Thử dùng Casbin phân quyền RBAC bằng Golang (P1)

test_rbac/
   examples/
      rbac_model.conf
   models/
      models.go
   rbac/
      rbac.go
      courses.go
      blog.go
   routes/
      routes.go
   go.mod
   go.sum
   main.go

// rbac_model.conf
[request_definition]
r = sub, obj, act
r2 = sub, obj, act
r3 = sub, obj, act

[policy_definition]
p = sub, obj, act
p2 = sub, obj, act
p3 = sub, obj, act

[role_definition]
g = _, _
g2 = _, _, _
g3 = _, _, _

[policy_effect]
e = some(where (p.eft == allow))
e2 = some(where (p.eft == allow)) && !some(where (p.eft == deny))
e3 = some(where (p.eft == allow)) && !some(where (p.eft == deny))

[matchers]
m = keyMatch2(r.obj, p.obj) && r.act == p.act && g(r.sub, p.sub)
m2 = keyMatch2(r2.obj, p2.obj) && r2.act == p2.act && g2(r2.sub, keyGet2(r2.obj, p2.obj, 'id'), p2.sub)    
m3 = keyMatch2(r3.obj, p3.obj) && r3.act == p3.act && g3(r3.sub, keyGet2(r3.obj, p3.obj, 'id'), p3.sub)

// main.go
package main

import (
	"github.com/kataras/iris/v12"
	"github.com/lits-06/test_rbac/routes"
)

func main() {
	app := iris.New()

	routes.RegisterRoute(app)
	
	app.Listen(":8080")
}

// rbac.go
package rbac

import (
	"github.com/casbin/casbin/v2"
	mongodbadapter "github.com/casbin/mongodb-adapter/v3"
	"github.com/kataras/iris/v12"
)

var rbac *casbin.Enforcer

func Setup() (*casbin.Enforcer) {
	a, err := mongodbadapter.NewAdapter("mongodb://development:testpassword@localhost:27017")
	if err != nil {
		panic(err)
	}

	r, err := casbin.NewEnforcer("examples/rbac_model.conf", a)
	if err != nil {
		panic(err)
	}

	r.LoadPolicy()

	rbac = r

	return r
}

// routes.go
package routes

import (
	"github.com/kataras/iris/v12"
	"github.com/lits-06/test_rbac/rbac"
)

func RegisterRoute(app *iris.Application) {
	r := rbac.Setup()

	app.Post("/add_role", rbac.AddRole())
	app.Post("/add_role_for_user", rbac.AddRoleForUser())
	app.Post("/delete_role_for_user", rbac.DeleteRoleForUser())
	app.Post("/add_api_for_role", rbac.AddAPIForRole())
	app.Post("/delete_api_for_role", rbac.DeleteAPIForRole())
	app.Post("/add_role_for_api", rbac.AddRoleForAPI())
	app.Post("/delete_role_for_api", rbac.DeleteRoleForAPI())
	app.Post("/delete_role", rbac.DeleteRole())
	app.Get("/admin", rbac.CheckAuth(), rbac.Notification())


	app.Post("/add_course", rbac.AddCourse())
	// nhập user_id: []string và class_id: string
	app.Post("/add_trainer", rbac.AddTrainer())
	app.Post("/add_student", rbac.AddStudents())
	app.Post("/delete_trainer", rbac.DeleteTrainer())
	app.Post("/delete_student", rbac.DeleteStudent())
	// nhập user_id: string
	app.Post("/courses/:id", rbac.CheckClassPermission(), rbac.ClassNotification())


	// nhập user_id: string	
	app.Post("/add_new_blog", rbac.AddBlog())
	app.Post("/posts/:id", rbac.CheckBlogPermission(), rbac.BlogNotification())
	// nhập user_id: string và blog_id: []string
	app.Post("/delete_blog", rbac.DeleteBlog())

	
	r.SavePolicy()
}

// rbac.go
type RoleData struct {
	Role 	string		`json:"role"`
   	API	[]string	`json:"api"`
	Method	[]string	`json:"method"`
}

func AddRole() iris.Handler {
	return func(ctx iris.Context) {
		var data RoleData

               // đọc dữ liệu và gán vào data
		if err := ctx.ReadJSON(&data); err != nil {
			ctx.JSON("can not get data")
			return
		}
  
               // nếu không cung cấp endpoint, ta sẽ thêm endpoint mặc định
		if data.API == nil {
			data.API = append(data.API, "http://localhost:8080")
		}
  
