RBAC API

The RBAC API is a convenience layer for role-based operations (roles for user, users for role, permissions, etc.). It is a subset of the Management API aimed at RBAC use cases.

Rujukan

The global variable e represents an Enforcer instance.

e, err := NewEnforcer("examples/rbac_model.conf", "examples/rbac_policy.csv")

const e = await newEnforcer('examples/rbac_model.conf', 'examples/rbac_policy.csv')

$e = new Enforcer('examples/rbac_model.conf', 'examples/rbac_policy.csv');

e = casbin.Enforcer("examples/rbac_model.conf", "examples/rbac_policy.csv")

var e = new Enforcer("path/to/model.conf", "path/to/policy.csv");

let mut e = Enforcer::new("examples/rbac_model.conf", "examples/rbac_policy.csv").await?;

Enforcer e = new Enforcer("examples/rbac_model.conf", "examples/rbac_policy.csv");

`GetRolesForUser()`

Retrieves all roles assigned to a user.

Contohnya:

res := e.GetRolesForUser("alice")

const res = await e.getRolesForUser('alice')

$res = $e->getRolesForUser("alice");

roles = e.get_roles_for_user("alice")

var res = e.GetRolesForUser("alice");

let roles = e.get_roles_for_user("alice", None); // No domain

List<String> res = e.getRolesForUser("alice");

`GetUsersForRole()`

Retrieves all users assigned to a role.

Contohnya:

res := e.GetUsersForRole("data1_admin")

const res = await e.getUsersForRole('data1_admin')

$res = $e->getUsersForRole("data1_admin");

users = e.get_users_for_role("data1_admin")

var res = e.GetUsersForRole("data1_admin");

let users = e.get_users_for_role("data1_admin", None); // No domain

List<String> res = e.getUsersForRole("data1_admin");

`HasRoleForUser()`

Checks whether a user has a specific role.

Contohnya:

res := e.HasRoleForUser("alice", "data1_admin")

const res = await e.hasRoleForUser('alice', 'data1_admin')

$res = $e->hasRoleForUser("alice", "data1_admin");

has = e.has_role_for_user("alice", "data1_admin")

var res = e.HasRoleForUser("alice", "data1_admin");

let has = e.has_role_for_user("alice", "data1_admin", None); // No domain

boolean res = e.hasRoleForUser("alice", "data1_admin");

`AddRoleForUser()`

Assigns a role to a user. Mengembalikan salah jika pengguna sudah mempunyai peranan tersebut (iaitu tidak terjejas).

Contohnya:

e.AddRoleForUser("alice", "data2_admin")

await e.addRoleForUser('alice', 'data2_admin')

$e->addRoleForUser("alice", "data2_admin");

e.add_role_for_user("alice", "data2_admin")

var added = e.AddRoleForUser("alice", "data2_admin");
or
var added = await e.AddRoleForUserAsync("alice", "data2_admin");

let added = e.add_role_for_user("alice", "data2_admin", None).await?; // No domain

boolean added = e.addRoleForUser("alice", "data2_admin");

`AddRolesForUser()`

Assigns multiple roles to a user. Mengembalikan salah jika pengguna sudah memiliki salah satu peranan ini (alias tidak terpengaruh).

Contohnya:

var roles = []string{"data2_admin", "data1_admin"}
e.AddRolesForUser("alice", roles)

const roles = ["data1_admin", "data2_admin"];
roles.map((role) => e.addRoleForUser("alice", role));

var roles = new List<string> { "data1_admin", "data2_admin" };
var allAdded = e.AddRolesForUser("alice", roles);
// or async
var allAdded = await e.AddRolesForUserAsync("alice", roles);

let roles = vec!["data1_admin".to_owned(), "data2_admin".to_owned()];
let all_added = e.add_roles_for_user("alice", roles, None).await?; // No domain

`DeleteRoleForUser()`

Removes a role from a user. Mengembalikan salah jika pengguna tidak memiliki peranan tersebut (alias tidak terpengaruh).

Sebagai contoh:

e.DeleteRoleForUser("alice", "data1_admin")

await e.deleteRoleForUser('alice', 'data1_admin')

$e->deleteRoleForUser("alice", "data1_admin");

e.delete_role_for_user("alice", "data1_admin")

var deleted = e.DeleteRoleForUser("alice", "data1_admin");
or
var deleted = await e.DeleteRoleForUser("alice", "data1_admin");

let deleted = e.delete_role_for_user("alice", "data1_admin", None).await?; // No domain

boolean deleted = e.deleteRoleForUser("alice", "data1_admin");

`DeleteRolesForUser()`

Removes all roles from a user. Mengembalikan salah jika pengguna tidak memiliki peranan apa pun (alias tidak terpengaruh).

