PHP 中基于 Casbin 做 RBAC + RESTful 权限控制 |
您所在的位置:网站首页 › 河北北方学院官网系统入口查询 › PHP 中基于 Casbin 做 RBAC + RESTful 权限控制 |
PHP-Casbin 是一个强大的、高效的开源访问控制框架,它支持基于各种访问控制模型(RBAC ABAC ACL)的权限管理。 这里使用官方提供的数据库适配器扩展:DBAL Adapter. 安装通过composer安装: composer require casbin/casbin composer require casbin/dbal-adapter 使用 RBAC Modelmodel.conf 如下: [request_definition] r = sub, obj, act [policy_definition] p = sub, obj, act # RBAC角色继承关系的定义 [role_definition] g = _, _ [policy_effect] e = some(where (p.eft == allow)) [matchers] m = g(r.sub, p.sub) && keyMatch2(r.obj, p.obj) && regexMatch(r.act, p.act) 初始化一个Casbin enforcer use Casbin\Enforcer; use CasbinAdapter\DBAL\Adapter; $adapter = Adapter::newAdapter([ 'driver' => 'pdo_mysql', 'host' => '127.0.0.1', 'dbname' => 'test', 'user' => 'root', 'password' => '', 'port' => '3306', ]); $enforcer = new Enforcer('path/to/model.conf', $adapter); 添加策略给alice和bob分配角色: // alice has the admin role $enforcer->addRoleForUser('alice', 'admin'); // bob has the member role $enforcer->addRoleForUser('bob', 'member');给member角色分配权限,member 角色仅对foo资源有查看权限: $enforcer->addPermissionForUser('member', '/foo', 'GET'); $enforcer->addPermissionForUser('member', '/foo/:id', 'GET');admin角色对foo拥有增删改查权限: // admin inherits all permissions of member $enforcer->addRoleForUser('admin', 'member'); $enforcer->addPermissionForUser('admin', '/foo', 'POST'); $enforcer->addPermissionForUser('admin', '/foo/:id', 'PUT'); $enforcer->addPermissionForUser('admin', '/foo/:id', 'DELETE');分配完角色和权限后,数据库中的策略规则大致如下: g, alice, admin g, bob, member p, memeber, /foo, GET p, memeber, /foo/:id, GET g, admin, member p, admin, /foo, POST p, admin, /foo/:id, PUT p, admin, /foo/:id, DELETE 验证权限alice 具有admin角色,继承admin和member两个角色的全部权限. $enforcer->enforce('alice', '/foo', 'GET'); // true $enforcer->enforce('alice', '/foo', 'GET'); // true $enforcer->enforce('alice', '/foo', 'POST'); // true $enforcer->enforce('alice', '/foo/1', 'PUT'); // true $enforcer->enforce('alice', '/foo/1', 'DELETE'); // truebob 具有member角色, 只继承member的权限. $enforcer->enforce('bob', '/foo', 'GET'); // true $enforcer->enforce('bob', '/foo', 'GET'); // true $enforcer->enforce('bob', '/foo', 'POST'); // false $enforcer->enforce('bob', '/foo/1', 'PUT'); // false $enforcer->enforce('bob', '/foo/1', 'DELETE'); // false文章转发原始链接:PHP 中基于 Casbin 做 RBAC + RESTful 权限控制 |
今日新闻 |
推荐新闻 |
CopyRight 2018-2019 办公设备维修网 版权所有 豫ICP备15022753号-3 |