               // thêm các policy rule
		for _, api := range data.API {
			for _, method := range data.Method {
				_, err := rbac.AddPolicy(data.Role, api, method)
				if err != nil {
					ctx.JSON("ERROR")
					return
				}
			}
		}

		ctx.WriteString("success added role: " + data.Role)
	}
}

// rbac.go
type UserRole struct {
	UserID	[]string	`json:"user_id"`	
	Role	string		`json:"role"`
}

func AddRoleForUser() iris.Handler {
	return func(ctx iris.Context) {
		var data UserRole

		if err := ctx.ReadJSON(&data); err != nil {
			ctx.JSON("can not get data")
			return
		}

		for _, id := range data.UserID {
			_, err := rbac.AddGroupingPolicy(id, data.Role)
			if err != nil {
				ctx.WriteString("cans not add role for this user")
				return
			} 
		}

		ctx.WriteString("success")
	}
}

func DeleteRoleForUser() iris.Handler {
	return func(ctx iris.Context) {
		var data UserRole

		if err := ctx.ReadJSON(&data); err != nil {
			ctx.JSON("can not get data")
			return
		}

		for _, id := range data.UserID {
			_, err := rbac.RemoveGroupingPolicy(id, data.Role)
			if err != nil {
				ctx.WriteString("cans not delete role for this user")
				return
			}
		}

		ctx.WriteString("success")
	}
}

// rbac.go
func AddAPIForRole() iris.Handler {
	return func(ctx iris.Context) {
		var data RoleData

		if err := ctx.ReadJSON(&data); err != nil {
			ctx.JSON("can not get data")
			return
		}
               // nếu chưa có method nào thì thêm method mặc định GET
		if data.Method == nil {
			data.Method = append(data.Method, "GET")
		}

		for _, api := range data.API {
			for _, method := range data.Method {
				_, err := rbac.AddPolicy(data.Role, api, method)
				if err != nil {
					ctx.JSON("ERROR")
					return
				}
			}
		}

		ctx.WriteString("success")
	}
}

// rbac.go
type RoleAPI struct  {
	Role		string		`json:"role"`
	API		[]string	`json:"api"`
}

func DeleteAPIForRole() iris.Handler {
	return func(ctx iris.Context) {
		var data RoleAPI

		if err := ctx.ReadJSON(&data); err != nil {
			ctx.JSON("can not get data")
			return
		}

		allAction := rbac.GetAllActions()

		for _, api := range data.API {
			for _, action := range allAction {
				rbac.RemovePolicy(data.Role, api, action)
			}
		}		
         	// nếu không còn endpoint nào thì thêm http://localhost:8080
		filteredPolicy := rbac.GetFilteredPolicy(0, data.Role)
		if (len(filteredPolicy)) == 0 {
			_, err := rbac.AddPolicy(data.Role, "http://localhost:8080", "GET")
			if err != nil {
				ctx.JSON("ERROR")
				return
			}
		}

		ctx.WriteString("success delete")
	}
}

// rbac.go
type APIData struct {
	API		string		`json:"api"`
	Role		[]string	`json:"role"`
	Method		[]string	`json:"method"`
}

func AddRoleForAPI() iris.Handler {
	return func(ctx iris.Context) {
		var data APIData

		if err := ctx.ReadJSON(&data); err != nil {
			ctx.JSON("can not get data")
			return
		}

		for _, role := range data.Role {
			for _, method := range data.Method {
				_, err := rbac.AddPolicy(role, data.API, method)
				if err != nil {
					ctx.JSON("ERROR")
					return
				}
			}
		}

		ctx.WriteString("success")
	}
}

// rbac.go
type APIRole struct {
	API		string		`json:"api"`
	Role		[]string	`json:"role"`
}

func DeleteRoleForAPI() iris.Handler {
	return func(ctx iris.Context) {
		var data APIRole

		if err := ctx.ReadJSON(&data); err != nil {
			ctx.JSON("can not get data")
			return
		}

		allAction := rbac.GetAllActions()

		for _, role := range data.Role {
			for _, action := range allAction {
				_, err := rbac.RemovePolicy(role, data.API, action)
				if err != nil {
					ctx.JSON("ERROR")
					return
				}
			}
		}		
		
		ctx.WriteString("success delete")
	}
}

// rbac.go
type Role struct {
	Role	string		`json:"role"`
}

func DeleteRole() iris.Handler {
	return func(ctx iris.Context) {
		var data Role

		err := ctx.ReadJSON(&data)
		if err != nil {
			ctx.JSON("can not get data")
			return
		}

		ok, err := rbac.DeleteRole(data.Role)
		if err != nil {
			ctx.JSON("ERROR")
			return
		}
                 // nếu không có role thì in ra
		if !ok {
			ctx.JSON("do not have role: " + data.Role)
			return
		}

		ctx.JSON("success delete role: " + data.Role)
	}
}

// rbac.go
type User struct {
	UserID		string		`json:"user_id"`
}

func CheckAuth() iris.Handler {
	return func(ctx iris.Context) {
		var data User

		if err := ctx.ReadJSON(&data); err != nil {
			ctx.JSON("can not get data")
			return
		}

		path := "http://localhost:8080" + ctx.Path()

		ok, err := rbac.Enforce(data.UserID, path, "GET")
		if !ok || err != nil {
			ctx.WriteString("ERROR")
			return
		}

		ctx.Next()
	}
}

func Notification() iris.Handler {
	return func(ctx iris.Context) {
		ctx.WriteString("Hello")
	}
}