RBAC API

一个更友好的RBAC API。 这个API是Management API的子集。 RBAC用户可以使用这个API来简化代码。

参考

全局变量 e 是 Enforcer 实例。

Go

e, err := NewEnforcer("examples/rbac_model.conf", "examples/rbac_policy.csv")

Node.js

const e = await newEnforcer('examples/rbac_model.conf', 'examples/rbac_policy.csv')

PHP

$e = new Enforcer('examples/rbac_model.conf', 'examples/rbac_policy.csv');

Python

e = casbin.Enforcer("examples/rbac_model.conf", "examples/rbac_policy.csv")

.NET

var e = new Enforcer("path/to/model.conf", "path/to/policy.csv");

Rust

let mut e = Enforcer::new("examples/rbac_model.conf", "examples/rbac_policy.csv").await?;

Java

Enforcer e = new Enforcer("examples/rbac_model.conf", "examples/rbac_policy.csv");

GetRolesForUser()

GetRolesForUser 获取用户具有的角色。

例如:

Go

res := e.GetRolesForUser("alice")

Node.js

const res = await e.getRolesForUser('alice')

PHP

$res = $e->getRolesForUser("alice");

Python

roles = e.get_roles_for_user("alice")

.NET

var res = e.GetRolesForUser("alice");

Rust

let roles = e.get_roles_for_user("alice", None); // 无域

Java

List<String> res = e.getRolesForUser("alice");

GetUsersForRole()

GetUsersForRole 获取具有角色的用户。

例如:

Go

res := e.GetUsersForRole("data1_admin")

Node.js

const res = await e.getUsersForRole('data1_admin')

PHP

$res = $e->getUsersForRole("data1_admin");

Python

users = e.get_users_for_role("data1_admin")

.NET

var res = e.GetUsersForRole("data1_admin");

Rust

let users = e.get_users_for_role("data1_admin", None); // No domain

Java

List<String> res = e.getUsersForRole("data1_admin");

HasRoleForUser()

HasRoleForUser 确定用户是否具有角色。

例如:

Go

res := e.HasRoleForUser("alice", "data1_admin")

Node.js

const res = await e.hasRoleForUser('alice', 'data1_admin')

PHP

$res = $e->hasRoleForUser("alice", "data1_admin");

Python

has = e.has_role_for_user("alice", "data1_admin")

.NET

var res = e.HasRoleForUser("alice", "data1_admin");

Rust

let has = e.has_role_for_user("alice", "data1_admin", None); // No domain

Java

boolean res = e.hasRoleForUser("alice", "data1_admin");

AddRoleForUser()

AddRoleForUser 为用户添加角色。 如果用户已经拥有该角色，则返回false。

例如:

Go

e.AddRoleForUser("alice", "data2_admin")

Node.js

await e.addRoleForUser('alice', 'data2_admin')

PHP

$e->addRoleForUser("alice", "data2_admin");

Python

e.add_role_for_user("alice", "data2_admin")

.NET

var added = e.AddRoleForUser("alice", "data2_admin");
or
var added = await e.AddRoleForUserAsync("alice", "data2_admin");

Rust

let added = e.add_role_for_user("alice", "data2_admin", None).await?; // No domain

Java

boolean added = e.addRoleForUser("alice", "data2_admin");

AddRolesForUser()

AddRolesForUser 为用户添加多个角色。 如果用户已经拥有该角色，则返回false。(不会受影响)

例如:

Go

var roles = []string{"data2_admin", "data1_admin"}
e.AddRolesForUser("alice", roles)

Node.js

const roles = ["data1_admin", "data2_admin"];
roles.map((role) => e.addRoleForUser("alice", role));

Rust

let roles = vec!["data1_admin".to_owned(), "data2_admin".to_owned()];
let all_added = e.add_roles_for_user("alice", roles, None).await?; // 无域

DeleteRoleForUser()

DeleteRoleForUser 删除用户的角色。 如果用户没有该角色，则返回false。

例如:

Go

e.DeleteRoleForUser("alice", "data1_admin")

Node.js

await e.deleteRoleForUser('alice', 'data1_admin')

PHP

$e->deleteRoleForUser("alice", "data1_admin");

Python

e.delete_role_for_user("alice", "data1_admin")

