跳到主要内容

Management API

Management API 涵盖所有策略和分组（角色）操作：获取、添加、删除、更新、过滤。以下，e 是一个 Enforcer 实例。

Filtered API​

Filtered 方法接受 (fieldIndex int, fieldValues ...string)：匹配从 fieldIndex 开始，fieldValues 是连续位置上的必需值。在 fieldValues 中使用 "" 作为该位置的通配符。

示例：

p, alice, book, read
p, bob, book, read
p, bob, book, write
p, alice, pen, get
p, bob, pen ,get
e.GetFilteredPolicy(1, "book") // returns: [["alice", "book", "read"], ["bob", "book", "read"], ["bob", "book", "write"]]

e.GetFilteredPolicy(1, "book", "read") // returns: [["alice", "book", "read"], ["bob", "book", "read"]]

e.GetFilteredPolicy(0, "alice", "", "read") // returns: [[alice book read]]

e.GetFilteredPolicy(0, "alice") // returns: [["alice", "book", "read"], ["alice", "pen", "get"]]

API Reference​

e, err := NewEnforcer("examples/rbac_model.conf", "examples/rbac_policy.csv")

Enforce()​

Enforce 决定“主体”是否可以使用“操作”访问“对象”，输入参数通常为：(sub, obj, act)。

例如：

ok, err := e.Enforce(request)

EnforceWithMatcher()​

EnforceWithMatcher use a custom matcher to decides whether a "subject" can access a "object" with the operation "action", input parameters are usually: (matcher, sub, obj, act), use model matcher by default when matcher is "".

例如：

ok, err := e.EnforceWithMatcher(matcher, request)

EnforceEx()​

EnforceEx explain enforcement by informing matched rules.

例如：

ok, reason, err := e.EnforceEx(request)

EnforceExWithMatcher()​

EnforceExWithMatcher use a custom matcher and explain enforcement by informing matched rules.

例如：

ok, reason, err := e.EnforceExWithMatcher(matcher, request)

BatchEnforce()​

BatchEnforce enforces each request and returns result in a bool array

例如：

boolArray, err := e.BatchEnforce(requests)

GetAllSubjects()​

GetAllSubjects gets the list of subjects that show up in the current policy.

例如：

allSubjects := e.GetAllSubjects()

GetAllNamedSubjects()​

GetAllNamedSubjects gets the list of subjects that show up in the current named policy.

例如：

allNamedSubjects := e.GetAllNamedSubjects("p")

GetAllObjects()​

GetAllObjects gets the list of objects that show up in the current policy.

例如：

allObjects := e.GetAllObjects()

GetAllNamedObjects()​

GetAllNamedObjects gets the list of objects that show up in the current named policy.

例如：

allNamedObjects := e.GetAllNamedObjects("p")

GetAllActions()​

GetAllActions gets the list of actions that show up in the current policy.

例如：

allActions := e.GetAllActions()

GetAllNamedActions()​

GetAllNamedActions gets the list of actions that show up in the current named policy.

例如：

allNamedActions := e.GetAllNamedActions("p")

GetAllRoles()​

GetAllRoles gets the list of roles that show up in the current policy.

例如：

allRoles = e.GetAllRoles()

GetAllNamedRoles()​

GetAllNamedRoles gets the list of roles that show up in the current named policy.

例如：

allNamedRoles := e.GetAllNamedRoles("g")

GetPolicy()​

GetPolicy gets all the authorization rules in the policy.

例如：

policy = e.GetPolicy()

GetFilteredPolicy()​

GetFilteredPolicy gets all the authorization rules in the policy, field filters can be specified.

例如：

filteredPolicy := e.GetFilteredPolicy(0, "alice")

GetNamedPolicy()​

GetNamedPolicy gets all the authorization rules in the named policy.

例如：

namedPolicy := e.GetNamedPolicy("p")

GetFilteredNamedPolicy()​

GetFilteredNamedPolicy gets all the authorization rules in the named policy, field filters can be specified.

例如：

filteredNamedPolicy = e.GetFilteredNamedPolicy("p", 0, "bob")

GetGroupingPolicy()​

GetGroupingPolicy gets all the role inheritance rules in the policy.

例如：

groupingPolicy := e.GetGroupingPolicy()

GetFilteredGroupingPolicy()​

GetFilteredGroupingPolicy gets all the role inheritance rules in the policy, field filters can be specified.

例如：

filteredGroupingPolicy := e.GetFilteredGroupingPolicy(0, "alice")

GetNamedGroupingPolicy()​

GetNamedGroupingPolicy gets all the role inheritance rules in the policy.

例如：

namedGroupingPolicy := e.GetNamedGroupingPolicy("g")

GetFilteredNamedGroupingPolicy()​

GetFilteredNamedGroupingPolicy gets all the role inheritance rules in the policy.

例如：

namedGroupingPolicy := e.GetFilteredNamedGroupingPolicy("g", 0, "alice")

HasPolicy()​

HasPolicy 确定是否存在授权规则。

例如：

hasPolicy := e.HasPolicy("data2_admin", "data2", "read")

HasNamedPolicy()​

HasNamedPolicy 确定是否存在命名的授权规则。

例如：

hasNamedPolicy := e.HasNamedPolicy("p", "data2_admin", "data2", "read")

AddPolicy()​

AddPolicy 向当前策略添加一条授权规则。 如果该规则已存在，函数返回 false 且不会添加该规则。 否则，函数通过添加新规则返回 true。

例如：

added := e.AddPolicy('eve', 'data3', 'read')

AddPolicies()​

AddPolicies 向当前策略添加多条授权规则。 该操作具有原子性。 因此，如果待添加的授权规则与当前策略不一致，函数将返回 false，且不会向当前策略添加任何规则。 如果所有待添加的授权规则都与现有策略规则一致，函数将返回 true，并将每条规则添加到当前策略中。

例如：

rules := [][] string {
    []string {"jack", "data4", "read"},
    []string {"katy", "data4", "write"},
    []string {"leyo", "data4", "read"},
    []string {"ham", "data4", "write"},
}

areRulesAdded := e.AddPolicies(rules)

AddPoliciesEx()​

AddPoliciesEx 向当前策略添加多条授权规则。 如果规则已存在，则不会添加该规则。 但与 AddPolicies 不同，其他不存在的规则会被添加，而不是直接返回 false。

例如：

ok, err := e.AddPoliciesEx([][]string{{"user1", "data1", "read"}, {"user2", "data2", "read"}})

AddNamedPolicy()​

AddNamedPolicy 向当前命名策略添加一条授权规则。 如果该规则已存在，函数返回 false 且不会添加该规则。 否则，函数通过添加新规则返回 true。

例如：

added := e.AddNamedPolicy("p", "eve", "data3", "read")

AddNamedPolicies()​

AddNamedPolicies 向当前命名策略添加多条授权规则。 该操作具有原子性。 因此，如果待添加的授权规则与当前策略不一致，函数将返回 false，且不会向当前策略添加任何规则。 如果所有待添加的授权规则都与现有策略规则一致，函数将返回 true，并将每条规则添加到当前策略中。

例如：

rules := [][] string {
    []string {"jack", "data4", "read"},
    []string {"katy", "data4", "write"},
    []string {"leyo", "data4", "read"},
    []string {"ham", "data4", "write"},
}

areRulesAdded := e.AddNamedPolicies("p", rules)

AddNamedPoliciesEx()​

AddNamedPoliciesEx 向当前命名策略添加多条授权规则。 如果规则已存在，则不会添加该规则。 但与 AddNamedPolicies 不同，其他不存在的规则会被添加，而不是直接返回 false。

例如：

ok, err := e.AddNamedPoliciesEx("p", [][]string{{"user1", "data1", "read"}, {"user2", "data2", "read"}})

SelfAddPoliciesEx()​

SelfAddPoliciesEx 在禁用 autoNotifyWatcher 的情况下，向当前命名策略添加多条授权规则。 如果规则已存在，则不会添加该规则。 但与 SelfAddPolicies 不同，其他不存在的规则会被添加，而不是直接返回 false。

例如：

ok, err := e.SelfAddPoliciesEx("p", "p", [][]string{{"user1", "data1", "read"}, {"user2", "data2", "read"}})

RemovePolicy()​

RemovePolicy 从当前策略中移除一条授权规则。

例如：

removed := e.RemovePolicy("alice", "data1", "read")

RemovePolicies()​

RemovePolicies 从当前策略中移除多条授权规则。 该操作具有原子性。 因此，如果待移除的授权规则与当前策略不一致，函数将返回 false，且不会从当前策略中移除任何规则。 如果所有待移除的授权规则都与现有策略规则一致，函数将返回 true，并从当前策略中移除每条规则。

例如：

rules := [][] string {
    []string {"jack", "data4", "read"},
    []string {"katy", "data4", "write"},
    []string {"leyo", "data4", "read"},
    []string {"ham", "data4", "write"},
}

areRulesRemoved := e.RemovePolicies(rules)

RemoveFilteredPolicy()​

RemoveFilteredPolicy 从当前策略中移除一条授权规则，可以指定字段过滤器。 RemovePolicy 从当前策略中移除一条授权规则。

例如：

removed := e.RemoveFilteredPolicy(0, "alice", "data1", "read")

