authj

README

authj

authj is an authorization middleware for Gin, it's based on casbin.

Installation

go get github.com/things-go/authj

Example

package main

import (
	"net/http"

	"github.com/casbin/casbin/v2"
	"github.com/gin-gonic/gin"

	"github.com/things-go/authj"
)

func main() {
	// load the casbin model and policy from files, database is also supported.
	e, err := casbin.NewEnforcer("authj_model.conf", "authj_policy.csv")
	if err != nil {
		panic(err)
	}

	// define your router, and use the Casbin authj middleware.
	// the access that is denied by authj will return HTTP 403 error.
	router := gin.New()
	router.Use(
		func(c *gin.Context) {
			// set context subject
			authj.ContextWithSubject(c, "alice")
		},
		authj.Authorizer(e),
	)
	router.GET("/dataset1/resource1", func(c *gin.Context) {
		c.String(http.StatusOK, "alice own this resource")
	})
	router.GET("/dataset2/resource1", func(c *gin.Context) {
		c.String(http.StatusOK, "alice do not own this resource")
	})
	router.Run(":8080")
}

Documentation

The authorization determines a request based on {subject, object, action}, which means what subject can perform what action on what object. In this plugin, the meanings are:

1. subject: the logged-on user name
2. object: the URL path for the web resource like "dataset1/item1"
3. action: HTTP method like GET, POST, PUT, DELETE, or the high-level actions you defined like "read-file", "write-blog"

For how to write authorization policy and other details, please refer to the Casbin's documentation.

Getting Help

• Casbin
• Gin
• Gin-authz

License

This project is under MIT License. See the LICENSE file for the full license text.

Documentation

Index

• func Authorizer(e casbin.IEnforcer, opts ...Option) gin.HandlerFunc
• func ContextWithSubject(c *gin.Context, subject string)
• func Subject(c *gin.Context) string
• type Config
• type Option
  • func WithErrorFallback(fn func(*gin.Context, error)) Option
  • func WithForbiddenFallback(fn func(*gin.Context)) Option
  • func WithSkipAuthentication(fn func(*gin.Context) bool) Option
  • func WithSubject(fn func(*gin.Context) string) Option

Functions

func Authorizer

func Authorizer(e casbin.IEnforcer, opts ...Option) gin.HandlerFunc

Authorizer returns the authorizer uses a Casbin enforcer, and Subject as subject.

func ContextWithSubject

func ContextWithSubject(c *gin.Context, subject string)

ContextWithSubject return a copy of parent in which the value associated with subjectCtxKey is subject.

func Subject

func Subject(c *gin.Context) string

Subject returns the value associated with this context for subjectCtxKey,

Types

type Config

type Config struct {
	// contains filtered or unexported fields
}

Config for Authorizer

type Option

type Option func(*Config)

Option config option

func WithErrorFallback

func WithErrorFallback(fn func(*gin.Context, error)) Option

WithErrorFallback set the fallback handler when request are error happened. default: the 500 server error to the client

func WithForbiddenFallback

func WithForbiddenFallback(fn func(*gin.Context)) Option

WithForbiddenFallback set the fallback handler when request are not allow. default: the 403 Forbidden to the client

func WithSkipAuthentication

func WithSkipAuthentication(fn func(*gin.Context) bool) Option

WithSkipAuthentication set the skip approve when it is return true. Default: always false

func WithSubject

func WithSubject(fn func(*gin.Context) string) Option

WithSubject set the subject extractor of the requests. default: Subject