Sebagai contoh:

e.DeleteRolesForUser("alice")

await e.deleteRolesForUser('alice')

$e->deleteRolesForUser("alice");

e.delete_roles_for_user("alice")

var deletedAtLeastOne = e.DeleteRolesForUser("alice");
or
var deletedAtLeastOne = await e.DeleteRolesForUserAsync("alice");

let deleted_at_least_one = e.delete_roles_for_user("alice", None).await?; // No domain

boolean deletedAtLeastOne = e.deleteRolesForUser("alice");

`DeleteUser()`

Removes a user from the system. Mengembalikan salah jika pengguna tidak wujud (atau tidak terjejas).

Sebagai contoh:

e.DeleteUser("alice")

await e.deleteUser('alice')

$e->deleteUser("alice");

e.delete_user("alice")

var deleted = e.DeleteUser("alice");
or
var deleted = await e.DeleteUserAsync("alice");

let deleted = e.delete_user("alice").await?;

boolean deleted = e.deleteUser("alice");

`DeleteRole()`

Removes a role from the system.

Sebagai contoh:

e.DeleteRole("data2_admin")

await e.deleteRole("data2_admin")

$e->deleteRole("data2_admin");

e.delete_role("data2_admin")

var deleted = e.DeleteRole("data2_admin");
or
var deleted = await e.DeleteRoleAsync("data2_admin");

let deleted = e.delete_role("data2_admin").await?;

e.deleteRole("data2_admin");

`DeletePermission()`

Removes a permission from the system. Mengembalikan salah jika kebenaran tidak wujud (atau tidak terjejas).

Sebagai contoh:

e.DeletePermission("read")

await e.deletePermission('read')

$e->deletePermission("read");

e.delete_permission("read")

var deleted = e.DeletePermission("read");
or
var deleted = await e.DeletePermissionAsync("read");

let deleted = e.delete_permission(vec!["read".to_owned()]).await?;

boolean deleted = e.deletePermission("read");

`AddPermissionForUser()`

Grants a permission to a user or role. Mengembalikan salah jika pengguna atau peranan sudah mempunyai kebenaran tersebut (iaitu tidak terjejas).

Sebagai contoh:

e.AddPermissionForUser("bob", "read")

await e.addPermissionForUser('bob', 'read')

$e->addPermissionForUser("bob", "read");

e.add_permission_for_user("bob", "read")

var added = e.AddPermissionForUser("bob", "read");
or
var added = await e.AddPermissionForUserAsync("bob", "read");

let added = e.add_permission_for_user("bob", vec!["read".to_owned()]).await?;

boolean added = e.addPermissionForUser("bob", "read");

`AddPermissionsForUser()`

Grants multiple permissions to a user or role. Mengembalikan salah jika pengguna atau peranan sudah mempunyai salah satu daripada kebenaran tersebut (iaitu tidak terjejas).

Sebagai contoh:

var permissions = [][]string{{"data1", "read"},{"data2","write"}}
for i := 0; i < len(permissions); i++ {
    e.AddPermissionsForUser("alice", permissions[i])
}

const permissions = [
    ["data1", "read"],
    ["data2", "write"],
];

permissions.map((permission) => e.addPermissionForUser("bob", ...permission));

var permissions = new List<List<string>>
{
    new List<string> { "data1", "read" },
    new List<string> { "data2", "write" }
};

foreach (var permission in permissions)
{
    var added = e.AddPermissionForUser("bob", permission.ToArray());
    // or async
    var added = await e.AddPermissionForUserAsync("bob", permission.ToArray());
}

let permissions = vec![
    vec!["data1".to_owned(), "read".to_owned()],
    vec!["data2".to_owned(), "write".to_owned()],
];

let all_added = e.add_permissions_for_user("bob", permissions).await?;

`DeletePermissionForUser()`

Revokes a permission from a user or role. Mengembalikan salah jika pengguna atau peranan tidak mempunyai kebenaran (aka tidak terjejas).

Sebagai contoh:

e.DeletePermissionForUser("bob", "read")

await e.deletePermissionForUser("bob", "read")

$e->deletePermissionForUser("bob", "read");

e.delete_permission_for_user("bob", "read")

var deleted = e.DeletePermissionForUser("bob", "read");
or
var deleted = await e.DeletePermissionForUserAsync("bob", "read");

let deleted = e.delete_permission_for_user("bob", vec!["read".to_owned()]).await?;

boolean deleted = e.deletePermissionForUser("bob", "read");

`DeletePermissionsForUser()`

Revokes all permissions from a user or role. Mengembalikan salah jika pengguna atau peranan tidak mempunyai sebarang kebenaran (aka tidak terjejas).

