Permissions
QOR5 permission is based on https://github.com/ory/ladon.
A piece of policy looks like this:
Who is able to do what on something (with given some context)
Who - Subject
Typically in admin system, they are roles like Admin
, Super Admin
.
Use SubjectsFunc
to fetch current subjects:
Able - Effect
:presets:users:1:
*
What - Action
presets has a list of actions:
ContextFunc
- %!s(MISSING)
- %!s(MISSING)
- %!s(MISSING)
- %!s(MISSING)
And you can define other specific actions if needed.
Something - Resource
An arbitrary unique resource name.
For example %!s(MISSING) represents the user record with id 1.
Use %!s(MISSING) as wildcard.
Context - Condition
Optional.
The current context that containing condition information about the resource.
Use %!s(MISSING) to set the context:
Policy uses Given
to set conditions:
Custom Action
Let's say there is a button on User detailing page used to ban the user. And only super_admin
users have permission to execute this action.
First, create a verifier
Then inject this verifier to relevant logic, such as
- whether to show the ban button.
- validate permission before execute the ban action.
Finally, add policy
Example
Debug
prints permission logs which is very helpful for debugging the permission policies: