authj

authj is an authorization middleware for Gin, it's based on casbin.

Installation

go get github.com/things-go/authj

Example

package main

import (
	"net/http"

	"github.com/casbin/casbin/v2"
	"github.com/gin-gonic/gin"

	"github.com/things-go/authj"
)

func main() {
	// load the casbin model and policy from files, database is also supported.
	e, err := casbin.NewEnforcer("authj_model.conf", "authj_policy.csv")
	if err != nil {
		panic(err)
	}

	// define your router, and use the Casbin authj middleware.
	// the access that is denied by authj will return HTTP 403 error.
	router := gin.New()
	router.Use(
		func(c *gin.Context) {
			// set context subject
			authj.ContextWithSubject(c, "alice")
		},
		authj.Authorizer(e),
	)
	router.GET("/dataset1/resource1", func(c *gin.Context) {
		c.String(http.StatusOK, "alice own this resource")
	})
	router.GET("/dataset2/resource1", func(c *gin.Context) {
		c.String(http.StatusOK, "alice do not own this resource")
	})
	router.Run(":8080")
}

Documentation

The authorization determines a request based on {subject, object, action}, which means what subject can perform what action on what object. In this plugin, the meanings are:

1. subject: the logged-on user name
2. object: the URL path for the web resource like "dataset1/item1"
3. action: HTTP method like GET, POST, PUT, DELETE, or the high-level actions you defined like "read-file", "write-blog"

For how to write authorization policy and other details, please refer to the Casbin's documentation.

Getting Help

• Casbin
• Gin
• Gin-authz

License

This project is under MIT License. See the LICENSE file for the full license text.