MemberContract 合约调用

initMemberAttr

MemberAttrCmd Arg : 
 "{"age":30,"level":5,"roles":["Admin"]}" 

peer chaincode invoke -d -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n data-access-control-chaincode --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"org.hepeng.dac.chaincode.contract.MemberContract:initMemberAttr","Args":["{"age":30,"level":5,"roles":["Admin"]}"]}'

updateMemberAttr


MemberAttrCmd Arg : 
 "{"age":30,"level":9999,"roles":["Admin","VIP","SVIP"]}" 

peer chaincode invoke -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n data-access-control-chaincode --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"org.hepeng.dac.chaincode.contract.MemberContract:updateMemberAttr","Args":[ "{"age":30,"level":9999,"roles":["Admin","VIP","SVIP"]}"  ]}'

getMemberAttr

peer chaincode query -C mychannel -n data-access-control-chaincode -c '{"function":"org.hepeng.dac.chaincode.contract.MemberContract:getMemberAttr", "Args":[""]}'

DataContract 合约调用

saveData

DataCmd Arg : 
 "{"key":"data-3","payload":"{\"xx\":\"dadsd\",\"ws\":\"dasdnaksdasjkd38\"}"}" 

DataAttrCmd Arg : 
 "{"level":5,"readers":["reader-member-key-1","reader-member-key-2"],"writers":["writer-member-key-1"]}" 

DacPolicyCmdArray Arg : 
 "[{"ageExpression":"clientMemberLevel>30","closeTimestamp":1662736374000,"levelExpression":"clientMemberAge>3","location":"上海","openTimestamp":1649427174000,"policyKey":"DACPolicy-1","roles":["Admin","VIP"]},{"ageExpression":"clientMemberLevel>19","closeTimestamp":1662736374000,"levelExpression":"clientMemberAge>3","location":"伦敦","openTimestamp":1649427174000,"policyKey":"DACPolicy-2","roles":["Admin","VIP"]}]" 


peer chaincode invoke -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n data-access-control-chaincode --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:saveData","Args":["{"key":"data-3","payload":"{\"xx\":\"dadsd\",\"ws\":\"dasdnaksdasjkd38\"}"}" , "{"level":5,"readers":["reader-member-key-1","reader-member-key-2"],"writers":["writer-member-key-1"]}" , "[{"ageExpression":"clientMemberLevel>30","closeTimestamp":1662736374000,"levelExpression":"clientMemberAge>3","location":"上海","openTimestamp":1649427174000,"policyKey":"Policy-1","roles":["Admin","VIP"]},{"ageExpression":"clientMemberLevel>19","closeTimestamp":1662736374000,"levelExpression":"clientMemberAge>3","location":"伦敦","openTimestamp":1649427174000,"policyKey":"Policy-2","roles":["Admin","VIP"]}]"  ]}'

getData

DataQuery Arg : 
 "{"envArg":{"location":"伊斯坦布尔","time":1649588888836},"key":"data-1"}" 

peer chaincode query -C mychannel -n data-access-control-chaincode -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:getData", "Args":[ "{"envArg":{"location":"伊斯坦布尔","time":1649587484310},"key":"data-1"}" ]}'

updateData


DataCmd Arg : 
 "{"key":"data-3","payload":"{\"security\":\"CAS\",\"project leader\":\"Eren Jaeger\",\"service mesh\":\"istio\",\"MQ\":\"rabbitMQ\",\"blockchain\":\"fabric\",\"web\":\"react\",\"lang\":\"golang\",\"DB\":\"TiDB\",\"web server\":\"nginx\"}"}" 

EnvArg Arg : 
 "{"location":"芝加哥","time":1649589093730}" 

peer chaincode invoke -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n data-access-control-chaincode --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:updateData","Args":[  "{"key":"data-3","payload":"{\"security\":\"CAS\",\"project leader\":\"Eren Jaeger\",\"service mesh\":\"istio\",\"MQ\":\"rabbitMQ\",\"blockchain\":\"fabric\",\"web\":\"react\",\"lang\":\"golang\",\"DB\":\"TiDB\",\"web server\":\"nginx\"}"}" ,  "{"location":"芝加哥","time":1649589093730}" ]}'

getDataAttr


dataKey Arg : "data-3"

peer chaincode query -C mychannel -n data-access-control-chaincode -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:getDataAttr", "Args":[ "data-3" ]}'

updateDataAttr


dataKey Arg : "data-3"

