apache / apache/casbin

[feature] Add experimental RBAC model preset (and optional helpers)

Open
#1,623 1 comment 1 reaction 3 assignees Claimed by @hsluoyz View on GitHub
enhancement
Dominant language
Go
Stars
20.4k
Forks
1.8k
Avg merge
5d 11h
Merged PRs (30d)
2

Description

## Background

Casbin models are currently defined by users via `model.conf`, which provides maximum flexibility but also requires users to repeatedly define common authorization patterns.

One of the most common patterns is standard RBAC (role-based access control) using `p` and `g` policies.

### Proposal

Introduce an opinionated RBAC model preset that provides a reference implementation of standard RBAC.

Example usage:

```go
m := preset.RBAC()
e, _ := casbin.NewEnforcer(m, adapter)

// optional helper
rbac.AssignRole(e, "alice", "admin")
rbac.Grant(e, "admin", "data1", "read")

ok, _ := e.Enforce("alice", "data1", "read")
```

Optionally, small helper functions may be provided to simplify common RBAC operations, such as assigning roles or granting permissions. These helpers operate on an existing `Enforcer` and do not introduce new abstractions or enforcement paths.

## Design Notes

* The preset generates a standard Casbin model equivalent to a typical `model.conf`
* No new enforcement semantics are introduced
* Existing APIs and behavior remain unchanged
* Helpers (if included) are convenience-only and optional

## Scope

**In scope**

* A single, standard RBAC model preset
* Optional helper functions for common RBAC operations

**Out of scope**

* RBAC variants (e.g. domains)
* ABAC or other authorization patterns

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.