{"id":19298241,"url":"https://github.com/casbin/casbin-mesh","last_synced_at":"2025-04-22T09:32:21.037Z","repository":{"id":40374681,"uuid":"345637579","full_name":"casbin/casbin-mesh","owner":"casbin","description":"A scalable authorization layer built on Casbin (The experimental project is currently unstable)","archived":false,"fork":false,"pushed_at":"2023-08-04T17:11:13.000Z","size":4216,"stargazers_count":25,"open_issues_count":11,"forks_count":13,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-10-29T22:37:42.799Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://mesh.casbin.org","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/casbin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null},"funding":{"github":"casbin"}},"created_at":"2021-03-08T11:47:19.000Z","updated_at":"2024-09-09T14:53:40.000Z","dependencies_parsed_at":"2023-02-14T05:30:47.006Z","dependency_job_id":null,"html_url":"https://github.com/casbin/casbin-mesh","commit_stats":{"total_commits":95,"total_committers":5,"mean_commits":19.0,"dds":"0.33684210526315794","last_synced_commit":"94d1c0ac656630eaba7664d6911ef6c76f27564f"},"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/casbin%2Fcasbin-mesh","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/casbin%2Fcasbin-mesh/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/casbin%2Fcasbin-mesh/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/casbin%2Fcasbin-mesh/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/casbin","download_url":"https://codeload.github.com/casbin/casbin-mesh/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223851664,"owners_count":17214115,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T23:07:22.465Z","updated_at":"2024-11-09T23:07:22.964Z","avatar_url":"https://github.com/casbin.png","language":"Go","funding_links":["https://github.com/sponsors/casbin"],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\u003cimg src=\"./casbin-mesh.png\" width=\"370\"\u003e\u003c/p\u003e\n\u003cp align=\"center\"\u003e\n\u003cb\u003eA scalable authorization application built on Casbin\u003c/b\u003e\n\u003c/p\u003e\n\n# Casbin-Mesh\n\n\u003cp\u003e\n  \u003ca href=\"https://goreportcard.com/report/github.com/casbin/casbin-mesh\"\u003e\n    \u003cimg src=\"https://goreportcard.com/badge/github.com/casbin/casbin-mesh\"\u003e\n  \u003c/a\u003e\n  \u003ca href=\"https://godoc.org/github.com/casbin/casbin-mesh\"\u003e\n    \u003cimg src=\"https://godoc.org/github.com/casbin/casbin-mesh?status.svg\" alt=\"GoDoc\"\u003e\n  \u003c/a\u003e\n    \u003cimg src=\"https://github.com/casbin/casbin-mesh/workflows/Go/badge.svg?branch=master\"/\u003e\n\u003c/p\u003e\n\nCasbin-Mesh is a lightweight, distributed authorization application. Casbin-Mesh uses [Raft](https://raft.github.io) to gain consensus across all the nodes.\n\n# TOC\n\n- [Install](#install)\n- [Quick Start](#quick-start)\n- [Documentation](#documentation)\n- [License](#license)\n\n# Install\n\n## Single Node\n\n### Docker\n\nYou can easily start a single Casbin-Mesh node like:\n\n```bash\n$ docker pull ghcr.io/casbin/casbin-mesh:latest\n\n$ docker run -it -p 4002:4002 --name=casbin_mesh_single ghcr.io/casbin/casbin-mesh:latest\n```\n\n### Binary\n\n```bash\n$ casmesh --node-id node0 ~/node1_data\n```\n\n## Cluster\n\n- The first benefit of the cluster is that it can be fault-tolerant several nodes crash, which will not affect your business.\n\n- For some special scenarios, you can read from the follower nodes which can increment the throughput of enforcing (reading) operations.