Sebagai contoh:

e.DeletePermissionsForUser("bob")

await e.deletePermissionsForUser('bob')

$e->deletePermissionsForUser("bob");

e.delete_permissions_for_user("bob")

var deletedAtLeastOne = e.DeletePermissionsForUser("bob");
or
var deletedAtLeastOne = await e.DeletePermissionsForUserAsync("bob");

let deleted_at_least_one = e.delete_permissions_for_user("bob").await?;

boolean deletedAtLeastOne = e.deletePermissionForUser("bob");

`GetPermissionsForUser()`

Retrieves all permissions for a user or role.

Sebagai contoh:

e.GetPermissionsForUser("bob")

await e.getPermissionsForUser('bob')

$e->getPermissionsForUser("bob");

e.get_permissions_for_user("bob")

var permissions = e.GetPermissionsForUser("bob");

List<List<String>> permissions = e.getPermissionsForUser("bob");

`GetNamedPermissionsForUser()`

GetNamedPermissionsForUser gets permissions for a user or role by named policy.

Sebagai contoh:

p, alice, data1, read
p, bob, data2, write
p2, admin, create
g, alice, admin

GetNamedPermissionsForUser("p", "alice") will return [["alice", "data1", "read"]]. GetNamedPermissionsForUser("p2", "alice") will return [["admin", "create"]].

permissions, err := e.GetNamedPermissionsForUser("p", "alice")

var permissions = e.GetNamedPermissionsForUser("p", "alice");

permissions = e.get_named_permissions_for_user("p", "alice")

`HasPermissionForUser()`

HasPermissionForUser menentukan sama ada pengguna mempunyai kebenaran.

Sebagai contoh:

e.HasPermissionForUser("alice", []string{"read"})

await e.hasPermissionForUser('alice', 'read')

$e->hasPermissionForUser("alice", []string{"read"});

has = e.has_permission_for_user("alice", "read")

var has = e.HasPermissionForUser("bob", "read");

let has = e.has_permission_for_user("alice", vec!["data1".to_owned(), "read".to_owned()]);

boolean has = e.hasPermissionForUser("alice", "read");

`GetImplicitRolesForUser()`

GetImplicitRolesForUser mendapatkan peranan tersirat yang dimiliki oleh pengguna. Berbanding dengan GetRolesForUser(), fungsi ini mengambil peranan tidak langsung selain peranan langsung.

Sebagai contoh:

g, alice, role:admin  
g, role:admin, role:user  

GetRolesForUser("alice") hanya boleh mendapatkan: ["role:admin"].
Tetapi GetImplicitRolesForUser("alice") akan mendapat: ["role:admin", "role:user"].

Sebagai contoh:

e.GetImplicitRolesForUser("alice")

await e.getImplicitRolesForUser("alice")

$e->getImplicitRolesForUser("alice");

e.get_implicit_roles_for_user("alice")

var implicitRoles = e.GetImplicitRolesForUser("alice");

e.get_implicit_roles_for_user("alice", None); // No domain

List<String> implicitRoles = e.getImplicitRolesForUser("alice");

`GetNamedImplicitRolesForUser()`

GetNamedImplicitRolesForUser gets implicit roles that a user has by named policy.

Sebagai contoh:

g, alice, admin
g, admin, super_admin
g2, alice, user
g2, user, guest

GetNamedImplicitRolesForUser("g", "alice") will return ["admin", "super_admin"]. GetNamedImplicitRolesForUser("g2", "alice") will return ["user", "guest"].

roles, err := e.GetNamedImplicitRolesForUser("g", "alice")

var roles = e.GetNamedImplicitRolesForUser("g", "alice");

roles = e.get_named_implicit_roles_for_user("g", "alice")

`GetImplicitUsersForRole()`

DapatkanPenggunaTersiratUntukPeranan mendapat semua pengguna yang mewarisi peranan tersebut. Berbanding dengan DapatkanPenggunaUntukPeranan(), fungsi ini mengambil pengguna tidak langsung.

Sebagai contoh:

g, alice, role:admin  
g, role:admin, role:user  

DapatkanPenggunaUntukPeranan("peranan:pengguna") hanya boleh mendapat: ["peranan:admin"].
Tetapi DapatkanPenggunaTersiratUntukPeranan("peranan:pengguna") akan mendapat: ["peranan:admin", "alice"].

