feat(permission): add RBAC module with Casbin enforcement and policy reload
- Multi-tenant RBAC: permission catalog, roles, role-permission mapping,
user-role assignment, and external IdP role mapping (zitadel/ldap/scim).
- Casbin enforcer with Redis-backed adapter and Pub/Sub reload for
multi-instance policy sync; HTTP middleware enforces (tenant, role,
path, method) with platform admin bypass.
- /api/v1/permissions routes: catalog, me, policy/reload, roles CRUD,
role permissions, user roles, role mappings.
- New error scope (31) for Permission and biz code descriptions.
- Wire Permission module into ServiceContext, config, mongo-index, and
add cmd/permission-seed CLI plus etc/rbac.conf model.
- Redis client gains lazy PubSubClient helper (go-zero wrapper lacks Subscribe).
- Rewrite internal/model/member/README to cover Tenant/Member/Identity.
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-21 08:47:35 +00:00
|
|
|
# Casbin model for the Gateway permission module.
|
|
|
|
|
#
|
|
|
|
|
# Multi-tenant RBAC with HTTP path/method matching. The 5th policy column
|
|
|
|
|
# (name) is the permission.name (dot notation) so audit logs can attribute
|
|
|
|
|
# the matched permission without re-querying the catalog.
|
|
|
|
|
#
|
|
|
|
|
# Request: (tenant, role, path, method)
|
|
|
|
|
# Policy: (tenant, role, path, methods, name)
|
|
|
|
|
# Effect: any role/policy that matches → allow
|
|
|
|
|
# Matcher: same tenant + same role + path keyMatch2 + method regexMatch
|
|
|
|
|
#
|
|
|
|
|
# Platform admin bypass is enforced before this matcher (middleware short
|
2026-05-22 09:18:08 +00:00
|
|
|
# circuit) so it does not appear here. See internal/model/permission/SDD.md
|
|
|
|
|
# §3.3 (RBAC Model).
|
feat(permission): add RBAC module with Casbin enforcement and policy reload
- Multi-tenant RBAC: permission catalog, roles, role-permission mapping,
user-role assignment, and external IdP role mapping (zitadel/ldap/scim).
- Casbin enforcer with Redis-backed adapter and Pub/Sub reload for
multi-instance policy sync; HTTP middleware enforces (tenant, role,
path, method) with platform admin bypass.
- /api/v1/permissions routes: catalog, me, policy/reload, roles CRUD,
role permissions, user roles, role mappings.
- New error scope (31) for Permission and biz code descriptions.
- Wire Permission module into ServiceContext, config, mongo-index, and
add cmd/permission-seed CLI plus etc/rbac.conf model.
- Redis client gains lazy PubSubClient helper (go-zero wrapper lacks Subscribe).
- Rewrite internal/model/member/README to cover Tenant/Member/Identity.
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-21 08:47:35 +00:00
|
|
|
|
|
|
|
|
[request_definition]
|
|
|
|
|
r = tenant, role, path, method
|
|
|
|
|
|
|
|
|
|
[policy_definition]
|
|
|
|
|
p = tenant, role, path, methods, name
|
|
|
|
|
|
|
|
|
|
[policy_effect]
|
|
|
|
|
e = some(where (p.eft == allow))
|
|
|
|
|
|
|
|
|
|
[matchers]
|
|
|
|
|
m = r.tenant == p.tenant && r.role == p.role && keyMatch2(r.path, p.path) && regexMatch(r.method, p.methods)
|
