class Casbin::Enforcer

Enforcer = ManagementEnforcer + RBAC_API + RBAC_WITH_DOMAIN_API

creates an enforcer via file or DB.

File:
  e = casbin.Enforcer("path/to/basic_model.conf", "path/to/basic_policy.csv")
MySQL DB:
  a = mysqladapter.DBAdapter("mysql", "mysql_username:mysql_password@tcp(127.0.0.1:3306)/")
  e = casbin.Enforcer("path/to/basic_model.conf", a)

Public Instance Methods

add_permission_for_user(user, *permission) click to toggle source

adds a permission for a user or role. Returns false if the user or role already has the permission (aka not affected).

# File lib/casbin-ruby/enforcer.rb, line 74
def add_permission_for_user(user, *permission)
  add_policy(Util.join_slice(user, *permission))
end
add_role_for_user(user, role) click to toggle source

adds a role for a user. Returns false if the user already has the role (aka not affected).

# File lib/casbin-ruby/enforcer.rb, line 34
def add_role_for_user(user, role)
  add_grouping_policy(user, role)
end
add_role_for_user_in_domain(user, role, domain) click to toggle source

adds a role for a user inside a domain. Returns false if the user already has the role (aka not affected).

# File lib/casbin-ruby/enforcer.rb, line 174
def add_role_for_user_in_domain(user, role, domain)
  add_grouping_policy(user, role, domain)
end
delete_permission(*permission) click to toggle source

deletes a permission. Returns false if the permission does not exist (aka not affected).

# File lib/casbin-ruby/enforcer.rb, line 68
def delete_permission(*permission)
  remove_filtered_policy(1, *permission)
end
delete_permission_for_user(user, *permission) click to toggle source

deletes a permission for a user or role. Returns false if the user or role does not have the permission (aka not affected).

# File lib/casbin-ruby/enforcer.rb, line 80
def delete_permission_for_user(user, *permission)
  remove_policy(Util.join_slice(user, *permission))
end
delete_permissions_for_user(user) click to toggle source

deletes permissions for a user or role. Returns false if the user or role does not have any permissions (aka not affected).

# File lib/casbin-ruby/enforcer.rb, line 86
def delete_permissions_for_user(user)
  remove_filtered_policy(0, user)
end
delete_role(role) click to toggle source

deletes a role. Returns false if the role does not exist (aka not affected).

# File lib/casbin-ruby/enforcer.rb, line 60
def delete_role(role)
  res1 = remove_filtered_grouping_policy(1, role)
  res2 = remove_filtered_policy(0, role)
  res1 || res2
end
delete_role_for_user(user, role) click to toggle source

deletes a role for a user. Returns false if the user does not have the role (aka not affected).

# File lib/casbin-ruby/enforcer.rb, line 40
def delete_role_for_user(user, role)
  remove_grouping_policy(user, role)
end
delete_roles_for_user(user) click to toggle source

deletes all roles for a user. Returns false if the user does not have any roles (aka not affected).

# File lib/casbin-ruby/enforcer.rb, line 46
def delete_roles_for_user(user)
  remove_filtered_grouping_policy(0, user)
end
delete_roles_for_user_in_domain(user, role, domain) click to toggle source

deletes a role for a user inside a domain. Returns false if the user does not have any roles (aka not affected).

# File lib/casbin-ruby/enforcer.rb, line 180
def delete_roles_for_user_in_domain(user, role, domain)
  remove_filtered_grouping_policy(0, user, role, domain)
end
delete_user(user) click to toggle source

deletes a user. Returns false if the user does not exist (aka not affected).

# File lib/casbin-ruby/enforcer.rb, line 52
def delete_user(user)
  res1 = remove_filtered_grouping_policy(0, user)
  res2 = remove_filtered_policy(0, user)
  res1 || res2
end
get_implicit_permissions_for_user(user, domain = nil) click to toggle source

gets implicit permissions for a user or role. Compared to get_permissions_for_user(), this function retrieves permissions for inherited roles. For example: p, admin, data1, read p, alice, data2, read g, alice, admin get_permissions_for_user(“alice”) can only get: [[“alice”, “data2”, “read”]]. But get_implicit_permissions_for_user(“alice”) will get: [[“admin”, “data1”, “read”], [“alice”, “data2”, “read”]].