Sebagai contoh:

users := e.GetImplicitUsersForRole("role:user")

const users = e.getImplicitUsersForRole("role:user");

List<String> users = e.getImplicitUsersForRole("role:user");

`GetImplicitPermissionsForUser()`

DapatkanKebenaranTersiratUntukPengguna mendapat kebenaran tersirat untuk pengguna atau peranan.
Berbanding dengan DapatkanKebenaranUntukPengguna(), fungsi ini mengambil kebenaran untuk peranan yang diwarisi.

Sebagai contoh:

p, admin, data1, read  
p, alice, data2, read  
g, alice, admin 

GetPermissionsForUser("alice") hanya boleh mendapatkan: [["alice", "data2", "read"]].
Tetapi GetImplicitPermissionsForUser("alice") akan mendapat: [["admin", "data1", "read"], ["alice", "data2", "read"]].

Sebagai contoh:

e.GetImplicitPermissionsForUser("alice")

await e.getImplicitPermissionsForUser("alice")

$e->getImplicitPermissionsForUser("alice");

e.get_implicit_permissions_for_user("alice")

var implicitPermissions = e.GetImplicitPermissionsForUser("alice");

e.get_implicit_permissions_for_user("alice", None); // No domain

List<List<String>> implicitPermissions = e.getImplicitPermissionsForUser("alice");

`GetNamedImplicitPermissionsForUser()`

GetNamedImplicitPermissionsForUser mendapatkan kebenaran tersirat untuk pengguna atau peranan berdasarkan dasar bernama

Sebagai contoh:

p, admin, data1, read
p2, admin, create
g, alice, admin

GetImplicitPermissionsForUser("alice") hanya mendapat: [["admin", "data1", "read"]], yang dasarnya adalah lalai "p"

Tetapi anda boleh menentukan dasar sebagai "p2" untuk mendapatkan: [["admin", "create"]] melalui GetNamedImplicitPermissionsForUser("p2","alice")

Contohnya:

e.GetNamedImplicitPermissionsForUser("p2","alice")

var permissions = e.GetNamedImplicitPermissionsForUser("p2", "alice");

e.get_named_implicit_permissions_for_user("p2", "alice")

`GetDomainsForUser()`

GetDomainsForUser mendapatkan semua domain yang dimiliki oleh pengguna.

Sebagai contoh:

p, admin, domain1, data1, read
p, admin, domain2, data2, read
p, admin, domain2, data2, write
g, alice, admin, domain1
g, alice, admin, domain2

GetDomainsForUser("alice") boleh mendapatkan ["domain1", "domain2"]

Sebagai contoh:

result, err := e.GetDomainsForUser("alice")

var result = e.GetDomainsForUser("alice");

`GetImplicitResourcesForUser()`

Returns all policies that apply to a user, including those inherited through roles.

Sebagai contoh:

p, alice, data1, read
p, bob, data2, write
p, data2_admin, data2, read
p, data2_admin, data2, write

g, alice, data2_admin

GetImplicitResourcesForUser("alice") akan mengembalikan

resources, err := e.GetImplicitResourcesForUser("alice")

var resources = e.GetImplicitResourcesForUser("alice");

`GetImplicitUsersForPermission()`

Retrieves all users with a specific permission, including those with implicit permissions through roles.

Sebagai contoh:

p, admin, data1, read
p, bob, data1, read
g, alice, admin

GetImplicitUsersForPermission("data1", "read") akan mengembalikan: ["alice", "bob"].

Perhatian: hanya pengguna yang akan dikembalikan, peranan (argumen ke-2 dalam "g") akan dikecualikan.

users, err := e.GetImplicitUsersForPermission("data1", "read")

var users = e.GetImplicitUsersForPermission("data1", "read");

`GetImplicitObjectPatternsForUser()`

Returns all object patterns (including wildcards) that a user can access for a given domain and action.

Sebagai contoh:

p, admin, chronicle/123, location/*, read
p, user, chronicle/456, location/789, read
g, alice, admin
g, bob, user

GetImplicitObjectPatternsForUser("alice", "chronicle/123", "read") will return ["location/*"]. GetImplicitObjectPatternsForUser("bob", "chronicle/456", "read") will return ["location/789"].

patterns, err := e.GetImplicitObjectPatternsForUser("alice", "chronicle/123", "read")

const patterns = await e.getImplicitObjectPatternsForUser("alice", "chronicle/123", "read")

$patterns = $e->getImplicitObjectPatternsForUser("alice", "chronicle/123", "read");

patterns = e.get_implicit_object_patterns_for_user("alice", "chronicle/123", "read")

var patterns = e.GetImplicitObjectPatternsForUser("alice", "chronicle/123", "read");

let patterns = e.get_implicit_object_patterns_for_user("alice", "chronicle/123", "read").await?;

List<String> patterns = e.getImplicitObjectPatternsForUser("alice", "chronicle/123", "read");

`GetAllowedObjectConditions()`

Returns object conditions that a user can access.

