RBAC API

The RBAC API is a convenience layer for role-based operations (roles for user, users for role, permissions, etc.). It is a subset of the Management API aimed at RBAC use cases.

Reference

The global variable e represents an Enforcer instance.

e, err := NewEnforcer("examples/rbac_model.conf", "examples/rbac_policy.csv")

const e = await newEnforcer('examples/rbac_model.conf', 'examples/rbac_policy.csv')

$e = new Enforcer('examples/rbac_model.conf', 'examples/rbac_policy.csv');

e = casbin.Enforcer("examples/rbac_model.conf", "examples/rbac_policy.csv")

var e = new Enforcer("path/to/model.conf", "path/to/policy.csv");

let mut e = Enforcer::new("examples/rbac_model.conf", "examples/rbac_policy.csv").await?;

Enforcer e = new Enforcer("examples/rbac_model.conf", "examples/rbac_policy.csv");

`GetRolesForUser()`

Retrieves all roles assigned to a user.

Zum Beispiel:

res := e.GetRolesForUser("alice")

const res = await e.getRolesForUser('alice')

$res = $e->getRolesForUser("alice");

roles = e.get_roles_for_user("alice")

var res = e.GetRolesForUser("alice");

let roles = e.get_roles_for_user("alice", None); // No domain

List<String> res = e.getRolesForUser("alice");

`GetUsersForRole()`

Retrieves all users assigned to a role.

Zum Beispiel:

res := e.GetUsersForRole("data1_admin")

const res = await e.getUsersForRole('data1_admin')

$res = $e->getUsersForRole("data1_admin");

users = e.get_users_for_role("data1_admin")

var res = e.GetUsersForRole("data1_admin");

let users = e.get_users_for_role("data1_admin", None); // No domain

List<String> res = e.getUsersForRole("data1_admin");

`HasRoleForUser()`

Checks whether a user has a specific role.

Zum Beispiel:

res := e.HasRoleForUser("alice", "data1_admin")

const res = await e.hasRoleForUser('alice', 'data1_admin')

$res = $e->hasRoleForUser("alice", "data1_admin");

has = e.has_role_for_user("alice", "data1_admin")

var res = e.HasRoleForUser("alice", "data1_admin");

let has = e.has_role_for_user("alice", "data1_admin", None); // No domain

boolean res = e.hasRoleForUser("alice", "data1_admin");

`AddRoleForUser()`

Assigns a role to a user. Returns false if the user already has the role (aka not affected).

Zum Beispiel:

e.AddRoleForUser("alice", "data2_admin")

await e.addRoleForUser('alice', 'data2_admin')

$e->addRoleForUser("alice", "data2_admin");

e.add_role_for_user("alice", "data2_admin")

var added = e.AddRoleForUser("alice", "data2_admin");
or
var added = await e.AddRoleForUserAsync("alice", "data2_admin");

let added = e.add_role_for_user("alice", "data2_admin", None).await?; // No domain

boolean added = e.addRoleForUser("alice", "data2_admin");

`AddRolesForUser()`

Assigns multiple roles to a user. Returns false if the user already has one of these roles (aka not affected).

Zum Beispiel:

var roles = []string{"data2_admin", "data1_admin"}
e.AddRolesForUser("alice", roles)

const roles = ["data1_admin", "data2_admin"];
roles.map((role) => e.addRoleForUser("alice", role));

var roles = new List<string> { "data1_admin", "data2_admin" };
var allAdded = e.AddRolesForUser("alice", roles);
// or async
var allAdded = await e.AddRolesForUserAsync("alice", roles);

let roles = vec!["data1_admin".to_owned(), "data2_admin".to_owned()];
let all_added = e.add_roles_for_user("alice", roles, None).await?; // No domain

`DeleteRoleForUser()`

Removes a role from a user. Returns false if the user does not have the role (aka not affected).

Zum Beispiel:

e.DeleteRoleForUser("alice", "data1_admin")

await e.deleteRoleForUser('alice', 'data1_admin')

$e->deleteRoleForUser("alice", "data1_admin");

e.delete_role_for_user("alice", "data1_admin")

var deleted = e.DeleteRoleForUser("alice", "data1_admin");
or
var deleted = await e.DeleteRoleForUser("alice", "data1_admin");

let deleted = e.delete_role_for_user("alice", "data1_admin", None).await?; // No domain

boolean deleted = e.deleteRoleForUser("alice", "data1_admin");

`DeleteRolesForUser()`

Removes all roles from a user. Returns false if the user does not have any roles (aka not affected).

Zum Beispiel:

e.DeleteRolesForUser("alice")

await e.deleteRolesForUser('alice')

$e->deleteRolesForUser("alice");

e.delete_roles_for_user("alice")

var deletedAtLeastOne = e.DeleteRolesForUser("alice");
or
var deletedAtLeastOne = await e.DeleteRolesForUserAsync("alice");

let deleted_at_least_one = e.delete_roles_for_user("alice", None).await?; // No domain

boolean deletedAtLeastOne = e.deleteRolesForUser("alice");

`DeleteUser()`

Removes a user from the system. Returns false if the user does not exist (aka not affected).

Zum Beispiel:

e.DeleteUser("alice")

await e.deleteUser('alice')

$e->deleteUser("alice");

e.delete_user("alice")

var deleted = e.DeleteUser("alice");
or
var deleted = await e.DeleteUserAsync("alice");

let deleted = e.delete_user("alice").await?;

boolean deleted = e.deleteUser("alice");

`DeleteRole()`

Removes a role from the system.

Zum Beispiel:

e.DeleteRole("data2_admin")

await e.deleteRole("data2_admin")

$e->deleteRole("data2_admin");

e.delete_role("data2_admin")

var deleted = e.DeleteRole("data2_admin");
or
var deleted = await e.DeleteRoleAsync("data2_admin");

let deleted = e.delete_role("data2_admin").await?;

e.deleteRole("data2_admin");

`DeletePermission()`

Removes a permission from the system. Returns false if the permission does not exist (aka not affected).

Zum Beispiel:

e.DeletePermission("read")

await e.deletePermission('read')

$e->deletePermission("read");

e.delete_permission("read")

var deleted = e.DeletePermission("read");
or
var deleted = await e.DeletePermissionAsync("read");

let deleted = e.delete_permission(vec!["read".to_owned()]).await?;

boolean deleted = e.deletePermission("read");

`AddPermissionForUser()`

Grants a permission to a user or role. Returns false if the user or role already has the permission (aka not affected).

Zum Beispiel:

e.AddPermissionForUser("bob", "read")

await e.addPermissionForUser('bob', 'read')

$e->addPermissionForUser("bob", "read");

e.add_permission_for_user("bob", "read")

var added = e.AddPermissionForUser("bob", "read");
or
var added = await e.AddPermissionForUserAsync("bob", "read");

let added = e.add_permission_for_user("bob", vec!["read".to_owned()]).await?;

boolean added = e.addPermissionForUser("bob", "read");

`AddPermissionsForUser()`

Grants multiple permissions to a user or role. Returns false if the user or role already has one of the permissions (aka not affected).

Zum Beispiel:

var permissions = [][]string{{"data1", "read"},{"data2","write"}}
for i := 0; i < len(permissions); i++ {
    e.AddPermissionsForUser("alice", permissions[i])
}

const permissions = [
    ["data1", "read"],
    ["data2", "write"],
];

permissions.map((permission) => e.addPermissionForUser("bob", ...permission));

var permissions = new List<List<string>>
{
    new List<string> { "data1", "read" },
    new List<string> { "data2", "write" }
};

foreach (var permission in permissions)
{
    var added = e.AddPermissionForUser("bob", permission.ToArray());
    // or async
    var added = await e.AddPermissionForUserAsync("bob", permission.ToArray());
}

let permissions = vec![
    vec!["data1".to_owned(), "read".to_owned()],
    vec!["data2".to_owned(), "write".to_owned()],
];

let all_added = e.add_permissions_for_user("bob", permissions).await?;

`DeletePermissionForUser()`

Revokes a permission from a user or role. Returns false if the user or role does not have the permission (aka not affected).

Zum Beispiel:

e.DeletePermissionForUser("bob", "read")

await e.deletePermissionForUser("bob", "read")

$e->deletePermissionForUser("bob", "read");

e.delete_permission_for_user("bob", "read")

var deleted = e.DeletePermissionForUser("bob", "read");
or
var deleted = await e.DeletePermissionForUserAsync("bob", "read");

let deleted = e.delete_permission_for_user("bob", vec!["read".to_owned()]).await?;

boolean deleted = e.deletePermissionForUser("bob", "read");

`DeletePermissionsForUser()`

Revokes all permissions from a user or role. Returns false if the user or role does not have any permissions (aka not affected).

Zum Beispiel:

e.DeletePermissionsForUser("bob")

await e.deletePermissionsForUser('bob')

$e->deletePermissionsForUser("bob");

e.delete_permissions_for_user("bob")

var deletedAtLeastOne = e.DeletePermissionsForUser("bob");
or
var deletedAtLeastOne = await e.DeletePermissionsForUserAsync("bob");

let deleted_at_least_one = e.delete_permissions_for_user("bob").await?;

boolean deletedAtLeastOne = e.deletePermissionForUser("bob");

`GetPermissionsForUser()`

Retrieves all permissions for a user or role.

Zum Beispiel:

e.GetPermissionsForUser("bob")

await e.getPermissionsForUser('bob')

$e->getPermissionsForUser("bob");

e.get_permissions_for_user("bob")

var permissions = e.GetPermissionsForUser("bob");

List<List<String>> permissions = e.getPermissionsForUser("bob");

`GetNamedPermissionsForUser()`

GetNamedPermissionsForUser gets permissions for a user or role by named policy.

Zum Beispiel:

p, alice, data1, read
p, bob, data2, write
p2, admin, create
g, alice, admin

GetNamedPermissionsForUser("p", "alice") will return [["alice", "data1", "read"]]. GetNamedPermissionsForUser("p2", "alice") will return [["admin", "create"]].

permissions, err := e.GetNamedPermissionsForUser("p", "alice")

var permissions = e.GetNamedPermissionsForUser("p", "alice");

permissions = e.get_named_permissions_for_user("p", "alice")

`HasPermissionForUser()`

HasPermissionForUser determines whether a user has a permission.

Zum Beispiel:

e.HasPermissionForUser("alice", []string{"read"})

await e.hasPermissionForUser('alice', 'read')

$e->hasPermissionForUser("alice", []string{"read"});

has = e.has_permission_for_user("alice", "read")

var has = e.HasPermissionForUser("bob", "read");

let has = e.has_permission_for_user("alice", vec!["data1".to_owned(), "read".to_owned()]);

boolean has = e.hasPermissionForUser("alice", "read");

`GetImplicitRolesForUser()`

GetImplicitRolesForUser gets implicit roles that a user has. Compared to GetRolesForUser(), this function retrieves indirect roles besides direct roles.

Zum Beispiel:

g, alice, role:admin  
g, role:admin, role:user  

GetRolesForUser("alice") can only get: ["role:admin"].
But GetImplicitRolesForUser("alice") will get: ["role:admin", "role:user"].

Zum Beispiel:

e.GetImplicitRolesForUser("alice")

await e.getImplicitRolesForUser("alice")

$e->getImplicitRolesForUser("alice");

e.get_implicit_roles_for_user("alice")

var implicitRoles = e.GetImplicitRolesForUser("alice");

e.get_implicit_roles_for_user("alice", None); // No domain

List<String> implicitRoles = e.getImplicitRolesForUser("alice");

`GetNamedImplicitRolesForUser()`

GetNamedImplicitRolesForUser gets implicit roles that a user has by named policy.

Zum Beispiel:

g, alice, admin
g, admin, super_admin
g2, alice, user
g2, user, guest

GetNamedImplicitRolesForUser("g", "alice") will return ["admin", "super_admin"]. GetNamedImplicitRolesForUser("g2", "alice") will return ["user", "guest"].

roles, err := e.GetNamedImplicitRolesForUser("g", "alice")

var roles = e.GetNamedImplicitRolesForUser("g", "alice");

roles = e.get_named_implicit_roles_for_user("g", "alice")

`GetImplicitUsersForRole()`

GetImplicitUsersForRole gets all users inheriting the role. Compared to GetUsersForRole(), this function retrieves indirect users.

For example:

g, alice, role:admin  
g, role:admin, role:user  

GetUsersForRole("role:user") can only get: ["role:admin"].
But GetImplicitUesrsForRole("role:user") will get: ["role:admin", "alice"].

Zum Beispiel:

users := e.GetImplicitUsersForRole("role:user")

const users = e.getImplicitUsersForRole("role:user");

List<String> users = e.getImplicitUsersForRole("role:user");

`GetImplicitPermissionsForUser()`

GetImplicitPermissionsForUser gets implicit permissions for a user or role.
Compared to GetPermissionsForUser(), this function retrieves permissions for inherited roles.

