- Notifications
You must be signed in to change notification settings - Fork54
An authorization library that supports access control models like ACL, RBAC, ABAC in Laravel.
License
php-casbin/laravel-authz
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
Laravel-authz is an authorization library for the laravel framework.
It's based onCasbin, an authorization library that supports access control models like ACL, RBAC, ABAC.
All you need to learn to useCasbin first.
Require this package in thecomposer.json of your Laravel project. This will download the package.
composer require casbin/laravel-authzTheLauthz\LauthzServiceProvider isauto-discovered and registered by default, but if you want to register it yourself:
Add the ServiceProvider inconfig/app.php
'providers' => [/* * Package Service Providers... */Lauthz\LauthzServiceProvider::class,]
The Enforcer facade is alsoauto-discovered, but if you want to add it manually:
Add the Facade inconfig/app.php
'aliases' => [// ...'Enforcer' =>Lauthz\Facades\Enforcer::class,]
To publish the config, run the vendor publish command:
php artisan vendor:publishThis will create a new model config file namedconfig/lauthz-rbac-model.conf and a new lauthz config file namedconfig/lauthz.php.
To migrate the migrations, run the migrate command:
php artisan migrateThis will create a new table namedrules
Once installed you can do stuff like this:
useEnforcer;// adds permissions to a userEnforcer::addPermissionForUser('eve','articles','read');// adds a role for a user.Enforcer::addRoleForUser('eve','writer');// adds permissions to a roleEnforcer::addPolicy('writer','articles','edit');
You can check if a user has a permission like this:
// to check if a user has permissionif (Enforcer::enforce("eve","articles","edit")) {// permit eve to edit articles}else {// deny the request, show an error}
By default,Gate checks will be automatically intercepted. You can check if a user has a permission with Laravel's defaultcan function:
$user->can('articles,read');
It provides a very rich api to facilitate various operations on the Policy:
Gets all roles:
Enforcer::getAllRoles();// ['writer', 'reader']
Gets all the authorization rules in the policy.:
Enforcer::getPolicy();Gets the roles that a user has.
Enforcer::getRolesForUser('eve');// ['writer']
Gets the users that has a role.
Enforcer::getUsersForRole('writer');// ['eve']
Determines whether a user has a role.
Enforcer::hasRoleForUser('eve','writer');// true or false
Adds a role for a user.
Enforcer::addRoleForUser('eve','writer');
Adds a permission for a user or role.
// to userEnforcer::addPermissionForUser('eve','articles','read');// to roleEnforcer::addPermissionForUser('writer','articles','edit');
Deletes a role for a user.
Enforcer::deleteRoleForUser('eve','writer');
Deletes all roles for a user.
Enforcer::deleteRolesForUser('eve');
Deletes a role.
Enforcer::deleteRole('writer');
Deletes a permission.
Enforcer::deletePermission('articles','read');// returns false if the permission does not exist (aka not affected).
Deletes a permission for a user or role.
Enforcer::deletePermissionForUser('eve','articles','read');
Deletes permissions for a user or role.
// to userEnforcer::deletePermissionsForUser('eve');// to roleEnforcer::deletePermissionsForUser('writer');
Gets permissions for a user or role.
Enforcer::getPermissionsForUser('eve');// return array
Determines whether a user has a permission.
Enforcer::hasPermissionForUser('eve','articles','read');// true or false
SeeCasbin API for more APIs.
This package comes withEnforcerMiddleware,RequestMiddleware middlewares. You can add them inside yourapp/Http/Kernel.php file.
protected$routeMiddleware = [// ...// a basic Enforcer Middleware'enforcer' => \Lauthz\Middlewares\EnforcerMiddleware::class,// an HTTP Request Middleware'http_request' => \Lauthz\Middlewares\RequestMiddleware::class,];
Then you can protect your routes using middleware rules:
Route::group(['middleware' => ['enforcer:articles,read']],function () {// pass});
If you need to authorize a Request，you need to define the model configuration first inconfig/lauthz-rbac-model.conf:
[request_definition]r = sub, obj, act[policy_definition]p = sub, obj, act[role_definition]g = _, _[policy_effect]e = some(where (p.eft == allow))[matchers]m = g(r.sub, p.sub) && keyMatch2(r.obj, p.obj) && regexMatch(r.act, p.act)
Then, using middleware rules:
Route::group(['middleware' => ['http_request']],function () { Route::resource('photo','PhotoController');});
You can use Laravel Gates to check if a user has a permission, provided that you have set an existing user instance as the currently authenticated user.
$user->can('articles,read');// For multiple enforcers$user->can('articles,read','second');// The methods cant, cannot, canAny, etc. also work
If you require custom Laravel Gates, you can disable the automatic registration by settingenabled_register_at_gates tofalse in the lauthz file. After that, you can useGates::before orGates::after in your ServiceProvider to register custom Gates. SeeGates for more details.
If you need multiple permission controls in your project, you can configure multiple enforcers.
In the lauthz file, it should be like this:
return ['default' =>'basic','basic' => ['model' => [// ... ],'adapter' =>Lauthz\Adapters\DatabaseAdapter::class,// ... ],'second' => ['model' => [// ... ],'adapter' =>Lauthz\Adapters\DatabaseAdapter::class,// ... ],];
Then you can choose which enforcers to use.
Enforcer::guard('second')->enforce("eve","articles","edit");
You can create a policy from a console with artisan commands.
To user:
php artisan policy:add eve,articles,read
To Role:
php artisan policy:add writer,articles,edit
Adds a role for a user:
php artisan role:assign eve writer# Specify the ptype of the role assignment by using the --ptype option.php artisan role:assign eve writer --ptype=g2Authorization rules are cached to speed up performance. The default is off.
Sets your own cache configs in Laravel'sconfig/lauthz.php.
'cache' => [// changes whether Lauthz will cache the rules.'enabled' =>false,// cache store'store' =>'default',// cache Key'key' =>'rules',// ttl \DateTimeInterface|\DateInterval|int|null'ttl' =>24 *60,],
Casbin in Laravel. You can find the full documentation of Casbinon the website.
This project is licensed under theApache 2.0 license.
About
An authorization library that supports access control models like ACL, RBAC, ABAC in Laravel.
Topics
Resources
License
Uh oh!
There was an error while loading.Please reload this page.
Stars
Watchers
Forks
Packages0
Uh oh!
There was an error while loading.Please reload this page.
Contributors12
Uh oh!
There was an error while loading.Please reload this page.