OpenClaw 权限管理：细粒度的访问控制

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

roles:
  admin:
    permissions:
      - sessions:*
      - skills:*
      - config:*
      - users:*
      
  developer:
    permissions:
      - sessions:create
      - sessions:read
      - skills:load
      - skills:execute
      
  user:
    permissions:
      - sessions:create
      - sessions:read:own
      - skills:execute:safe

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

function checkPermission(user, action, resource) {
  const userRoles = user.roles;
  
  for (const role of userRoles) {
    const roleDef = roles[role];
    
    if (roleDef.permissions.includes('*')) return true;
    if (roleDef.permissions.includes(action)) return true;
    if (roleDef.permissions.includes(`${action}:${resource}`)) return true;
  }
  
  return false;
}

1
2
3
4
5
6
7

// 检查权限
if (!checkPermission(user, 'skills:load', 'filesystem')) {
  throw new Error('权限不足');
}

// 执行技能
await skills.load('filesystem');