RemoveNamedPolicy()​

RemoveNamedPolicy 从当前命名策略中移除一条授权规则。

例如：

removed := e.RemoveNamedPolicy("p", "alice", "data1", "read")

RemoveNamedPolicies()​

RemoveNamedPolicies 从当前命名策略中移除多条授权规则。 该操作具有原子性。 因此，如果待移除的授权规则与当前策略不一致，函数将返回 false，且不会从当前策略中移除任何规则。 如果所有待移除的授权规则都与现有策略规则一致，函数将返回 true，并从当前策略中移除每条规则。

例如：

rules := [][] string {
    []string {"jack", "data4", "read"},
    []string {"katy", "data4", "write"},
    []string {"leyo", "data4", "read"},
    []string {"ham", "data4", "write"},
}

areRulesRemoved := e.RemoveNamedPolicies("p", rules)

RemoveFilteredNamedPolicy()​

RemoveFilteredNamedPolicy 从当前命名策略中移除一条授权规则，可以指定字段过滤器。

例如：

removed := e.RemoveFilteredNamedPolicy("p", 0, "alice", "data1", "read")

HasGroupingPolicy()​

HasGroupingPolicy 确定是否存在角色继承规则。

例如：

has := e.HasGroupingPolicy("alice", "data2_admin")

HasNamedGroupingPolicy()​

HasNamedGroupingPolicy 确定是否存在命名的角色继承规则。

例如：

has := e.HasNamedGroupingPolicy("g", "alice", "data2_admin")

AddGroupingPolicy()​

AddGroupingPolicy 向当前策略添加一条角色继承规则。 如果该规则已存在，函数返回 false 且不会添加该规则。 否则，函数通过添加新规则返回 true。

例如：

added := e.AddGroupingPolicy("group1", "data2_admin")

AddGroupingPolicies()​

AddGroupingPolicies 向当前策略添加多条角色继承规则。 该操作具有原子性。 因此，如果待添加的授权规则与当前策略不一致，函数将返回 false，且不会向当前策略添加任何规则。 如果所有待添加的规则都与现有策略规则一致，函数将返回 true，并将每条规则添加到当前策略中。

例如：

rules := [][] string {
    []string {"ham", "data4_admin"},
    []string {"jack", "data5_admin"},
}

areRulesAdded := e.AddGroupingPolicies(rules)

AddGroupingPoliciesEx()​

AddGroupingPoliciesEx 向当前策略添加多条角色继承规则。 如果规则已存在，则不会添加该规则。 但与 AddGroupingPolicies 不同，其他不存在的规则会被添加，而不是直接返回 false。

例如：

ok, err := e.AddGroupingPoliciesEx([][]string{{"user1", "member"}, {"user2", "member"}})

AddNamedGroupingPolicy()​

AddNamedGroupingPolicy adds a named role inheritance rule to the current policy. If the rule already exists, the function returns false and the rule will not be added. Otherwise the function returns true by adding the new rule.

例如：

added := e.AddNamedGroupingPolicy("g", "group1", "data2_admin")

AddNamedGroupingPolicies()​

AddNamedGroupingPolicies adds named role inheritance rules to the current policy. The operation is atomic in nature. Hence, if authorization rules consists of rules which are not consistent with the current policy, the function returns false and no policy rule is added to the current policy. If all the authorization rules are consistent with the policy rules, the function returns true and each policy rule is added to the current policy.

例如：

rules := [][] string {
    []string {"ham", "data4_admin"},
    []string {"jack", "data5_admin"},
}

areRulesAdded := e.AddNamedGroupingPolicies("g", rules)

AddNamedGroupingPoliciesEx()​

AddNamedGroupingPoliciesEx adds named role inheritance rules to the current policy. If the rule already exists, the rule will not be added. But unlike AddNamedGroupingPolicies, other non-existent rules are added instead of returning false directly

例如：

ok, err := e.AddNamedGroupingPoliciesEx("g", [][]string{{"user1", "member"}, {"user2", "member"}})

RemoveGroupingPolicy()​

RemoveGroupingPolicy removes a role inheritance rule from the current policy.

例如：

removed := e.RemoveGroupingPolicy("alice", "data2_admin")

RemoveGroupingPolicies()​

RemoveGroupingPolicies removes role inheritance rules from the current policy. The operation is atomic in nature. Hence, if authorization rules consists of rules which are not consistent with the current policy, the function returns false and no policy rule is removed from the current policy. If all the authorization rules are consistent with the policy rules, the function returns true and each policy rule is removed from the current policy.