.NET

var deleted = e.DeleteRoleForUser("alice", "data1_admin");
or
var deleted = await e.DeleteRoleForUser("alice", "data1_admin");

Rust

let deleted = e.delete_role_for_user("alice", "data1_admin", None).await?; // No domain

Java

boolean deleted = e.deleteRoleForUser("alice", "data1_admin");

DeleteRolesForUser()

DeleteRolesForUser 删除用户的所有角色。 如果用户没有任何角色，则返回false。

例如:

Go

e.DeleteRolesForUser("alice")

Node.js

await e.deleteRolesForUser('alice')

PHP

$e->deleteRolesForUser("alice");

Python

e.delete_roles_for_user("alice")

.NET

var deletedAtLeastOne = e.DeleteRolesForUser("alice");
or
var deletedAtLeastOne = await e.DeleteRolesForUserAsync("alice");

Rust

let deleted_at_least_one = e.delete_roles_for_user("alice", None).await?; // 无域

Java

boolean deletedAtLeastOne = e.deleteRolesForUser("alice");

DeleteUser()

DeleteUser 删除一个用户。 如果用户不存在，则返回false（也就是说不受影响）。

例如:

Go

e.DeleteUser("alice")

Node.js

await e.deleteUser('alice')

PHP

$e->deleteUser("alice");

Python

e.delete_user("alice")

.NET

var deleted = e.DeleteUser("alice");
or
var deleted = await e.DeleteUserAsync("alice");

Rust

let deleted = e.delete_user("alice").await?;

Java

boolean deleted = e.deleteUser("alice");

DeleteRole()

DeleteRole 删除一个角色。

例如:

Go

e.DeleteRole("data2_admin")

Node.js

await e.deleteRole("data2_admin")

PHP

$e->deleteRole("data2_admin");

Python

e.delete_role("data2_admin")

.NET

var deleted = e.DeleteRole("data2_admin");
or
var deleted = await e.DeleteRoleAsync("data2_admin");

Rust

let deleted = e.delete_role("data2_admin").await?;

Java

e.deleteRole("data2_admin");

DeletePermission()

DeletePermission 删除权限。 如果权限不存在，则返回false（aka不受影响）。

例如:

Go

e.DeletePermission("read")

Node.js

await e.deletePermission('read')

PHP

$e->deletePermission("read");

Python

e.delete_permission("read")

.NET

var deleted = e.DeletePermission("read");
or
var deleted = await e.DeletePermissionAsync("read");

Rust

let deleted = e.delete_permission(vec!["read".to_owned()]).await?;

Java

boolean deleted = e.deletePermission("read");

AddPermissionForUser()

AddPermissionForUser 为用户或角色添加权限。 如果用户或角色已经拥有该权限（aka不受影响），则返回false。

例如：

Go

e.AddPermissionForUser("bob", "read")

Node.js

await e.addPermissionForUser('bob', 'read')

PHP

$e->addPermissionForUser("bob", "read");

Python

e.add_permission_for_user("bob", "read")

.NET

var added = e.AddPermissionForUser("bob", "read");
or
var added = await e.AddPermissionForUserAsync("bob", "read");

Rust

let added = e.add_permission_for_user("bob", vec!["read".to_owned()]).await?;

Java

boolean added = e.addPermissionForUser("bob", "read");

AddPermissionsForUser()

AddPermissionForUser 为用户或角色添加多个权限。 如果用户或角色已经有一个权限，则返回 false (不会受影响)。

例如：

Go

var permissions = [][]string{{"data1", "read"},{"data2","write"}}
for i := 0; i < len(permissions); i++ {
    e.AddPermissionsForUser("alice", permissions[i])
}

Node.js

const permissions = [
    ["data1", "read"],
    ["data2", "write"],
];

permissions.map((permission) => e.addPermissionForUser("bob", ...permission));

Rust

let permissions = vec![
    vec!["data1".to_owned(), "read".to_owned()],
    vec!["data2".to_owned(), "write".to_owned()],
];

let all_added = e.add_permissions_for_user("bob", permissions).await?;

DeletePermissionForUser()

DeletePermissionForUser 删除用户或角色的权限。 如果用户或角色没有权限（aka不受影响），则返回false。

例如：

Go

e.DeletePermissionForUser("bob", "read")

