Redis权限异常深度剖析：从NOPERM错误到KEYS命令的生产环境救赎

2025-08-25 11:09:14.606 ERROR c.m.o.s.f.i.TestServiceImpl - 获取media:toIssue:下的媒体广告位时发生异常: NOPERM no permission to execute the command 'KEYS'; nested exception is redis.clients.jedis.exceptions.JedisAccessControlException: NOPERM no permission to execute the command 'KEYS'
org.springframework.dao.InvalidDataAccessApiUsageException: NOPERM no permission to execute the command 'KEYS'; nested exception is redis.clients.jedis.exceptions.JedisAccessControlException: NOPERM no permission to execute the command 'KEYS'
        at org.springframework.data.redis.connection.jedis.JedisExceptionConverter.convert(JedisExceptionConverter.java:69)
        at org.springframework.data.redis.connection.jedis.JedisExceptionConverter.convert(JedisExceptionConverter.java:42)
        ... (长长的调用栈指向了你熟悉的业务代码文件)
        at com.middle.orm.service.flow.impl.TestServiceImpl.issueFlow(TestServiceImpl.java:1008)

ACL LIST

1) "user default on #xxx...xxx ~* &* +@all"
2) "user appuser on #yyy...yyy ~* &* -@all +get +set +hget +hset ..."

ACL SETUSER appuser +keys

ACL SETUSER appuser +@dangerous

// TestServiceImpl.java @ line 1008
// 这是导致NOPERM错误的根源
Set<String> keys = redisTemplate.keys("media:toIssue:*");
// ... 后续对keys集合的操作

// TestServiceImpl.java

// 使用SCAN操作安全地迭代匹配的键
public Set<String> safeKeys(String pattern) {
    // 创建扫描选项，匹配模式并设置每次迭代数量
    ScanOptions options = ScanOptions.scanOptions()
            .match(pattern)
            .count(100) // 根据实际情况调整，不宜过小或过大
            .build();
    
    // 使用try-with-resources确保Cursor被正确关闭，防止资源泄漏
    try (Cursor<String> cursor = redisTemplate.scan(options)) {
        Set<String> result = new HashSet<>();
        while (cursor.hasNext()) {
            result.add(cursor.next());
        }
        return result;
    } catch (IOException e) {
        // 处理异常，通常可以包装为运行时异常抛出
        throw new RuntimeException("Error during SCAN operation", e);
    }
}

// 在原来的业务方法中调用
public void someBusinessMethod() {
    // ... 其他逻辑
    Set<String> keys = safeKeys("media:toIssue:*");
    // ... 使用keys进行后续操作
}

@Component
public class MediaToIssueService {

    @Autowired
    private RedisTemplate<String, String> redisTemplate;

    private static final String MEDIA_TO_ISSUE_PREFIX = "media:toIssue:";
    private static final String MEDIA_TO_ISSUE_INDEX = "index:media:toIssue";

    /
     * 创建一个新的mediaToIssue数据，并维护索引
     * @param id 业务ID
     * @param value 存储的值
     */
    public void createMediaToIssue(String id, String value) {
        String key = MEDIA_TO_ISSUE_PREFIX + id;
        // 1. 使用事务或Pipeline保证原子性（可选，但推荐）
        redisTemplate.opsForValue().set(key, value);
        // 2. 将该键添加到索引集合中
        redisTemplate.opsForSet().add(MEDIA_TO_ISSUE_INDEX, key);
    }

    /
     * 删除一个mediaToIssue数据，并清理索引
     * @param id 业务ID
     */
    public void deleteMediaToIssue(String id) {
        String key = MEDIA_TO_ISSUE_PREFIX + id;
        redisTemplate.delete(key);
        redisTemplate.opsForSet().remove(MEDIA_TO_ISSUE_INDEX, key);
    }

    /
     * 安全地获取所有mediaToIssue的键
     * @return 所有键的集合
     */
    public Set<String> getAllMediaToIssueKeys() {
        // 直接获取Set中的所有成员，性能极高且安全
        return redisTemplate.opsForSet().members(MEDIA_TO_ISSUE_INDEX);
    }
}