit, Deny
  
−
        when ATTR(Request::Obj, copyright) = true
+
    }
  
−
          and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"
+
    combineAlgorithm = deny-overrides
  
−
        where return Permit
+
    ## Type(target)
  
−
    ## Type(comb)
+
    term policy_target: Platform must targetMatch(Request)
  
−
    term policy_comb: Sub can access Resource
+
        when ATTR(Request::Obj, copyright) = true
  
−
        when evalTerm(rule_target, Request) = Permit
+
          and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"
  
−
        where evalTerm(obligation_mark, Request) AND evalTerm(obligation_encrypt, Request)
+
    term rightsToUse: Sub can use Resource
−
 
 
−
          AND return Permit
 
−
 
 
−
    term rule_target: Sub can use Resource
 
  
 
        when ATTR(Request::Obj, ipOwner) = "Acme"
 
        when ATTR(Request::Obj, ipOwner) = "Acme"
  
−
          and  ATTR(Request::Sub, organization) = "Wiley Corp"
+
        where ATTR(Request::Sub, organization) = "Wiley Corp"
  
−
          and fn::string::oneAndOnly(ATTR(Request::Sub, agreementId)) =
+
          and oneAndOnly(ATTR(Request::Sub, agreementId)) =
  
−
              fn::string::oneAndOnly(ATTR(Request::Obj, agreementId))
+
              oneAndOnly(ATTR(Request::Obj, agreementId))
  
 
          and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"
 
          and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"
  
−
          and now >= fn::dateTime::oneAndOnly(ATTR(Request::Obj, effectiveDate))
+
          and now >= oneAndOnly(ATTR(Request::Obj, effectiveDate))
−
 
 
−
          and now < fn::dateTime::oneAndOnly(ATTR(Request::Obj, expirationDate))
 
  
−
        where return Permit
+
          and now < oneAndOnly(ATTR(Request::Obj, expirationDate))
  
−
    term obligation_mark: Platform must marking("Copyright 2011 Acme")
+
    ## Type(obligation)
  
−
        when true
+
    term policy_obligation: Platform must fulfillObligations(Request)
  
−
    term obligation_encrypt: Platform must encrypt()
+
        while marking(Permit, "Copyright 2011 Acme")
  
−
        when true
+
          and encrypt(Permit)
  
 
}
 
}
 
*
 
*

2026年9月4日 (五) 15:34的版本

<meta charset="utf-8" /> <meta property="mw:pageId" content="75" /> <meta property="mw:pageNamespace" content="0" />

<meta property="mw:revisionSHA1" content="6484283d6d9200fc6e16e86fda94ddc6c13a9b49" /> <meta property="dc:modified" content="2026-09-03T01:08:50.000Z" /> <meta property="mw:html:version" content="2.1.0" /> [1][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector] <meta http-equiv="content-language" content="zh-cn" /> <meta http-equiv="vary" content="Accept" />

概览

更新时间：2026.9.4

将语言最简化，去除了将combination逻辑中，使用evalterm和逻辑谓词表达的方法。理由：在没有ifelse的情况下，无法表达其中某种组合逻辑。obligation的选取完全无法脱离if-else完成。

成功转换了100+个从oasis官网获取的example

下一步安排：在方磊制作的网页上上传10个精选版（周五夜里）

下一步安排：寻找一些更复杂的例子（周五夜里）

下一步安排：精进栈式判决测试，完善例子的输入，寻找xacml执行器并进行对比，在确认正确后进行效率测试（周六）

一、基本结构

TODO


二、执行顺序：

（1）Target Term，只做资源级适用性判断，包含when逻辑并调用

（2）Authentic Term：在运行前临时进行变量赋值逻辑

when 条件

while 赋值

（3）rule_term

when：rule级target

where：condition

while：rule级obligation

(4) obligation_term：policy级的义务，在最后执行

使用while调用platform的函数

例1：sample6

来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/

原文：

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" 
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
   <Description>Test Or</Description>
   <Target></Target>
   <Rule Effect="Permit" RuleId="primary-group-emps-rule">  
      <Target>
         <AnyOf>
            <AllOf>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" 
                  Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
               </Match>
            </AllOf>
         </AnyOf>
      </Target>
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
            <AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" 
            Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Permit" RuleId="primary-user-rule"> 
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" 
            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="deny-rule"></Rule>
</Policy>

逻辑结构：

Policy (组合: first-applicable)

├── Target = 空

├── Rule1 (Permit)

│ ├── Target: action-id = read

│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集

├── Rule2 (Permit)

│ ├── Target: 无

│ └── Condition: resource-id 与 {http://localhost:8280/services/Customers/getVersion1, http://localhost:8280/services/Customers/getVersion2} 有交集

└── Rule3 (Deny) 兜底

原始请求等效json：

{
  "sub": {
    "subjectId": "anyone",
    "groups": []
  },
  "act": {
    "actionId": "read"
  },
  "obj": {
    "resourceId": "http://localhost:8280/services/Customers/getVersion1"
  }
}