Node.js

await e.deletePermissionForUser("bob", "read")

PHP

$e->deletePermissionForUser("bob", "read");

Python

e.delete_permission_for_user("bob", "read")

.NET

var deleted = e.DeletePermissionForUser("bob", "read");
or
var deleted = await e.DeletePermissionForUserAsync("bob", "read");

Rust

let deleted = e.delete_permission_for_user("bob", vec!["read".to_owned()]).await?;

Java

boolean deleted = e.deletePermissionForUser("bob", "read");

DeletePermissionsForUser()

DeletePermissionsForUser 删除用户或角色的权限。 如果用户或角色没有任何权限（aka不受影响），则返回false。

例如：

Go

e.DeletePermissionsForUser("bob")

Node.js

await e.deletePermissionsForUser('bob')

PHP

$e->deletePermissionsForUser("bob");

Python

e.delete_permissions_for_user("bob")

.NET

var deletedAtLeastOne = e.DeletePermissionsForUser("bob");
or
var deletedAtLeastOne = await e.DeletePermissionsForUserAsync("bob");

Rust

let deleted_at_least_one = e.delete_permissions_for_user("bob").await?;

Java

boolean deletedAtLeastOne = e.deletePermissionForUser("bob");

GetPermissionsForUser()

GetPermissionsForUser 获取用户或角色的权限。

例如：

Go

e.GetPermissionsForUser("bob")

Node.js

await e.getPermissionsForUser('bob')

PHP

$e->getPermissionsForUser("bob");

Python

e.get_permissions_for_user("bob")

.NET

var permissions = e.GetPermissionsForUser("bob");

Java

List<List<String>> permissions = e.getPermissionsForUser("bob");

HasPermissionForUser()

HasPermissionForUser 确定用户是否具有权限。

例如：

Go

e.HasPermissionForUser("alice", []string{"read"})

Node.js

await e.hasPermissionForUser('alice', 'read')

PHP

$e->hasPermissionForUser("alice", []string{"read"});

Python

has = e.has_permission_for_user("alice", "read")

.NET

var has = e.HasPermissionForUser("bob", "read");

Rust

let has = e.has_permission_for_user("alice", vec!["data1".to_owned(), "read".to_owned()]);

Java

boolean has = e.hasPermissionForUser("alice", "read");

GetImplicitRolesForUser()

GetImplicitRolesForUser 获取用户具有的隐式角色。 与GetRolesForUser() 相比，该函数除了直接角色外还检索间接角色。

例如：
g, Alice, role:admin
g, role:admin, role:user

GetRolesForUser("Alice") 只能获取：["role:admin"]。
但 GetImplicitRolesForUser("alice") 将获取：["role:admin", "role:user"]。

例如：

Go

e.GetImplicitRolesForUser("alice")

Node.js

await e.getImplicitRolesForUser("alice")

PHP

$e->getImplicitRolesForUser("alice");

Python

e.get_implicit_roles_for_user("alice")

.NET

var implicitRoles = e.GetImplicitRolesForUser("alice");

Rust

e.get_implicit_roles_for_user("alice", None); // No domain

Java

List<String> implicitRoles = e.getImplicitRolesForUser("alice");

GetImplicitUsersForRole()

GetImplicitUsersForRole 获取所有继承该角色的用户 与GetUsersForRole() 相比，这个函数检索间接用户。

例如：
g, Alice, role:admin
g, role:admin, role:user

GetRolesForUser("Alice") 只能获取：["role:admin"]。
但 GetImplicitUsersForRole("role:alice") 将获取：["role:admin", "alice"]。

例如：

Go

users := e.GetImplicitUsersForRole("role:user")

Node.js

const users = e.getImplicitUsersForRole("role:user");

Java

List<String> users = e.getImplicitUsersForRole("role:user");

GetImplicitPermissionsForUser()

GetImplicitPermissionsForUser 获得用户或角色的隐含权限。
与GetPermissionsForUser() 相比，此函数获取继承角色的权限。

例如:
p, admin, data1, read
p, alice, data2, read
g, alice, admin

GetPermissionsForUser("alice") 只能获取：[["alice", "data 2", "read"]]。
但GetImplicitPermissionsForUser("alice") 将获取：[["admin", "data1", "read"], ["alice", "data2", "read"]]。