# File lib/casbin-ruby/enforcer.rb, line 131
def get_implicit_permissions_for_user(user, domain = nil)
  roles = get_implicit_roles_for_user(user, domain)
  roles.insert(0, user)
  res = []
  roles.each do |role|
    permissions = if domain
                    get_permissions_for_user_in_domain(role, domain)
                  else
                    get_permissions_for_user(role)
                  end

    res.concat(permissions)
  end

  res
end
get_implicit_roles_for_user(name, domain = nil) click to toggle source

gets implicit roles that a user has. Compared to get_roles_for_user(), this function retrieves indirect roles besides direct roles. For example: g, alice, role:admin g, role:admin, role:user get_roles_for_user(“alice”) can only get: [“role:admin”]. But get_implicit_roles_for_user(“alice”) will get: [“role:admin”, “role:user”].

# File lib/casbin-ruby/enforcer.rb, line 107
def get_implicit_roles_for_user(name, domain = nil)
  res = []
  queue = [name]
  while queue.size.positive?
    name = queue.delete_at(0)
    rm_map.each_value do |rm|
      rm.get_roles(name, domain).each do |r|
        res << r
        queue << r
      end
    end
  end

  res
end
get_implicit_users_for_permission(*permission) click to toggle source

gets implicit users for a permission. For example: p, admin, data1, read p, bob, data1, read g, alice, admin get_implicit_users_for_permission(“data1”, “read”) will get: [“alice”, “bob”]. Note: only users will be returned, roles (2nd arg in “g”) will be excluded.

# File lib/casbin-ruby/enforcer.rb, line 155
def get_implicit_users_for_permission(*permission)
  subjects = get_all_subjects
  roles = get_all_roles
  users = Util.set_subtract(subjects, roles)
  users.find_all { |user| enforce(*Util.join_slice(user, *permission)) }
end
get_permissions_for_user(user) click to toggle source

gets permissions for a user or role.

# File lib/casbin-ruby/enforcer.rb, line 91
def get_permissions_for_user(user)
  get_filtered_policy(0, user)
end
get_permissions_for_user_in_domain(user, domain) click to toggle source

gets permissions for a user or role inside domain.

# File lib/casbin-ruby/enforcer.rb, line 185
def get_permissions_for_user_in_domain(user, domain)
  get_filtered_policy(0, user, domain)
end
get_roles_for_user(name) click to toggle source

gets the roles that a user has.

# File lib/casbin-ruby/enforcer.rb, line 17
def get_roles_for_user(name)
  model.model['g']['g'].rm.get_roles(name)
end
get_roles_for_user_in_domain(name, domain) click to toggle source

gets the roles that a user has inside a domain.

# File lib/casbin-ruby/enforcer.rb, line 163
def get_roles_for_user_in_domain(name, domain)
  model.model['g']['g'].rm.get_roles(name, domain)
end
get_users_for_role(name) click to toggle source

gets the users that has a role.

# File lib/casbin-ruby/enforcer.rb, line 22
def get_users_for_role(name)
  model.model['g']['g'].rm.get_users(name)
end
get_users_for_role_in_domain(name, domain) click to toggle source

gets the users that has a role inside a domain.

# File lib/casbin-ruby/enforcer.rb, line 168
def get_users_for_role_in_domain(name, domain)
  model.model['g']['g'].rm.get_users(name, domain)
end
has_permission_for_user(user, *permission) click to toggle source

determines whether a user has a permission.

# File lib/casbin-ruby/enforcer.rb, line 96
def has_permission_for_user(user, *permission)
  has_policy(Util.join_slice(user, *permission))
end
has_role_for_user(name, role) click to toggle source

determines whether a user has a role.

# File lib/casbin-ruby/enforcer.rb, line 27
def has_role_for_user(name, role)
  roles = get_roles_for_user(name)
  roles.include?(role)
end