企业级 AI Agent 行列级动态数据权限裁剪与细粒度访问控制实战：破解复杂组织越权查询、虚拟视图注入与大模型跨域泄露

/**
 * 百信企业级 AI Agent 数据行列级细粒度安全治理中间件
 * 实现了基于 ABAC 属性访问控制的策略决策（PDP）与 AST 强制谓词下推执行点（PEP）
 */

// 用户与会话安全上下文契约接口定义
export interface SecurityContext {
  userId: string;                     // 用户唯一业务标识
  tenantId: string;                   // 企业租户唯一标识
  userRole: 'admin' | 'manager' | 'analyst' | 'operator'; // 宏观角色
  departmentId: string;               // 所属部门编码
  accessibleOrgPaths: string[];       // 允许访问的组织架构树路径分支列表
  dataClearanceLevel: number;         // 涉密安全等级：1(公开), 2(内部), 3(机密), 4(绝密)
}

// 列级访问控制规则配置
export interface ColumnSecurityRule {
  tableName: string;                  // 目标数据表名
  restrictedColumns: {
    columnName: string;               // 受控字段名
    minRequiredLevel: number;         // 访问所需的最低密级
    allowedRoles: string[];           // 允许访问的角色列表
    maskStrategy: 'DROP' | 'MASK' | 'BUCKET'; // 阻断策略：直接剔除、保形掩码、区间分桶
  }[];
}

// 行级数据范围过滤约束定义
export interface RowScopingConstraint {
  targetTable: string;                // 目标表名
  enforcedWhereCondition: string;     // 强制注入的 WHERE 过滤 SQL 表达式
  kAnonymityMinRows: number;          // 最小聚合防差分行数阈值
}

/**
 * 策略决策点（PDP, Policy Decision Point）
 * 根据用户上下文与目标业务实体，动态计算出当前操作允许的行列级安全契约
 */
export class PolicyDecisionPoint {
  // 模拟企业安全策略中心存储的列级策略库
  private columnRules: Map<string, ColumnSecurityRule> = new Map([
    [
      'sales_orders',
      {
        tableName: 'sales_orders',
        restrictedColumns: [
          { columnName: 'cost_price', minRequiredLevel: 3, allowedRoles: ['admin', 'manager'], maskStrategy: 'DROP' },
          { columnName: 'profit_margin', minRequiredLevel: 3, allowedRoles: ['admin', 'manager'], maskStrategy: 'DROP' },
          { columnName: 'customer_phone', minRequiredLevel: 2, allowedRoles: ['admin', 'manager', 'analyst'], maskStrategy: 'MASK' }
        ]
      }
    ],
    [
      'employees',
      {
        tableName: 'employees',
        restrictedColumns: [
          { columnName: 'base_salary', minRequiredLevel: 4, allowedRoles: ['admin'], maskStrategy: 'DROP' },
          { columnName: 'performance_score', minRequiredLevel: 3, allowedRoles: ['admin', 'manager'], maskStrategy: 'BUCKET' }
        ]
      }
    ]
  ]);

  /**
   * 动态计算目标表的行级安全过滤谓词
   * 将用户的组织机构路径、租户与权限转换为确定性的 SQL 过滤表达式
   */
  public resolveRowScoping(ctx: SecurityContext, tableName: string): RowScopingConstraint {
    // 租户隔离为全局不可动摇的最高铁律
    const tenantCondition = `tenant_id = '${ctx.tenantId.replace(/'/g, "''")}'`;

    // 管理员在当前租户内拥有全局行级可见性
    if (ctx.userRole === 'admin') {
      return {
        targetTable: tableName,
        enforcedWhereCondition: tenantCondition,
        kAnonymityMinRows: 1
      };
    }

    // 普通员工与经理仅能查看其已授权的组织机构分支数据
    const orgPathConditions = ctx.accessibleOrgPaths
      .map(path => `org_path LIKE '${path.replace(/'/g, "''")}%'`)
      .join(' OR ');

    const combinedCondition = `${tenantCondition} AND (${orgPathConditions || '1=0'})`;

    return {
      targetTable: tableName,
      enforcedWhereCondition: combinedCondition,
      kAnonymityMinRows: 5 // 非管理员启用防差分聚合阈值保护
    };
  }

  /**
   * 计算指定表的受限列清单及对该用户的处置策略
   */
  public resolveColumnScoping(ctx: SecurityContext, tableName: string): Map<string, 'DROP' | 'MASK' | 'BUCKET'> {
    const actionMap = new Map<string, 'DROP' | 'MASK' | 'BUCKET'>();
    const rule = this.columnRules.get(tableName.toLowerCase());
    if (!rule) return actionMap;

    for (const col of rule.restrictedColumns) {
      const hasClearance = ctx.dataClearanceLevel >= col.minRequiredLevel;
      const hasRole = col.allowedRoles.includes(ctx.userRole);

      // 若密级或角色不符，则实施策略指定的裁剪动作
      if (!hasClearance || !hasRole) {
        actionMap.set(col.columnName.toLowerCase(), col.maskStrategy);
      }
    }

    return actionMap;
  }
}

/**
 * 策略执行点（PEP, Policy Enforcement Point）
 * 包含 SQL AST 语法树遍历重写与 REST 响应体虚拟投影
 */
export class PolicyEnforcementPoint {
  constructor(private pdp: PolicyDecisionPoint) {}