转换版：

contract Sample6_RoleAccess {

    party Sub {

        subjectId: String

        groups: set String

    }

    asset Resource {

        resourceId: String

    }

    addition Request {

        Sub: Subject

        Obj: Resource

        Act: Action

    }

    addition fn {

        regexpMatch(value: String, pattern: String): Boolean

    }

    combineAlgorithm = first-applicable

    ## Type(target)

    term policy_target: Platform must targetMatch(Request)

    term primaryGroupEmpsRule: Sub can read Resource

        when ATTR(Request::Act, actionId) = "read"

        where ATTR(Request::Sub, groups) overlaps {"admin_emps", "admin"}

    term primaryUserRule: Sub can access Resource

        where ATTR(Request::Obj, resourceId) belong {

            "http://localhost:8280/services/Customers/getVersion1",

            "http://localhost:8280/services/Customers/getVersion2"

        }

    term denyRule: Sub cannot access Resource

}



例2：OASIS 3-4

来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502

语法：双target，有obligation

原文：

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="copyright-approve"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"
    Version="1">
    <Description>Example copyright material policy</Description>

    <!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant -->
    <Target>
        <AnyOf>
            <AllOf>
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue>
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/>
                </Match>
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue>
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/>
                </Match>
            </AllOf>
        </AnyOf>
    </Target>

    <!-- 规则级 Target：资源 ip-owner = Acme -->
    <Rule Effect="Permit" RuleId="Right to use copyrighted material match">
        <Description>Allow if subject's association to the designated custodian of the copyright agrees</Description>
        <Target>
            <AnyOf>
                <AllOf>
                    <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue>
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Match>
                </AllOf>
            </AnyOf>
        </Target>

        <!-- Condition：以下 5 个条件全部成立才 Permit -->
        <Condition>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                <!-- ① 请求方组织 = Wiley Corp -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ② 主体协议号 = 资源协议号 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ③ 资源被许可方 = Wiley Corp -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ④ 当前时间 >= 生效时间 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ⑤ 当前时间 < 过期时间 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                </Apply>
            </Apply>
        </Condition>
    </Rule>

    <!-- Permit 时要求 PEP：加标记 + 加密 -->
    <ObligationExpressions>
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit">
            <AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text">
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue>
            </AttributeAssignmentExpression>
        </ObligationExpression>
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/>
    </ObligationExpressions>
</Policy>

逻辑结构：

Policy copyright-approve (deny-overrides)

├── Target: resource:copyright = true

│           AND resource:agreement-type = urn:...:copyright-grant

└── Rule "Right to use copyrighted material match" (Permit)

|   ├── Target: resource:ip-owner = "Acme"

|   └── Condition (AND):

|       ├── subject:organization = "Wiley Corp"

|       ├── subject:agreement-id = resource:agreement-id

|       ├── resource:ip-licensee = "Wiley Corp"

|       ├── current-dateTime >= resource:effective-date

|       └── current-dateTime 小于 resource:expiration-date

└── Obligations (Permit):

    ├── marking(text = "Copyright 2011 Acme")

    └── encrypt

原始请求等效json：

 {
  "sub": {
    "organization": "Wiley Corp",
    "agreementId": "A-001"
  },
  "obj": {
    "copyright": true,
    "ipOwner": "Acme",
    "ipLicensee": "Wiley Corp",
    "agreementType": "urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant",
    "agreementId": "A-001",
    "effectiveDate": "2020-01-01T00:00:00",
    "expirationDate": "2030-01-01T00:00:00"
  },
  "act": {
    "actionId": "use"
  },
  "env": {
    "currentDateTime": "2024-06-01T12:00:00"
  }
}

转换版：

contract CopyrightApprove {

    party Sub {

        organization: String

        agreementId: String

    }

    party Platform {

        marking(trigger: OrderState, text: String)

        encrypt(trigger: OrderState)

    }

    asset Resource {

        copyright: Boolean

        agreementType: String

        ipOwner: String

        ipLicensee: String

        agreementId: String

        effectiveDate: dateTime

        expirationDate: dateTime

    }

    addition Request {

        Sub: Subject

        Obj: Resource

        Act: Action

    }

    addition fn {

        oneAndOnly(x: String): String

        oneAndOnly(x: dateTime): dateTime

    }

    enum OrderState {

        Permit, Deny

    }

    combineAlgorithm = deny-overrides

    ## Type(target)

    term policy_target: Platform must targetMatch(Request)

        when ATTR(Request::Obj, copyright) = true

          and ATTR(Request::Obj, agreementType) = "urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant"

    term rightsToUse: Sub can use Resource

        when ATTR(Request::Obj, ipOwner) = "Acme"

        where ATTR(Request::Sub, organization) = "Wiley Corp"

          and oneAndOnly(ATTR(Request::Sub, agreementId)) =

              oneAndOnly(ATTR(Request::Obj, agreementId))

          and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"

          and now >= oneAndOnly(ATTR(Request::Obj, effectiveDate))

          and now < oneAndOnly(ATTR(Request::Obj, expirationDate))

    ## Type(obligation)

    term policy_obligation: Platform must fulfillObligations(Request)

        while marking(Permit, "Copyright 2011 Acme")

          and encrypt(Permit)

}

取自“https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&oldid=547”