Using Casbin as permission control middleware in thinkphp-ThinkPHP-php.cn

Using Casbin as permission control middleware in thinkphp

尚

Release： 2020-05-26 09:17:09

forward

3450 people have browsed it

Using Casbin as permission control middleware in thinkphp

PHP-Casbin is a powerful and efficient open source access control framework that supports permission management based on various access control models.

Think-Casbin is a Casbin extension package specially customized for ThinkPHP5.1, making it easier for developers to use Casbin in thinkphp projects.

Installation

Create thinkphp project (if not available):

composer create-project topthink/think=5.1.* tp5

Copy after login

In the ThinkPHP project, install the Think-Casbin extension:

composer require casbin/think-adapter

Copy after login

Publish resources:

php think casbin:publish

Copy after login

This will automatically create the model configuration file config/casbin-basic-model.conf, and the Casbin configuration file config/casbin.php.

Data migration:

Because Think-Casbin stores Casbin’s policy (Policy) in the database by default, the database table information needs to be initialized.

Before execution, please ensure that the database connection information is configured correctly. If you need to modify Casbin's database connection information or table name separately, you can modify the configuration in config/casbin.php.

php think casbin:migrate

Copy after login

This will automatically create Casbin's policy table casbin_rule.

Middleware

ThinkPHP Starting from version 5.1.6, middleware support is officially introduced.

You can quickly generate middleware through command line instructions

php think make:middleware Authorization

Copy after login

This instruction will generate an Authorization middleware under the application/http/middleware directory.

In the middleware, get the current user name, URI, request method, and verify permissions through Casbin:

<?php

namespace app\http\middleware;

use Casbin;
use think\facade\Session;

class Authorization
{
    public function handle($request, \Closure $next)
    {
        // 当前登录用户名，这里以session为例
        // $user = Session::get(&#39;user_name&#39;) ?: &#39;test_user&#39;;
        $user = Session::get(&#39;user_name&#39;);

        $url = $request->url();
        $action = $request->method();

        if (!$user){
            return response()->data(&#39;Unauthenticated.&#39;)->code(401);
        }

        if (!Casbin::enforce($user, $url, $action)) {
            return response()->data(&#39;Unauthorized.&#39;)->code(403);
        }

        return $next($request);
    }
}

Copy after login

Casbin Model configuration

config\ casbin-basic-model.conf Configuration file:

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = r.sub == p.sub && keyMatch2(r.obj, p.obj) && r.act == p.act

Copy after login

Verification

Before performing authorization, add some default policies to the database casbin_rule table:

Using Casbin as permission control middleware in thinkphp

Add routing and its middleware:

Route::group(&#39;users&#39;, function () {
    
    Route::get(&#39;&#39;, function () {
        return &#39;Users data.&#39;;
    });

    Route::get(&#39;/:id&#39;, function ($id) {
        return &#39;User: &#39;.$id;
    });

})->middleware(\app\http\middleware\Authorization::class);

Copy after login

First log in to the user and save the user name to SESSION. You can visit /users, /users/1 to verify the permissions.