https://github.com/lanlin/god
An authority proving system that supports ACL, RBAC, ABAC
https://github.com/lanlin/god
abac acl permission php rbac restful
Last synced: about 1 year ago
JSON representation
An authority proving system that supports ACL, RBAC, ABAC
- Host: GitHub
- URL: https://github.com/lanlin/god
- Owner: lanlin
- License: mit
- Created: 2018-06-25T04:59:18.000Z (almost 8 years ago)
- Default Branch: master
- Last Pushed: 2019-08-01T09:24:12.000Z (almost 7 years ago)
- Last Synced: 2025-03-25T10:12:36.043Z (about 1 year ago)
- Topics: abac, acl, permission, php, rbac, restful
- Language: PHP
- Size: 99.6 KB
- Stars: 5
- Watchers: 3
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
## God Permission System
"God said, Let there be light, and there was light."
"God will decide if you have permission."
"God bless you!"
## Install
```shell
composer require lanlin/god
```
## The Origin
God is written after referring to the Casbin(golang) project, thanks for their hard work.
For more detail, please refer to the documentation of [Casbin](https://github.com/casbin/casbin).
## Supported models
1. [**ACL (Access Control List)**](https://en.wikipedia.org/wiki/Access_control_list)
2. **ACL with [superuser](https://en.wikipedia.org/wiki/Superuser)**
3. **ACL without users**: especially useful for systems that don't have authentication or user log-ins.
3. **ACL without resources**: some scenarios may target for a type of resources instead of an individual resource by using permissions like ``write-article``, ``read-log``. It doesn't control the access to a specific article or log.
4. **[RBAC (Role-Based Access Control)](https://en.wikipedia.org/wiki/Role-based_access_control)**
5. **RBAC with resource roles**: both users and resources can have roles (or groups) at the same time.
6. **RBAC with domains/tenants**: users can have different role sets for different domains/tenants.
7. **[ABAC (Attribute-Based Access Control)](https://en.wikipedia.org/wiki/Attribute-Based_Access_Control)**: syntax sugar like ``resource.Owner`` can be used to get the attribute for a resource.
8. **[RESTful](https://en.wikipedia.org/wiki/Representational_state_transfer)**: supports paths like ``/res/*``, ``/res/:id`` and HTTP methods like ``GET``, ``POST``, ``PUT``, ``DELETE``.
9. **Deny-override**: both allow and deny authorizations are supported, deny overrides the allow.
10. **Priority**: the policy rules can be prioritized like firewall rules.
## Supported Adapters
1. file adapter
2. MongoDB adapter
3. PHP PDO adapters (now support: MySQL, PostgreSQL, SQLite, SqlServer.)
## How it works?
does "Who" as "Role" or "Group" from "Where" do "Operator" to "What" will got "How"?
| Identifier | Description |
|------------|-------------|
| r | Request (r = sub, obj, act) |
| p | Policy (p = sub, obj, act, eft) |
| g | Group or Role (g = _, _) |
| e | Policy Efftect (e = some(where (p.eft == allow))) |
| m | Matchers (m = r.obj == p.obj) |
| sub | Subject (Who) |
| dom | Domain (Where) |
| obj | Object (What) |
| act | Action (Operator) |
| eft | Efftect (How) (allow, deny, indeterminate) |
An access control model is abstracted into a CONF file based on the **PERM metamodel (Policy, Effect, Request, Matchers)**.
So switching or upgrading the authorization mechanism for a project is just as simple as modifying a configuration.
You can customize your own access control model by combining the available models.
For example, you can get RBAC roles and ABAC attributes together inside one model and share one set of policy rules.
The most basic and simplest model in God is ACL. ACL's model CONF is:
```ini
# Request definition
[request_definition]
r = sub, obj, act
# Policy definition
[policy_definition]
p = sub, obj, act
# Policy effect
[policy_effect]
e = some(where (p.eft == allow))
# Matchers
[matchers]
m = r.sub == p.sub && r.obj == p.obj && r.act == p.act
```
An example policy for ACL model is like:
```
p, alice, data1, read
p, bob, data2, write
```
It means:
- alice can read data1
- bob can write data2
## Demo
```php
use God\God;
$God = new God('path/to/model.conf', 'path/to/policy.csv');
$God->allows('you', 'evil book', 'read'); // Does God allows you to do this?
new God();
new God(string $modelPath);
new God(string $modelPath, string $policyFile);
new God(string $modelPath, Adapter $adapter);
new God(Model $model);
new God(Model $model, Adapter $adapter);
// demo for mysql
$dbHost = "127.0.0.1";
$dbPort = 3306;
$dbName = "your_database_name";
$username = "root";
$password = "your_password";
// php mysql pdo demo
$pdo = new \PDO("mysql:host={$dbHost};port={$dbPort};dbname={$dbName}", $username, $password);
// init god model with csv
$g = new God('tests/Examples/rbac_model.conf', 'tests/Examples/rbac_policy.csv');
$m = $g->getModel();
// save policy to database
$a = new Adapter($pdo);
$a->savePolicy($m);
```
For more usage demos, please view the unit tests or
[Casbin 中文文档](https://casbin.org/docs/zh-CN/overview)
[Casbin Documents](https://casbin.org/docs/en/overview)
## License
This project is licensed under the MIT license.