Sebagai contoh:

p, alice, r.obj.price < 25, read
p, admin, r.obj.category_id = 2, read
p, bob, r.obj.author = bob, write

g, alice, admin

e.GetAllowedObjectConditions("alice", "read", "r.obj.") akan mengembalikan ["price < 25", "category_id = 2"], nil

Perhatian:

awalan: Anda boleh menyesuaikan awalan syarat objek, dan "r.obj." biasanya digunakan sebagai awalan. Selepas mengalih keluar awalan, bahagian yang tinggal ialah syarat objek. Jika terdapat dasar obj yang tidak memenuhi keperluan awalan, errors.ERR_OBJ_CONDITION akan dikembalikan.
Jika tatasusunan 'objectConditions' kosong, kembalikan errors.ERR_EMPTY_CONDITION

conditions, err := e.GetAllowedObjectConditions("alice", "read", "r.obj.")

var conditions = e.GetAllowedObjectConditions("alice", "read", "r.obj.");

`GetImplicitUsersForResource()`

Returns all users with access to a resource, including those with implicit permissions through roles.

Sebagai contoh:

p, alice, data1, read
p, bob, data2, write
p, data2_admin, data2, read
p, data2_admin, data2, write
g, alice, data2_admin

Contohnya:

GetImplicitUsersForResource("data2") akan mengembalikan [["bob", "data2", "write"], ["alice", "data2", "read"] ["alice", "data2", "write"]], nil.

ImplicitUsers, err := e.GetImplicitUsersForResource("data2")

var implicitUsers = e.GetImplicitUsersForResource("data2");

nota

Hanya pengguna akan dikembalikan, peranan (argumen ke-2 dalam "g") akan dikecualikan.

`GetNamedImplicitUsersForResource()`

Returns all users with access to a resource through a named policy, including those with implicit permissions through roles. This function handles resource role relationships through named policies (e.g., g2, g3, etc.).

Sebagai contoh:

p, admin_group, admin_data, *
g, admin, admin_group
g2, app, admin_data

GetNamedImplicitUsersForResource("g2", "app") will return users who have access to admin_data through g2 relationship.

ImplicitUsers, err := e.GetNamedImplicitUsersForResource("g2", "app")

var implicitUsers = e.GetNamedImplicitUsersForResource("g2", "app");

Rujukan​

GetRolesForUser()​

GetUsersForRole()​

HasRoleForUser()​

AddRoleForUser()​

AddRolesForUser()​

DeleteRoleForUser()​

DeleteRolesForUser()​

DeleteUser()​

DeleteRole()​

DeletePermission()​

AddPermissionForUser()​

AddPermissionsForUser()​

DeletePermissionForUser()​

DeletePermissionsForUser()​

GetPermissionsForUser()​

GetNamedPermissionsForUser()​

HasPermissionForUser()​

GetImplicitRolesForUser()​

GetNamedImplicitRolesForUser()​

GetImplicitUsersForRole()​

GetImplicitPermissionsForUser()​

GetNamedImplicitPermissionsForUser()​

GetDomainsForUser()​

GetImplicitResourcesForUser()​

GetImplicitUsersForPermission()​

GetImplicitObjectPatternsForUser()​

GetAllowedObjectConditions()​

GetImplicitUsersForResource()​

GetNamedImplicitUsersForResource()​

Rujukan

`GetRolesForUser()`

`GetUsersForRole()`

`HasRoleForUser()`

`AddRoleForUser()`

`AddRolesForUser()`

`DeleteRoleForUser()`

`DeleteRolesForUser()`

`DeleteUser()`

`DeleteRole()`

`DeletePermission()`

`AddPermissionForUser()`

`AddPermissionsForUser()`

`DeletePermissionForUser()`

`DeletePermissionsForUser()`

`GetPermissionsForUser()`

`GetNamedPermissionsForUser()`

`HasPermissionForUser()`

`GetImplicitRolesForUser()`

`GetNamedImplicitRolesForUser()`

`GetImplicitUsersForRole()`

`GetImplicitPermissionsForUser()`

`GetNamedImplicitPermissionsForUser()`

`GetDomainsForUser()`

`GetImplicitResourcesForUser()`

`GetImplicitUsersForPermission()`

`GetImplicitObjectPatternsForUser()`

`GetAllowedObjectConditions()`

`GetImplicitUsersForResource()`

`GetNamedImplicitUsersForResource()`