For example:

p, admin, data1, read  
p, alice, data2, read  
g, alice, admin 

GetPermissionsForUser("alice") can only get: [["alice", "data2", "read"]].
But GetImplicitPermissionsForUser("alice") will get: [["admin", "data1", "read"], ["alice", "data2", "read"]].

Zum Beispiel:

e.GetImplicitPermissionsForUser("alice")

await e.getImplicitPermissionsForUser("alice")

$e->getImplicitPermissionsForUser("alice");

e.get_implicit_permissions_for_user("alice")

var implicitPermissions = e.GetImplicitPermissionsForUser("alice");

e.get_implicit_permissions_for_user("alice", None); // No domain

List<List<String>> implicitPermissions = e.getImplicitPermissionsForUser("alice");

`GetNamedImplicitPermissionsForUser()`

GetNamedImplicitPermissionsForUser gets implicit permissions for a user or role by named policy Compared to GetImplicitPermissionsForUser(), this function allow you to specify the policy name.

Zum Beispiel:

p, admin, data1, read
p2, admin, create
g, alice, admin

GetImplicitPermissionsForUser("alice") only get: [["admin", "data1", "read"]], whose policy is default "p"

But you can specify the policy as "p2" to get: [["admin", "create"]] by GetNamedImplicitPermissionsForUser("p2","alice")

Zum Beispiel:

e.GetNamedImplicitPermissionsForUser("p2","alice")

var permissions = e.GetNamedImplicitPermissionsForUser("p2", "alice");

e.get_named_implicit_permissions_for_user("p2", "alice")

`GetDomainsForUser()`

GetDomainsForUser gets all domains which a user has.

Zum Beispiel:

p, admin, domain1, data1, read
p, admin, domain2, data2, read
p, admin, domain2, data2, write
g, alice, admin, domain1
g, alice, admin, domain2

GetDomainsForUser("alice") could get ["domain1", "domain2"]

Zum Beispiel:

result, err := e.GetDomainsForUser("alice")

var result = e.GetDomainsForUser("alice");

`GetImplicitResourcesForUser()`

Returns all policies that apply to a user, including those inherited through roles.

Zum Beispiel:

p, alice, data1, read
p, bob, data2, write
p, data2_admin, data2, read
p, data2_admin, data2, write

g, alice, data2_admin

GetImplicitResourcesForUser("alice") will return [[alice data1 read] [alice data2 read] [alice data2 write]]

resources, err := e.GetImplicitResourcesForUser("alice")

var resources = e.GetImplicitResourcesForUser("alice");

`GetImplicitUsersForPermission()`

Retrieves all users with a specific permission, including those with implicit permissions through roles.

Zum Beispiel:

p, admin, data1, read
p, bob, data1, read
g, alice, admin

GetImplicitUsersForPermission("data1", "read") will return: ["alice", "bob"].

Note: only users will be returned, roles (2nd arg in "g") will be excluded.

users, err := e.GetImplicitUsersForPermission("data1", "read")

var users = e.GetImplicitUsersForPermission("data1", "read");

`GetImplicitObjectPatternsForUser()`

Returns all object patterns (including wildcards) that a user can access for a given domain and action.

Zum Beispiel:

p, admin, chronicle/123, location/*, read
p, user, chronicle/456, location/789, read
g, alice, admin
g, bob, user

GetImplicitObjectPatternsForUser("alice", "chronicle/123", "read") will return ["location/*"]. GetImplicitObjectPatternsForUser("bob", "chronicle/456", "read") will return ["location/789"].

patterns, err := e.GetImplicitObjectPatternsForUser("alice", "chronicle/123", "read")

const patterns = await e.getImplicitObjectPatternsForUser("alice", "chronicle/123", "read")

$patterns = $e->getImplicitObjectPatternsForUser("alice", "chronicle/123", "read");

patterns = e.get_implicit_object_patterns_for_user("alice", "chronicle/123", "read")

var patterns = e.GetImplicitObjectPatternsForUser("alice", "chronicle/123", "read");

let patterns = e.get_implicit_object_patterns_for_user("alice", "chronicle/123", "read").await?;

List<String> patterns = e.getImplicitObjectPatternsForUser("alice", "chronicle/123", "read");

`GetAllowedObjectConditions()`

Returns object conditions that a user can access.

