Installation

  1. go get github.com/casbin/casbin/v2

New a Casbin enforcer

The new a Casbin enforcer must provide a Model and a Adapter.
Casbin has a FileAdapter, see Adapter from more Adapter.

  1. import "github.com/casbin/casbin/v2"
  3. e, err := casbin.NewEnforcer("path/to/model.conf", "path/to/policy.csv")

注意：上面提到的适配器adapter指的是 policy。

  • Use the Model text with other Adapter:
  1. import (
  2.     "log"
  4.     "github.com/casbin/casbin/v2"
  5.     "github.com/casbin/casbin/v2/model"
  6.     xormadapter "github.com/casbin/xorm-adapter/v2"
  7.     _ "github.com/go-sql-driver/mysql"
  8. )
  10. // Initialize a Xorm adapter with MySQL database.
  11. a, err := xormadapter.NewAdapter("mysql", "mysql_username:mysql_password@tcp(127.0.0.1:3306)/casbin")
  12. if err != nil {
  13.     log.Fatalf("error: adapter: %s", err)
  14. }
  16. m, err := model.NewModelFromString(`
  17. [request_definition]
  18. r = sub, obj, act
  20. [policy_definition]
  21. p = sub, obj, act
  23. [policy_effect]
  24. e = some(where (p.eft == allow))
  26. [matchers]
  27. m = r.sub == p.sub && r.obj == p.obj && r.act == p.act
  28. `)
  29. if err != nil {
  30.     log.Fatalf("error: model: %s", err)
  31. }
  33. e, err := casbin.NewEnforcer(m, a)
  34. if err != nil {
  35.     log.Fatalf("error: enforcer: %s", err)
  36. }

Check permissions

Add an enforcement hook into your code right before the access happens:

  1. sub := "alice" // the user that wants to access a resource.
  2. obj := "data1" // the resource that is going to be accessed.
  3. act := "read" // the operation that the user performs on the resource.
  5. ok, err := e.Enforce(sub, obj, act)
  7. if err != nil {
  8.     // handle err
  9. }
  11. if ok == true {
  12.     // permit alice to read data1
  13. } else {
  14.     // deny the request, show an error
  15. }

Casbin also provides API for permission management at run-time. For example, You can get all the roles assigned to a user as below:

  1. roles := e.GetRolesForUser("alice")

See Management API and RBAC API for more usage.
Please refer to the test cases for more usage.