DataAttrCmd Arg : 
 "{"level":66,"readers":["writer-member-key-1","writer-member-key-2","writer-member-key-3"],"writers":["reader-member-key-1","reader-member-key-2","reader-member-key-3"]}" 


peer chaincode invoke -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n data-access-control-chaincode --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:updateDataAttr","Args":[ "data-3" , "{"level":66,"readers":["writer-member-key-1","writer-member-key-2","writer-member-key-3"],"writers":["reader-member-key-1","reader-member-key-2","reader-member-key-3"]}"  ]}'

getDataAllPolicy


dataKey Arg : "data-3"

peer chaincode query -C mychannel -n data-access-control-chaincode -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:getDataAllPolicy", "Args":[ "data-3" ]}'

getDataPolicies

DACPolicyQuery Arg : 
 "{"dataKey":"data-3","policyKeys":["DACPolicy-2","DACPolicy-678","DACPolicy-3"]}" 

peer chaincode query -C mychannel -n data-access-control-chaincode -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:getDataAllPolicy", "Args":[ "{"dataKey":"data-3","policyKeys":["DACPolicy-2","DACPolicy-678","DACPolicy-3"]}"  ]}'

updateDACPolicy

dataKey Arg : "data-3"

DACPolicyCmd Arg : 
 "[{"ageExpression":"clientMemberLevel>30","closeTimestamp":1649593264084,"levelExpression":"clientMemberAge>3","location":"东京","openTimestamp":1649593264084,"policyKey":"DACPolicy-1","roles":["Admin","VIP"]},{"ageExpression":"clientMemberLevel>19","closeTimestamp":1649593264084,"levelExpression":"clientMemberAge>3","location":"洛杉矶","openTimestamp":1649593264084,"policyKey":"DACPolicy-2","roles":["Admin","VIP"]}]" 

peer chaincode invoke -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n data-access-control-chaincode --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:updateDACPolicy","Args":[ "data-3" ,  "[{"ageExpression":"clientMemberLevel>30","closeTimestamp":1649593264084,"levelExpression":"clientMemberAge>3","location":"东京","openTimestamp":1649593264084,"policyKey":"DACPolicy-1","roles":["Admin","VIP"]},{"ageExpression":"clientMemberLevel>19","closeTimestamp":1649593264084,"levelExpression":"clientMemberAge>3","location":"洛杉矶","openTimestamp":1649593264084,"policyKey":"DACPolicy-2","roles":["Admin","VIP"]}]"  ]}'

removeDACPolicy


RemoveDACPolicyCmd Arg : 
 "{"dataKey":"data-3","policyKeys":["DACPolicy-1"]}" 

peer chaincode invoke -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n data-access-control-chaincode --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:removeDACPolicy","Args":[  "{"dataKey":"data-3","policyKeys":["DACPolicy-1"]}"  ]}'

测试数据访问策略

调用账号换成 Org1 User1 账号调用

export CORE_PEER_LOCALMSPID="Org1MSP"
export CORE_PEER_MSPCONFIGPATH=${PWD}/organizations/peerOrganizations/org1.example.com/users/User1@org1.example.com/msp
export CORE_PEER_TLS_ROOTCERT_FILE=${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt
export CORE_PEER_ADDRESS=localhost:7051

初始化 User1 成员属性

MemberAttrCmd Arg : 
 "{"age":30,"level":2,"roles":["User"]}" 

peer chaincode invoke -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n data-access-control-chaincode --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"org.hepeng.dac.chaincode.contract.MemberContract:initMemberAttr","Args":["{"age":30,"level":1,"roles":["User"]}"]}'

调用 getData

DataQuery Arg : 
 "{"envArg":{"location":"伊斯坦布尔","time":1649596234054},"key":"data-3"}" 

peer chaincode query -C mychannel -n data-access-control-chaincode -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:getData", "Args":[ "{"envArg":{"location":"伊斯坦布尔","time":1649596234054},"key":"data-3"}" ]}'

响应：

[root@localhost test-network]# peer chaincode query -C mychannel -n data-access-control-chaincode -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:getData", "Args":[ "{\"envArg\":{\"location\":\"伊斯坦布尔\",\"time\":1649596234054},\"key\":\"data-1\"}" ]}'
{"msg":"Access Denied:访问角色检查未通过"}

给 User1 赋予 VIP 角色，调用 updateMemberAttr


MemberAttrCmd Arg : 
 "{"age":30,"level":9999,"roles":["User" ,"VIP"]}" 

peer chaincode invoke -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n data-access-control-chaincode --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"org.hepeng.dac.chaincode.contract.MemberContract:updateMemberAttr","Args":[ "{"age":30,"level":9999,"roles":["User","VIP"]}"  ]}'