\n\n### Docker Compose\n\ndocker-compose.yml\n\n```yml\nversion: \"3\"\nservices:\n  node0:\n    image: ghcr.io/casbin/casbin-mesh:latest\n    command: \u003e\n      --node-id node0\n      --raft-address 0.0.0.0:4002\n      --raft-advertise-address node0:4002\n      --endpoint-no-verify\n    ports:\n      - \"4002:4002\"\n    volumes:\n      - ./store/casbin/node1:/casmesh/data\n  node1:\n    image: ghcr.io/casbin/casbin-mesh:latest\n    command: \u003e\n      --node-id node1\n      --raft-address 0.0.0.0:4002\n      --raft-advertise-address node1:4002\n      --join http://node0:4002\n      --endpoint-no-verify\n    ports:\n      - \"4004:4002\"\n    volumes:\n      - ./store/casbin/node2:/casmesh/data\n    depends_on:\n      - node0\n  node2:\n    image: ghcr.io/casbin/casbin-mesh:latest\n    command: \u003e\n      --node-id node2\n      --raft-address 0.0.0.0:4002\n      --raft-advertise-address node2:4002\n      --join http://node0:4002\n      --endpoint-no-verify\n    ports:\n      - \"4006:4002\"\n    volumes:\n      - ./store/casbin/node3:/casmesh/data\n    depends_on:\n      - node0\n```\n\n```\n$ docker-compose up\n```\n\n### Helm\nYou can start a three node Casbin-Mesh cluster on Kubernetes using [Helm](https://helm.sh/):\n```bash\nHelm install \u003ccluster-name\u003e --set replicaCount=3 ./chart\n```\nThe Casbin-Mesh nodes will be exposed on service `\u003ccluster-name\u003e-casbin-mesh:4002`\n\n### Binary\n\n```bash\n$ casmesh --node-id --raft-address localhost:4002 --raft-advertise-address localhost:4002 node0 ~/node1_data\n\n$ casmesh --node-id --raft-address localhost:4004 --raft-advertise-address localhost:4004 node1 --join http://localhost:4002  ~/node2_data\n\n$ casmesh --node-id --raft-address localhost:4006 --raft-advertise-address localhost:4006 node2 --join http://localhost:4002  ~/node3_data\n```\n\n_Notes: In practice, you should deploy nodes on different machines._\n\n# Quick Start\n\n### Create namespaces\n\nFirst, We need to create a new namespace, which can be done by performing an HTTP request on the `/create/namespace` on any Casbin-Mesh node.\n\n```bash\n$ curl --location --request GET 'http://localhost:4002/create/namespace' \\\n--header 'Content-Type: application/json' \\\n--data-raw '{\n    \"ns\": \"test\"\n}'\n```\n\n### Set an RBAC model for the test namespace\n\nTo setup an Casbin model for a specific namespace, executes following request on `/set/model` endpoint. See all supported [models](https://casbin.org/docs/supported-models).\n\n```bash\n$ curl --location --request GET 'http://localhost:4002/set/model' \\\n--header 'Content-Type: application/json' \\\n--data-raw '{\n    \"ns\":\"test\",\n    \"text\":\"[request_definition]\\nr = sub, obj, act\\n\\n[policy_definition]\\np = sub, obj, act\\n\\n[role_definition]\\ng = _, _\\n\\n[policy_effect]\\ne = some(where (p.eft == allow))\\n\\n[matchers]\\nm = g(r.sub, p.sub) \u0026\u0026 r.obj == p.obj \u0026\u0026 r.act == p.act\"\n}'\n```\n\n### List all namespaces\n\nNow, let's list the namespaces which we created.\n\n```bash\n$ curl --location --request GET 'http://localhost:4002/list/namespaces'\n```\n\nThe response:\n\n```json\n[\"test\"]\n```\n\n### Add Policies\n\nLet's add policies for the `test` namespace. See more of [Policies](https://casbin.org/docs/supported-models)\n\n```bash\n$ curl --location --request GET 'http://localhost:4002/add/policies' \\\n--header 'Content-Type: application/json' \\\n--data-raw '{\n    \"ns\":\"test\",\n    \"sec\":\"p\",\n    \"ptype\":\"p\",\n    \"rules\":[[\"alice\",\"data1\",\"read\"],[\"bob\",\"data2\",\"write\"]]\n}'\n```\n\nWe will receive the sets of effected rules from the response.\n\n```json\n{\n  \"effected_rules\": [\n    [\"alice\", \"data1\", \"read\"],\n    [\"bob\", \"data2\", \"write\"]\n  ]\n}\n```\n\n### First enforce\n\nNow, Let's figure out whether Alice can read data1.\n\n```bash\n$ curl --location --request GET 'http://localhost:4002/enforce' \\\n--header 'Content-Type: application/json' \\\n--data-raw '{\n    \"ns\":\"test\",\n    \"params\":[\"alice\",\"data1\",\"read\"]\n}'\n```\n\nThe answer is yes:\n\n```json\n{\n  \"ok\": true\n}\n```\n\n# Documentation\n\n## APIs Overview\n\n### HTTP Endpoints\n\nHTTP endpoints for managing the namespaces and policies in casbin-mesh:\n\n- /create/namespace: to create a new namespace.\n- /list/namespaces: to list all existing namespaces.\n- /print/model: to print the model for a given namespace.\n- /list/policies: to list all policies for a given namespace.