RBAC using casbin
I was implementing rbac in my refine+supabase application. In Casbin Model and Policies file, what is resources/ objects there.
obj variable in the model definition. obj is the object or resource, and is the action. Casbin uses this model to scan the request for the subject, object, and action.p. The policies define what actions () a subject () can perform on a resource (obj). For example, in the policy , admin is the subject, users is the resource, and list is the action. This policy allows an admin to list users.App.tsx file.orders, and customers.list, create, and edit properties define the actions that can be performed on these resources, and the corresponding routes in the application.admin role has permission to list, create, edit, and delete both and . The role can list, create, and edit , but can only list .p denotes a policy, is the subject (the role in this case), obj is the object or resource, and is the action. The actions are separated by to indicate that any of these actions are allowed.list action for a resource, that resource will not appear in the sidebar. You can check the List of Default Access Control Points documentation (https://refine.dev/docs/authorization/access-control-provider#list-of-default-access-control-points) for more information.false or true respectively, the resource will not appear in the sidebar, regardless of the access control policies. You can check the Github Issue (closed): [FEAT] Add an option to hide the resource in the menu (https://github.com/refinedev/refine/issues/2388) for more information.r = sub, obj, actsubsubsubactactactp, admin, users, listresources<Refine />postspostspostspostspostsauthorsauthorsauthorsauthorsauthorsproductsp, admin, posts, (list|create|edit|delete)
p, admin, authors, (list|create|edit|delete)
p, editor, posts, (list|create|edit)
p, editor, authors, listeditorp, sub, obj, act|{ resource, action: "list" }visiblehideexport const model = newModel(`
[request_definition]
r = sub, obj, act
[policy_definition]
p = sub, obj, act
[role_definition]
g = _, _
[policy_effect]
e = some(where (p.eft == allow))
[matchers]
m = g(r.sub, p.sub) && keyMatch(r.obj, p.obj) && regexMatch(r.act, p.act)
`);<Refine
resources={[
{
name: "posts",
list: "/posts",
create: "/posts/create",
edit: "/posts/edit/:id",
},
{
name: "authors",
list: "/authors",
create: "/authors/create",
edit: "/authors/edit/:id",
},
]}
/>