User1 具有了 "VIP" 角色

再次调用 getData

DataQuery Arg : 
 "{"envArg":{"location":"伊斯坦布尔","time":1649597275808},"key":"data-3"}" 

peer chaincode query -C mychannel -n data-access-control-chaincode -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:getData", "Args":[ "{"envArg":{"location":"伊斯坦布尔","time":1649597275808},"key":"data-3"}" ]}'

响应：

[root@localhost test-network]# peer chaincode query -C mychannel -n data-access-control-chaincode -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:getData", "Args":[ "{\"envArg\":{\"location\":\"伊斯坦布尔\",\"time\":1649596234054},\"key\":\"data-3\"}" ]}'
{"msg":"Access Denied:访问地点检查未通过"}

修改参数 location 后调用：



peer chaincode query -C mychannel -n data-access-control-chaincode -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:getData", "Args":[ "{"envArg":{"location":"上海","time":1649597275808},"key":"data-3"}" ]}'

测试访问数据读写集合

给 "data-3" 数据的读写集合增加 User1 成员

切换到 Org1 Admin 账号调用

export CORE_PEER_LOCALMSPID="Org1MSP"
export CORE_PEER_MSPCONFIGPATH=${PWD}/organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp
export CORE_PEER_TLS_ROOTCERT_FILE=${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt
export CORE_PEER_ADDRESS=localhost:7051

测试网络下 User1 成员的 key : org.hepeng.dac.chaincode.data.MemberAttr:Org1MSP:x509::CN=User1@org1.example.com, OU=client, L=San Francisco, ST=California, C=US::CN=ca.org1.example.com, O=org1.example.com, L=San Francisco, ST=California, C=US

增加读集合：


peer chaincode invoke -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n data-access-control-chaincode --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:updateDataAttr","Args":[ "data-3" , "{"level":66,"readers":["org.hepeng.dac.chaincode.data.MemberAttr:Org1MSP:x509::CN=User1@org1.example.com, OU=client, L=San Francisco, ST=California, C=US::CN=ca.org1.example.com, O=org1.example.com, L=San Francisco, ST=California, C=US" , "reader-member-key-1","reader-member-key-2","reader-member-key-3"],"writers":["writers-member-key-1","writers-member-key-2","writers-member-key-3"]}"  ]}'

调用 updateData 更新数据：


DataCmd Arg : 
 "{"key":"data-3","payload":"{\"security\":\"Spring Security\",\"project leader\":\"Eren Jaeger\",\"service mesh\":\"istio\",\"MQ\":\"rabbitMQ\",\"blockchain\":\"fabric\",\"web\":\"react\",\"lang\":\"golang\",\"DB\":\"TiDB\",\"web server\":\"nginx\"}"}" 

# 故意修改为不满足访问策略的 location
EnvArg Arg : 
 "{"location":"东京","time":1649596234054}" 

peer chaincode invoke -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n data-access-control-chaincode --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"org.hepeng.dac.chaincode.contract.DataContract:updateData","Args":[  "{"key":"data-3","payload":"{\"security\":\"Spring Security\",\"project leader\":\"Eren Jaeger\",\"service mesh\":\"istio\",\"MQ\":\"rabbitMQ\",\"blockchain\":\"fabric\",\"web\":\"react\",\"lang\":\"golang\",\"DB\":\"TiDB\",\"web server\":\"nginx\"}"}" ,  "{"location":"东京","time":1649596234054}" ]}'

日志内容：

15:06:29.565 [fabric-txinvoke:3] INFO  o.h.d.chaincode.contract.ACSentinel - 请求者身份未通过读写身份集合验证进行访问策略判定 , client identity member key org.hepeng.dac.chaincode.data.MemberAttr:Org1MSP:x509::CN=User1@org1.example.com, OU=client, L=San Francisco, ST=California, C=US::CN=ca.org1.example.com, O=org1.example.com, L=San Francisco, ST=California, C=US

响应：

2022-04-10 11:06:29.595 EDT 0001 INFO [chaincodeCmd] chaincodeInvokeOrQuery -> Chaincode invoke successful. result: status:200 payload:"{"msg":"Access Denied:\350\256\277\351\227\256\345\234\260\347\202\271\346\243\200\346\237\245\346\234\252\351\200\232\350\277\207"}"

写操作被拒绝，把 User1 增加到 data-3 写集合中：