例如：

Go

e.GetImplicitPermissionsForUser("alice")

Node.js

await e.getImplicitPermissionsForUser("alice")

PHP

$e->getImplicitPermissionsForUser("alice");

Python

e.get_implicit_permissions_for_user("alice")

.NET

var implicitPermissions = e.GetImplicitPermissionsForUser("alice");

Rust

e.get_implicit_permissions_for_user("alice", None); // 无域

Java

List<List<String>> implicitPermissions = e.getImplicitPermissionsForUser("alice");

GetNamedImplicitPermissionsForUser()

GetNamedImplicitPermissionsForUser 通过命名策略获得用户或角色的隐含权限 与 GetImplicitPermissionPermissionsForUser() 相比，此函数允许您指定策略名称。

例如： p, admin, data1, read p2, admin, creaty g, alice, admin

GetImplicitPermissionsForUser("Alice") 只能获取到默认为“p”的权限: [["admin", "data1", "read"]]

但是你可以指定策略为 "p2" 来获取：[["admin", "create"]] 由 GetNamedImplicitPermissionsForUser("p2","Alice")

例如：

Go

e.GetNamedImplicitPermissionsForUser("p2","alice")

Python

e.get_named_implicit_permissions_for_user("p2", "alice")

GetDomainsForUser()

GetDomainsForUser 获取用户拥有的所有域名。

例如： p, admin, domain1, data1, read p, admin, domain2, data2, read p, admin, domain2, data2, write g, alice, admin, domain1 g, alice, admin, domain2

GetDomainsForUser("Alice") 可以获取 ["domain1", "domain2"]

例如：

Go

result, err := e.GetDomainsForUser("alice")

GetImplicitResourcesForUser()

GetImplicitResourcesForUser 返回为true的策略给用户。

例如：

p, alice, data1, read
p, bob, data2, write
p, data2_admin, data2, read
p, data2_admin, data2, write

g, alice, data2_admin

GetImplicitResourcesForUser("alice") 将会返回 [[alice data1 read] [alice data2 read] [alice data2 write]]

Go

resources, err := e.GetImplicitResourcesForUser("alice")

GetImplicitUsersForPermission()

GetImplicitUsersForPermission gets implicit users for a permission.

For example:

p, admin, data1, read
p, bob, data1, read
g, alice, admin

GetImplicitUsersForPermission("data1", "read") will return: ["alice", "bob"].

Note: only users will be returned, roles (2nd arg in "g") will be excluded.

Go

users, err := e.GetImplicitUsersForPermission("data1", "read")

GetAllowedObjectConditions()

GetAllowedObjectConditions returns a string array of object conditions that the user can access.

For example:

p, alice, r.obj.price < 25, read
p, admin, r.obj.category_id = 2, read
p, bob, r.obj.author = bob, write

g, alice, admin

e.GetAllowedObjectConditions("alice", "read", "r.obj.") will return ["price < 25", "category_id = 2"], nil

Note:

0. prefix: You can customize the prefix of the object conditions, and "r.obj." is commonly used as a prefix. After removing the prefix, the remaining part is the condition of the object. If there is an obj policy that does not meet the prefix requirement, an errors.ERR_OBJ_CONDITION will be returned.

1. If the 'objectConditions' array is empty, return errors.ERR_EMPTY_CONDITION This error is returned because some data adapters' ORM return full table data by default when they receive an empty condition, which tends to behave contrary to expectations.(e.g. GORM) If you are using an adapter that does not behave like this, you can choose to ignore this error.

Go

conditions, err := e.GetAllowedObjectConditions("alice", "read", "r.obj.")

GetImplicitUsersForResource()

GetImplicitUsersForResource return implicit user based on resource.

For example:

p, alice, data1, read
p, bob, data2, write
p, data2_admin, data2, read
p, data2_admin, data2, write
g, alice, data2_admin

GetImplicitUsersForResource("data2") will return [["bob", "data2", "write"], ["alice", "data2", "read"] ["alice", "data2", "write"]], nil.

GetImplicitUsersForResource("data1") will return [["alice", "data1", "read"]], nil.

Go

ImplicitUsers, err := e.GetImplicitUsersForResource("data2")

备注

Only users will be returned, roles (2nd arg in "g") will be excluded.