tulip

README

Tulip

A high-performance replacement for Casbin that works solely with Postgres using PGX. It maintains a front-end cache of all policies and keep up-to-date with Postgres via notifications and periodic sync.

Documentation

Index

• Constants
• func RBACWithDomain(m *Manager, request ...string) bool
• type Manager
  • func NewManager(conn interface{}, matcher Matcher, opts ...Option) (*Manager, error)
  • func (m *Manager) AddPolicies(pRules, gRules [][]string) error
  • func (m *Manager) AddPolicy(ptype string, rule []string) error
  • func (m *Manager) Close() error
  • func (m *Manager) Enforce(request ...string) bool
  • func (m *Manager) Filter(rule ...string) Policies
  • func (m *Manager) FilterGroups(rule ...string) Policies
  • func (m *Manager) FilterWithGroups(policyValueIndex int, groups Policies, groupValueIndex int) Policies
  • func (m *Manager) FindExact(rule ...string) []string
  • func (m *Manager) GroupingPolicyCount() int
  • func (m *Manager) LoadPolicies() error
  • func (m *Manager) PolicyCount() int
  • func (m *Manager) RemoveFilteredPolicies(pPattern, gPattern []string) error
  • func (m *Manager) RemovePolicies(pRules, gRules [][]string) error
  • func (m *Manager) RemovePolicy(ptype string, rule []string) error
• type Matcher
• type Option
  • func WithDatabase(dbname string) Option
  • func WithSkipDatabaseCreate() Option
  • func WithSkipTableCreate() Option
  • func WithSyncInterval(interval time.Duration) Option
  • func WithTableName(tableName string) Option
  • func WithTimeout(timeout time.Duration) Option
  • func WithZapLogger(logger *zap.Logger) Option
• type Policies
  • func (p Policies) Filter(rule ...string) Policies
  • func (p Policies) Find(rule []string) []string
  • func (p *Policies) Insert(rule []string)
  • func (p Policies) Len() int
  • func (p Policies) Less(i, j int) bool
  • func (p *Policies) Remove(rule []string)
  • func (p Policies) Swap(i, j int)

Constants

const (
	DefaultTableName    = "tulip_rule"
	DefaultDatabaseName = "tulip"
	DefaultTimeout      = time.Second * 10
	DefaultSyncPeriod   = time.Second * 60
)

Functions

func RBACWithDomain

func RBACWithDomain(m *Manager, request ...string) bool

RBACWithDomain matcher encapsulates the matching logic of the following casbin model:

r = sub, dom, obj, act
p = sub, dom, obj, act
g = _, _, _
e = some(where (p.eft == allow))
m = (r.sub == p.sub || g(r.sub, p.sub, r.dom)) && r.dom == p.dom && r.obj == p.obj && r.act == p.act

Types

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager manages access control policies.

func NewManager

func NewManager(conn interface{}, matcher Matcher, opts ...Option) (*Manager, error)

NewManager creates a new manager with connection conn which must either be a PostgreSQL connection string or an instance of *pgx.ConnConfig from package github.com/jackc/pgx/v4.

func (*Manager) AddPolicies

func (m *Manager) AddPolicies(pRules, gRules [][]string) error

AddPolicies adds policy rules to the storage.

func (*Manager) AddPolicy

func (m *Manager) AddPolicy(ptype string, rule []string) error

AddPolicy adds a policy rule to the storage.

func (*Manager) Close

func (m *Manager) Close() error

Close closes all connections and stops all goroutines

func (*Manager) Enforce

func (m *Manager) Enforce(request ...string) bool

func (*Manager) Filter

func (m *Manager) Filter(rule ...string) Policies

Filter filters policies

func (*Manager) FilterGroups

func (m *Manager) FilterGroups(rule ...string) Policies

Filter filters grouping policies

func (*Manager) FilterWithGroups

func (m *Manager) FilterWithGroups(policyValueIndex int, groups Policies, groupValueIndex int) Policies

func (*Manager) FindExact

func (m *Manager) FindExact(rule ...string) []string

FindExact finds the policy that match this rule exactly

func (*Manager) GroupingPolicyCount

func (m *Manager) GroupingPolicyCount() int

func (*Manager) LoadPolicies

func (m *Manager) LoadPolicies() error

LoadPolicies loads policies from database.

func (*Manager) PolicyCount

func (m *Manager) PolicyCount() int

func (*Manager) RemoveFilteredPolicies

func (m *Manager) RemoveFilteredPolicies(pPattern, gPattern []string) error

func (*Manager) RemovePolicies

func (m *Manager) RemovePolicies(pRules, gRules [][]string) error

RemovePolicies removes policy rules from the storage.

func (*Manager) RemovePolicy

func (m *Manager) RemovePolicy(ptype string, rule []string) error

RemovePolicy removes a policy rule from the storage.

type Matcher

type Matcher func(m *Manager, request ...string) bool

Matcher encapsulates the logic of matching a query request against internal policies and grouping polcies.

type Option

type Option func(m *Manager)

func WithDatabase

func WithDatabase(dbname string) Option

WithTableName can be used to pass custom database name for Tulip rules

func WithSkipDatabaseCreate

func WithSkipDatabaseCreate() Option

func WithSkipTableCreate

func WithSkipTableCreate() Option

WithSkipTableCreate skips the table creation step when the manager starts If the Tulip rules table does not exist, it will lead to issues when using the manager

func WithSyncInterval

func WithSyncInterval(interval time.Duration) Option

WithSyncInterval specifies a different sync interval for the manager

func WithTableName

func WithTableName(tableName string) Option

WithTableName can be used to pass custom table name for Tulip rules

func WithTimeout

func WithTimeout(timeout time.Duration) Option

WithTimeout specifies a Postgres connection timeout for the manager

func WithZapLogger

func WithZapLogger(logger *zap.Logger) Option

WithZapLogger specifies a logger for the manager

type Policies

type Policies [][]string

Policies represents a list of sortable policies

func (Policies) Filter

func (p Policies) Filter(rule ...string) Policies

func (Policies) Find

func (p Policies) Find(rule []string) []string

func (*Policies) Insert

func (p *Policies) Insert(rule []string)

func (Policies) Len

func (p Policies) Len() int

func (Policies) Less

func (p Policies) Less(i, j int) bool

func (*Policies) Remove

func (p *Policies) Remove(rule []string)

func (Policies) Swap

func (p Policies) Swap(i, j int)