如何解决复杂权限管理难题，使用SprykerAuthorization模块构建灵活可扩展的授权系统

<code class="bash">composer require spryker/authorization</code>

<pre class="brush:php;toolbar:false;"><?php

use Spryker\Shared\AuthorizationExtension\Dependency\Plugin\AuthorizationStrategyPluginInterface;
use Spryker\Transfer\Authorization\AuthorizationRequestTransfer;
use Spryker\Transfer\Authorization\AuthorizationResponseTransfer;
use Spryker\Transfer\Authorization\AuthorizationIdentityTransfer;
use Spryker\Transfer\Authorization\AuthorizationEntityTransfer;

// 假设我们有一个授权策略，检查用户是否是订单的拥有者
class OrderOwnerAuthorizationStrategy implements AuthorizationStrategyPluginInterface
{
    public function getName(): string
    {
        return 'OrderOwner';
    }

    public function authorize(AuthorizationRequestTransfer $authorizationRequestTransfer): AuthorizationResponseTransfer
    {
        $identity = $authorizationRequestTransfer->getAuthorizationIdentity();
        $entity = $authorizationRequestTransfer->getAuthorizationEntity();

        // 假设 identity 和 entity 都有 getIdentifier() 方法来获取ID
        $userId = $identity->getIdentifier(); // 当前用户ID
        $orderId = $entity->getIdentifier(); // 目标订单ID

        // 实际业务逻辑：从数据库获取订单，检查订单的 user_id 是否等于当前用户ID
        // 例如：
        // $order = $this->orderRepository->findById($orderId);
        // if ($order && $order->getUserId() === $userId) {
        //     return (new AuthorizationResponseTransfer())->setIsGranted(true);
        // }

        // 为了示例，我们假设用户ID为1可以访问订单ID为100的订单
        if ($userId === 1 && $orderId === 100) {
             return (new AuthorizationResponseTransfer())->setIsGranted(true);
        }

        return (new AuthorizationResponseTransfer())->setIsGranted(false);
    }
}

// --- 在应用中如何使用 ---

// 假设当前用户ID是1，要检查订单ID为100的权限
$currentUserIdentity = (new AuthorizationIdentityTransfer())->setIdentifier(1);
$targetOrderEntity = (new AuthorizationEntityTransfer())->setIdentifier(100);

$request = (new AuthorizationRequestTransfer())
    ->setAuthorizationIdentity($currentUserIdentity)
    ->setAuthorizationEntity($targetOrderEntity);

// 假设我们有一个授权服务，可以根据名称获取并执行策略
// 在实际Spryker项目中，这会通过依赖注入和工厂模式来完成
// $authorizationService = $this->getLocator()->authorization()->service();
// $response = $authorizationService->authorizeByName('OrderOwner', $request);

// 简化示例，直接调用策略
$strategy = new OrderOwnerAuthorizationStrategy();
$response = $strategy->authorize($request);

if ($response->getIsGranted()) {
    echo "用户有权访问该订单。\n";
} else {
    echo "用户无权访问该订单。\n";
}

// 尝试一个无权访问的场景
$currentUserIdentity = (new AuthorizationIdentityTransfer())->setIdentifier(2); // 另一个用户
$request->setAuthorizationIdentity($currentUserIdentity);
$response = $strategy->authorize($request);

if ($response->getIsGranted()) {
    echo "用户有权访问该订单。\n";
} else {
    echo "用户无权访问该订单。\n"; // 输出：用户无权访问该订单。
}