例如：

rules := [][] string {
                []string {"ham", "data4_admin"},
                []string {"jack", "data5_admin"},
        }

areRulesRemoved := e.RemoveGroupingPolicies(rules)

RemoveFilteredGroupingPolicy()​

RemoveFilteredGroupingPolicy removes a role inheritance rule from the current policy, field filters can be specified.

例如：

removed := e.RemoveFilteredGroupingPolicy(0, "alice")

RemoveNamedGroupingPolicy()​

RemoveNamedGroupingPolicy removes a role inheritance rule from the current named policy.

例如：

removed := e.RemoveNamedGroupingPolicy("g", "alice")

RemoveNamedGroupingPolicies()​

RemoveNamedGroupingPolicies removes named role inheritance rules from the current policy. The operation is atomic in nature. Hence, if authorization rules consists of rules which are not consistent with the current policy, the function returns false and no policy rule is removed from the current policy. If all the authorization rules are consistent with the policy rules, the function returns true and each policy rule is removed from the current policy.

例如：

rules := [][] string {
    []string {"ham", "data4_admin"},
    []string {"jack", "data5_admin"},
}

areRulesRemoved := e.RemoveNamedGroupingPolicies("g", rules)

RemoveFilteredNamedGroupingPolicy()​

RemoveFilteredNamedGroupingPolicy removes a role inheritance rule from the current named policy, field filters can be specified.

例如：

removed := e.RemoveFilteredNamedGroupingPolicy("g", 0, "alice")

UpdatePolicy()​

UpdatePolicy update a old policy to new policy.

例如：

updated, err := e.UpdatePolicy([]string{"eve", "data3", "read"}, []string{"eve", "data3", "write"})

UpdatePolicies()​

UpdatePolicies updates all old policies to new policies.

例如：

updated, err := e.UpdatePolicies([][]string{{"eve", "data3", "read"}, {"jack", "data3", "read"}}, [][]string{{"eve", "data3", "write"}, {"jack", "data3", "write"}})

UpdateNamedPolicy()​

UpdateNamedPolicy update a old policy to new policy in the named policy.

例如：

updated, err := e.UpdateNamedPolicy("p", []string{"eve", "data3", "read"}, []string{"eve", "data3", "write"})

UpdateNamedPolicies()​

UpdateNamedPolicies updates all old policies to new policies in the named policy.

例如：

updated, err := e.UpdateNamedPolicies("p", [][]string{{"eve", "data3", "read"}, {"jack", "data3", "read"}}, [][]string{{"eve", "data3", "write"}, {"jack", "data3", "write"}})

UpdateFilteredPolicies()​

UpdateFilteredPolicies updates all old policies that match the filter to new policies.

例如：

updated, err := e.UpdateFilteredPolicies([][]string{{"eve", "data3", "write"}}, 0, "eve", "data3", "read")

AddFunction()​

AddFunction adds a customized function.

例如：

func CustomFunction(key1 string, key2 string) bool {
    if key1 == "/alice_data2/myid/using/res_id" && key2 == "/alice_data/:resource" {
        return true
    } else if key1 == "/alice_data2/myid/using/res_id" && key2 == "/alice_data2/:id/using/:resId" {
        return true
    } else {
        return false
    }
}

func CustomFunctionWrapper(args ...interface{}) (interface{}, error) {
    key1 := args[0].(string)
    key2 := args[1].(string)

    return bool(CustomFunction(key1, key2)), nil
}

e.AddFunction("keyMatchCustom", CustomFunctionWrapper)

LoadFilteredPolicy()​

LoadFilteredPolicy loads filtered policies from file/database.

例如：

err := e.LoadFilteredPolicy()

LoadIncrementalFilteredPolicy()​

LoadIncrementalFilteredPolicy append a filtered policy from file/database.

例如：

err := e.LoadIncrementalFilteredPolicy()

UpdateGroupingPolicy()​

UpdateGroupingPolicy updates oldRule to newRulein g section

例如：

succeed, err : = e.UpdateGroupingPolicy([]string{"data3_admin", "data4_admin"}, []string{"admin", "data4_admin"})

UpdateNamedGroupingPolicy()​

UpdateNamedGroupingPolicy updates oldRule named ptype to newRulein g section

例如：

succeed, err : = e.UpdateGroupingPolicy("g1",[]string{"data3_admin", "data4_admin"}, []string{"admin", "data4_admin"})

SetFieldIndex()​

SetFieldIndex suport customization of conventional name and position of sub, obj, domain and priority.

[policy_definition]
p = customized_priority, obj, act, eft, subject

例如：

e.SetFieldIndex("p", constant.PriorityIndex, 0)
e.SetFieldIndex("p", constant.SubjectIndex, 4)

Comments are powered by giscus and GitHub Discussions. They load from giscus.app and GitHub only after you click the button below.