php-casbin / laravel-authz

An authorization library that supports access control models like ACL, RBAC, ABAC in Laravel.
Apache License 2.0
272 stars 46 forks source link

Validation issues in Restful routing style #42

Closed zhengzhishanliang closed 2 years ago

zhengzhishanliang commented 2 years ago

背景: laravel8+,采取的是restful风格路由,角色绑定路由

1、在casbin的官网编辑器中示例如下: 1646038097(1)

2、在laravel插件里配置如下: 1646038214

3、laravel代码如下: 1646038610(1)

4、请求结果如下: 1646038626(1) 1646038706(1)

5、查看日志问题出在regexMatch方法校验。 1646038768(1)

6、我未重写regexMatch方法。

谢谢大佬们的指导,拜谢。

hsluoyz commented 2 years ago

@leeqvip

leeqvip commented 2 years ago

@zhengzhishanliang This is related to the priority of the policy. It works fine in your editor because this policy is hit first:

p, admin, domain1, /api/admins/permissions, get

If you move the (p, admin, domain1, /api/admins/permissions, *) policy to the front and make it a higher priority, it will also generate an error. because * is not a valid regular expression . see: https://casbin.org/casbin-editor/#BNLXPXAK7 image

zhengzhishanliang commented 2 years ago

@leeqvip 由衷表示感谢!Thank you very much! you solved my problem. Allow me to ask an additional question: I want to have both and GET data for the same url, for example, "alice,/orders," means that alice can request /orders for GET/POST and /orders/:id for GET /PUT/DELETE. "bob ,/orders,GET" means that bob can only request /orders by GET. For this case, I can't use *, then how should I structure my data. Thanks again!

leeqvip commented 2 years ago

@zhengzhishanliang

alice, /orders, (get|post)
zhengzhishanliang commented 2 years ago

@leeqvip thanks !