Zum Beispiel:

p, alice, r.obj.price < 25, read
p, admin, r.obj.category_id = 2, read
p, bob, r.obj.author = bob, write

g, alice, admin

e.GetAllowedObjectConditions("alice", "read", "r.obj.") will return ["price < 25", "category_id = 2"], nil

Note:

prefix: You can customize the prefix of the object conditions, and "r.obj." is commonly used as a prefix. After removing the prefix, the remaining part is the condition of the object. If there is an obj policy that does not meet the prefix requirement, an errors.ERR_OBJ_CONDITION will be returned.
If the 'objectConditions' array is empty, return errors.ERR_EMPTY_CONDITION This error is returned because some data adapters' ORM return full table data by default when they receive an empty condition, which tends to behave contrary to expectations.(e.g. GORM) If you are using an adapter that does not behave like this, you can choose to ignore this error.

conditions, err := e.GetAllowedObjectConditions("alice", "read", "r.obj.")

var conditions = e.GetAllowedObjectConditions("alice", "read", "r.obj.");

`GetImplicitUsersForResource()`

Returns all users with access to a resource, including those with implicit permissions through roles.

Zum Beispiel:

p, alice, data1, read
p, bob, data2, write
p, data2_admin, data2, read
p, data2_admin, data2, write
g, alice, data2_admin

GetImplicitUsersForResource("data2") will return [["bob", "data2", "write"], ["alice", "data2", "read"] ["alice", "data2", "write"]], nil.

GetImplicitUsersForResource("data1") will return [["alice", "data1", "read"]], nil.

ImplicitUsers, err := e.GetImplicitUsersForResource("data2")

var implicitUsers = e.GetImplicitUsersForResource("data2");

hinweis

Only users will be returned, roles (2nd arg in "g") will be excluded.

`GetNamedImplicitUsersForResource()`

Returns all users with access to a resource through a named policy, including those with implicit permissions through roles. This function handles resource role relationships through named policies (e.g., g2, g3, etc.).

Zum Beispiel:

p, admin_group, admin_data, *
g, admin, admin_group
g2, app, admin_data

GetNamedImplicitUsersForResource("g2", "app") will return users who have access to admin_data through g2 relationship.

ImplicitUsers, err := e.GetNamedImplicitUsersForResource("g2", "app")

var implicitUsers = e.GetNamedImplicitUsersForResource("g2", "app");

Reference​

GetRolesForUser()​

GetUsersForRole()​

HasRoleForUser()​

AddRoleForUser()​

AddRolesForUser()​

DeleteRoleForUser()​

DeleteRolesForUser()​

DeleteUser()​

DeleteRole()​

DeletePermission()​

AddPermissionForUser()​

AddPermissionsForUser()​

DeletePermissionForUser()​

DeletePermissionsForUser()​

GetPermissionsForUser()​

GetNamedPermissionsForUser()​

HasPermissionForUser()​

GetImplicitRolesForUser()​

GetNamedImplicitRolesForUser()​

GetImplicitUsersForRole()​

GetImplicitPermissionsForUser()​

GetNamedImplicitPermissionsForUser()​

GetDomainsForUser()​

GetImplicitResourcesForUser()​

GetImplicitUsersForPermission()​

GetImplicitObjectPatternsForUser()​

GetAllowedObjectConditions()​

GetImplicitUsersForResource()​

GetNamedImplicitUsersForResource()​

Reference

`GetRolesForUser()`

`GetUsersForRole()`

`HasRoleForUser()`

`AddRoleForUser()`

`AddRolesForUser()`

`DeleteRoleForUser()`

`DeleteRolesForUser()`

`DeleteUser()`

`DeleteRole()`

`DeletePermission()`

`AddPermissionForUser()`

`AddPermissionsForUser()`

`DeletePermissionForUser()`

`DeletePermissionsForUser()`

`GetPermissionsForUser()`

`GetNamedPermissionsForUser()`

`HasPermissionForUser()`

`GetImplicitRolesForUser()`

`GetNamedImplicitRolesForUser()`

`GetImplicitUsersForRole()`

`GetImplicitPermissionsForUser()`

`GetNamedImplicitPermissionsForUser()`

`GetDomainsForUser()`

`GetImplicitResourcesForUser()`

`GetImplicitUsersForPermission()`

`GetImplicitObjectPatternsForUser()`

`GetAllowedObjectConditions()`

`GetImplicitUsersForResource()`

`GetNamedImplicitUsersForResource()`