  /**
   * 基于简易 AST 语义的 SQL 强制安全改写（针对 Text-to-SQL 工具调用）
   * 严格解析 SELECT 表名、别名，并将 RLS 安全谓词精准注入到 WHERE 子句最前沿
   */
  public rewriteSqlWithRowSecurity(rawSql: string, ctx: SecurityContext, targetTable: string): string {
    const scoping = this.pdp.resolveRowScoping(ctx, targetTable);
    const trimmedSql = rawSql.trim();

    // 正则提取目标表的别名（支持 orders AS o 或 orders o 模式）
    const aliasPattern = new RegExp(`\\b${targetTable}\\b(?:\\s+AS)?\\s+([a-zA-Z0-9_]+)`, 'i');
    const aliasMatch = trimmedSql.match(aliasPattern);
    const tableIdentifier = aliasMatch ? aliasMatch[1] : targetTable;

    // 将注入谓词中的字段绑定至当前活跃表别名（例如 tenant_id -> o.tenant_id）
    const qualifiedCondition = scoping.enforcedWhereCondition
      .replace(/\btenant_id\b/g, `${tableIdentifier}.tenant_id`)
      .replace(/\borg_path\b/g, `${tableIdentifier}.org_path`);

    // 检查 SQL 中是否已有 WHERE 子句
    const whereRegex = /\bWHERE\b/i;
    if (whereRegex.test(trimmedSql)) {
      // 在原 WHERE 条件前以最高逻辑优先级注入安全谓词：WHERE (enforced_conditions) AND (original_conditions)
      return trimmedSql.replace(whereRegex, `WHERE (${qualifiedCondition}) AND `);
    }

    // 若无 WHERE，在 ORDER BY / GROUP BY / LIMIT / 分号之前插入 WHERE 约束
    const clauseRegex = /\b(GROUP\s+BY|HAVING|ORDER\s+BY|LIMIT)\b|;?$/i;
    const match = trimmedSql.match(clauseRegex);
    if (match && match.index !== undefined) {
      const insertIndex = match.index;
      const prefix = trimmedSql.slice(0, insertIndex).trim();
      const suffix = trimmedSql.slice(insertIndex);
      return `${prefix} WHERE (${qualifiedCondition}) ${suffix}`.trim();
    }

    return `${trimmedSql} WHERE (${qualifiedCondition})`;
  }

  /**
   * 面向 REST API 响应数据的动态虚拟投影（Dynamic Virtual Projection）
   * 将未授权列从结果对象数组中剔除或执行掩码替换，彻底杜绝数据回流至大模型 Prompt
   */
  public sanitizeResponsePayload<T extends Record<string, any>>(
    dataList: T[],
    ctx: SecurityContext,
    tableName: string
  ): Record<string, any>[] {
    const columnActions = this.pdp.resolveColumnScoping(ctx, tableName);
    if (columnActions.size === 0) return dataList;

    return dataList.map(record => {
      const sanitized: Record<string, any> = { ...record };

      for (const [columnName, strategy] of columnActions.entries()) {
        if (columnName in sanitized) {
          switch (strategy) {
            case 'DROP':
              delete sanitized[columnName]; // 物理剔除，大模型彻底不可见
              break;
            case 'MASK':
              sanitized[columnName] = this.maskFormatPreserving(sanitized[columnName]);
              break;
            case 'BUCKET':
              sanitized[columnName] = this.bucketNumericValue(sanitized[columnName]);
              break;
          }
        }
      }

      return sanitized;
    });
  }

  // 保形掩码辅助实现（保留前后字符，掩码核心识别区）
  private maskFormatPreserving(val: any): string {
    if (typeof val !== 'string') return '***';
    if (val.length <= 4) return '***';
    return `${val.slice(0, 3)}****${val.slice(-4)}`;
  }

  // 数值分桶泛化实现（防差分攻击）
  private bucketNumericValue(val: any): string {
    const num = Number(val);
    if (isNaN(num)) return '区间未知';
    if (num < 5000) return '< 5k';
    if (num <= 10000) return '5k-10k';
    if (num <= 20000) return '10k-20k';
    return '> 20k';
  }
}

// 模拟测试断言验证逻辑
export function verifySecurityEnforcement() {
  const pdp = new PolicyDecisionPoint();
  const pep = new PolicyEnforcementPoint(pdp);

  // 模拟一线销售员用户上下文
  const operatorContext: SecurityContext = {
    userId: 'U-7890',
    tenantId: 'TENANT-SH-01',
    userRole: 'operator',
    departmentId: 'DEP-SALES-EAST',
    accessibleOrgPaths: ['/corp/east/team_a'],
    dataClearanceLevel: 1
  };

  // 1. 测试 SQL 谓词强制注入与表别名适配
  const rawSql = 'SELECT o.order_id, o.cost_price, o.customer_phone FROM sales_orders o WHERE o.status = "COMPLETED"';
  const rewrittenSql = pep.rewriteSqlWithRowSecurity(rawSql, operatorContext, 'sales_orders');

  console.log('改写后的安全 SQL:', rewrittenSql);

  // 2. 测试返回数据列级物理剥离与脱敏
  const rawData = [
    { order_id: 'SO-101', cost_price: 450.0, profit_margin: 0.25, customer_phone: '13812345678', amount: 600.0 }
  ];
  const sanitized = pep.sanitizeResponsePayload(rawData, operatorContext, 'sales_orders');

  console.log('脱敏后的干净数据 (送入 LLM):', JSON.stringify(sanitized, null, 2));
}