\n- /set/model: to set the model for a given namespace.\n- /add/policies: to add policies to a given namespace.\n- /remove/policies: to remove policies from a given namespace.\n- /remove/filtered_policies: to remove policies matching a filter from a given namespace.\n- /update/policies: to update policies in a given namespace.\n- /clear/policy: to clear all policies from a given namespace.\n- /enforce: to enforce a policy for a given namespace.\n- /stats: to get statistics for a given namespace.\n\n### gRPC Endpoints\n\ngRPC endpoints for managing the namespaces and policies in casbin-mesh:\n\n- Enforce: to enforce a policy for a given namespace.\n- CreateNamespace: to create a new namespace.\n- SetModelFromString: to set the model for a given namespace.\n- AddPolicies: to add policies to a given namespace.\n- RemovePolicies: to remove policies from a given namespace.\n- RemoveFilteredPolicy: to remove policies matching a filter from a given namespace.\n- UpdatePolicies: to update policies in a given namespace.\n- ClearPolicy: to clear all policies from a given namespace.\n- PrintModel: to print the model for a given namespace.\n- ListPolicies: to list all policies for a given namespace.\n\n### gRPC API Reference for the Command Service\n\nThe casbin-mesh service has the following methods:\n\n- ShowStats: This method take a StatsRequest message and returns a StatsResponse message. It can be used to retrieve statistical information about the Casbin system.\n- ListNamespaces: This method takes a ListNamespacesRequest message and returns a ListNamespacesResponse message. It can be used to list all the namespaces in the       Casbin system.\n- PrintModel: This method takes a PrintModelRequest message and returns a PrintModelResponse message. It can be used to retrieve the model of a specific namespace in     the Casbin system.\n- ListPolicies: This method takes a ListPoliciesRequest message and returns a ListPoliciesResponse message. It can be used to list all the policies in a specific         namespace in the Casbin system.\n- Request: This method takes a Command message and returns a Response message. It can be used to send various commands to the Casbin system.\n- Enforce: This method takes an EnforceRequest message and returns an EnforceResponse message. It can be used to check if a request is authorized or not.\n- The StatsRequest, ListNamespacesRequest, PrintModelRequest, and ListPoliciesRequest messages are all empty. They only serve as a placeholder for metadata that can be   added to the request.\n- The StatsResponse, PrintModelResponse, and ListPoliciesResponse messages all contain a payload field that can be used to pass back additional information.\n- The ListNamespacesResponse message contains a list of namespaces in the namespace field.\n- The Command message is used to send various commands to the Casbin system. It has a type field that specifies the type of command being sent, a namespace field that   specifies the namespace the command should be applied to, a payload field that contains additional data for the command, and a metadata field that can be used to       pass metadata along with the command.\n- The EnforceRequest message is used to request authorization for a specific action. It has a namespace field that specifies the namespace to check the authorization     in, an enforce_payload field that contains the details of the request, and a metadata field that can be used to pass metadata along with the request.\n- The EnforceResponse message is used to respond to an EnforceRequest. It has an ok field that specifies if the request is authorized or not.\n\n\n\nAll documents were located in [docs](https://mesh.casbin.org/docs/guide/getting-started) directory.\n\n# License\n\nThis project is licensed under the [Apache 2.0 license](/LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcasbin%2Fcasbin-mesh","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcasbin%2Fcasbin-mesh","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcasbin%2Fcasbin-mesh/lists"}