Permissions

QOR5 permission is based on https://github.com/ory/ladon.
A piece of policy looks like this:
Who is able to do what on something (with given some context)

Who - Subject

Typically in admin system, they are roles like Admin, Super Admin.
Use SubjectsFunc to fetch current subjects:

Able - Effect

  • :presets:users:1:
  • *

What - Action

presets has a list of actions:

  • ContextFunc
  • %!s(MISSING)
  • %!s(MISSING)
  • %!s(MISSING)
  • %!s(MISSING)

And you can define other specific actions if needed.

Something - Resource

An arbitrary unique resource name.
For example %!s(MISSING) represents the user record with id 1.
Use %!s(MISSING) as wildcard.

Context - Condition

Optional.
The current context that containing condition information about the resource.
Use %!s(MISSING) to set the context:

Policy uses Given to set conditions:

Custom Action

Let's say there is a button on User detailing page used to ban the user. And only super_admin users have permission to execute this action.
First, create a verifier

Then inject this verifier to relevant logic, such as

  • whether to show the ban button.
  • validate permission before execute the ban action.

Finally, add policy

Example

Debug

prints permission logs which is very helpful for debugging the permission policies: