Help us shape the future of Go! Take the 2026 Go Developer Survey

Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

rbac

package module

Go to main page

Versions in this module

v0

v0.1.0

Oct 18, 2026

Changes in this version

+ const DefaultLoadTimeout

+ const MultiWildcard

+ const PermissionSeparator

+ const ScopeSeparator

+ const Wildcard

+ var ErrForbidden = errors.New("rbac: forbidden")

+ var ErrInvalidPermission = errors.New("rbac: invalid permission")

+ var ErrInvalidPolicy = errors.New("rbac: invalid policy")

+ var ErrInvalidRole = errors.New("rbac: invalid role")

+ var ErrInvalidScope = errors.New("rbac: invalid scope")

+ var ErrMalformedClaim = errors.New("rbac: malformed claim")

+ var ErrNilPolicy = errors.New("rbac: policy provider returned a nil policy")

+ var ErrNoClaims = errors.New("rbac: no claims in context")

+ var ErrNotConfigured = errors.New("rbac: not configured")

+ var ErrRoleCycle = errors.New("rbac: role inheritance cycle")

+ var ErrUnknownRole = errors.New("rbac: unknown role")

+ func ContextWithClaims(ctx context.Context, c *Claims) context.Context

+ func Grants(grant, perm string) bool

+ func MatchScope(pattern, scope string) bool

+ func ValidateGrant(grant string) error

+ func ValidatePermission(perm string) error

+ func ValidateScope(s string) error

+ func ValidateScopePattern(s string) error

+ type Binding struct

+ Role string

+ Scope string

+ type CacheOption func(*CachedPolicyProvider)

+ func WithLoadTimeout(d time.Duration) CacheOption

+ func WithStaleGrace(d time.Duration) CacheOption

+ type CachedPolicyProvider struct

+ func NewCachedPolicyProvider(load func(ctx context.Context) (*Policy, error), ttl time.Duration, ...) *CachedPolicyProvider

+ func (c *CachedPolicyProvider) Invalidate()

+ func (c *CachedPolicyProvider) Policy(ctx context.Context) (*Policy, error)

+ type Claims struct

+ Subject string

+ Values map[string]any

+ func ClaimsFromContext(ctx context.Context) (*Claims, bool)

+ type ClaimsProviderFunc = func(ctx context.Context, subject string) (map[string]any, error)

+ type ClaimsSource func(ctx context.Context) (*Claims, bool)

+ type Config struct

+ EmbedPermissions bool

+ EmbedRoles bool

+ PermissionsClaim string

+ RolesClaim string

+ ScopedRolesOnly bool

+ func DefaultConfig() Config

+ func (c Config) Validate() error

+ type Enforcer struct

+ func New(opts ...Option) (*Enforcer, error)

+ func (e *Enforcer) Can(ctx context.Context, perm string) (bool, error)

+ func (e *Enforcer) CanAll(ctx context.Context, perms ...string) (bool, error)

+ func (e *Enforcer) CanAllOn(ctx context.Context, resource string, perms ...string) (bool, error)

+ func (e *Enforcer) CanAny(ctx context.Context, perms ...string) (bool, error)

+ func (e *Enforcer) CanAnyOn(ctx context.Context, resource string, perms ...string) (bool, error)

+ func (e *Enforcer) CanOn(ctx context.Context, resource, perm string) (bool, error)

+ func (e *Enforcer) ClaimsCanAll(ctx context.Context, c *Claims, perms ...string) (bool, error)

+ func (e *Enforcer) ClaimsCanAllOn(ctx context.Context, c *Claims, resource string, perms ...string) (bool, error)

+ func (e *Enforcer) ClaimsCanAny(ctx context.Context, c *Claims, perms ...string) (bool, error)

+ func (e *Enforcer) ClaimsCanAnyOn(ctx context.Context, c *Claims, resource string, perms ...string) (bool, error)

+ func (e *Enforcer) ClaimsHaveAnyRole(ctx context.Context, c *Claims, roles ...string) (bool, error)

+ func (e *Enforcer) ClaimsHaveAnyRoleOn(ctx context.Context, c *Claims, resource string, roles ...string) (bool, error)

+ func (e *Enforcer) ClaimsProvider(base ClaimsProviderFunc) ClaimsProviderFunc

+ func (e *Enforcer) Config() Config

+ func (e *Enforcer) EffectiveRoles(ctx context.Context, subject string) ([]string, error)

+ func (e *Enforcer) HasAnyRole(ctx context.Context, roles ...string) (bool, error)

+ func (e *Enforcer) HasAnyRoleOn(ctx context.Context, resource string, roles ...string) (bool, error)

+ func (e *Enforcer) HasRole(ctx context.Context, role string) (bool, error)

+ func (e *Enforcer) HasRoleOn(ctx context.Context, resource, role string) (bool, error)

+ func (e *Enforcer) Permissions(ctx context.Context, subject string) ([]string, error)

+ func (e *Enforcer) RequireAllPermissions(perms ...string) Middleware

+ func (e *Enforcer) RequireAllPermissionsOn(resource ResourceFunc, perms ...string) Middleware

+ func (e *Enforcer) RequireAnyPermission(perms ...string) Middleware

+ func (e *Enforcer) RequireAnyPermissionOn(resource ResourceFunc, perms ...string) Middleware

+ func (e *Enforcer) RequireAnyRole(roles ...string) Middleware

+ func (e *Enforcer) RequireAnyRoleOn(resource ResourceFunc, roles ...string) Middleware

+ func (e *Enforcer) SubjectCan(ctx context.Context, subject, perm string) (bool, error)

+ func (e *Enforcer) SubjectCanOn(ctx context.Context, subject, resource, perm string) (bool, error)

+ func (e *Enforcer) SubjectHasRole(ctx context.Context, subject, role string) (bool, error)

+ func (e *Enforcer) SubjectHasRoleOn(ctx context.Context, subject, resource, role string) (bool, error)

+ type ErrorHandler func(w http.ResponseWriter, r *http.Request, err error)

+ type MemoryRoleStore struct

+ func NewMemoryRoleStore() *MemoryRoleStore

+ func (s *MemoryRoleStore) AddRoles(subject string, roles ...string)

+ func (s *MemoryRoleStore) RemoveRoles(subject string, roles ...string)

+ func (s *MemoryRoleStore) Roles(_ context.Context, subject string) ([]string, error)

+ func (s *MemoryRoleStore) SetRoles(subject string, roles ...string)

+ type MemoryScopedRoleStore struct

+ func NewMemoryScopedRoleStore() *MemoryScopedRoleStore

+ func (s *MemoryScopedRoleStore) Bind(subject, scope string, roles ...string) error

+ func (s *MemoryScopedRoleStore) Bindings(_ context.Context, subject string, scopes []string) ([]Binding, error)

+ func (s *MemoryScopedRoleStore) Unbind(subject, scope string, roles ...string)

+ type Middleware func(http.Handler) http.Handler

+ type Option func(*settings)

+ func WithClaimsSource(src ClaimsSource) Option

+ func WithConfig(cfg Config) Option

+ func WithEmbedPermissions(embed bool) Option

+ func WithEmbedRoles(embed bool) Option

+ func WithErrorHandler(h ErrorHandler) Option

+ func WithLogger(l *slog.Logger) Option

+ func WithOptions(opts ...Option) Option

+ func WithPermissionsClaim(name string) Option

+ func WithPolicy(p *Policy) Option

+ func WithPolicyProvider(p PolicyProvider) Option

+ func WithReservedClaims(reserved func(name string) bool) Option

+ func WithRoleStore(store RoleStore) Option

+ func WithRolesClaim(name string) Option

+ func WithScopeResolver(r ScopeResolver) Option

+ func WithScopedRoleStore(store ScopedRoleStore) Option

+ func WithScopedRolesOnly() Option

+ type Policy struct

+ func LoadPolicyJSON(r io.Reader) (*Policy, error)

+ func NewPolicy(defs map[string]RoleDefinition) (*Policy, error)

+ func ParsePolicyJSON(data []byte) (*Policy, error)

+ func (p *Policy) Can(roles []string, perm string) (bool, error)

+ func (p *Policy) Definitions() map[string]RoleDefinition

+ func (p *Policy) EffectiveRoles(assigned ...string) []string

+ func (p *Policy) HasRole(name string) bool

+ func (p *Policy) Permissions(roles ...string) []string

+ func (p *Policy) Roles() []string

+ type PolicyFile struct

+ Roles map[string]RoleDefinition

+ func (f PolicyFile) Policy() (*Policy, error)

+ type PolicyProvider interface

+ Policy func(ctx context.Context) (*Policy, error)

+ func StaticPolicy(p *Policy) PolicyProvider

+ type PolicyProviderFunc func(ctx context.Context) (*Policy, error)

+ func (f PolicyProviderFunc) Policy(ctx context.Context) (*Policy, error)

+ type ResourceFunc func(r *http.Request) (string, error)

+ func PathResource(pattern string) ResourceFunc

+ type RoleDefinition struct

+ Except []string

+ Inherits []string

+ Permissions []string

+ type RoleStore interface

+ Roles func(ctx context.Context, subject string) ([]string, error)

+ type RoleStoreFunc func(ctx context.Context, subject string) ([]string, error)

+ func (f RoleStoreFunc) Roles(ctx context.Context, subject string) ([]string, error)

+ type ScopeResolver interface

+ Scopes func(ctx context.Context, resource string) ([]string, error)

+ func PathScopes() ScopeResolver

+ type ScopeResolverFunc func(ctx context.Context, resource string) ([]string, error)

+ func (f ScopeResolverFunc) Scopes(ctx context.Context, resource string) ([]string, error)

+ type ScopedRoleStore interface

+ Bindings func(ctx context.Context, subject string, scopes []string) ([]Binding, error)

+ type ScopedRoleStoreFunc func(ctx context.Context, subject string, scopes []string) ([]Binding, error)

+ func (f ScopedRoleStoreFunc) Bindings(ctx context.Context, subject string, scopes []string) ([]Binding, error)