Preserve permission decisions with Casbin

In this lesson you will preserve permission decisions with Casbin. Work with the Equipment Rental API in the downloadable lab. The reference is a complete solution with separate lesson checks, so you can inspect the answer, make a deliberate local change and verify its behavior.

Moving a permission rule into Casbin should preserve its decisions. The model represents subject, object and action; policy rows permit named role/action pairs. The matcher also checks ownership for the customer. Unknown roles and unsupported actions have no matching allow, so the policy denies them.

policy.py constructs a small in-memory enforcer from an explicit matrix. It does not create a database policy administrator or grant a real person a role. test_lesson18 compares every combination of four roles, two owner relationships and three actions with the original may function. This equivalence check guards against broadening permission during refactoring. A readable policy still depends on trustworthy inputs: build Principal from the current user record and Resource from the loaded rental. Never accept a client's claimed role or owner as the object. If policy storage becomes persistent, changes need review, versioning and tests of both allowed and denied paths. Refactoring the enforcement mechanism is not a reason to silently alter the policy.

Worked source: equipment/policy.py, enforcer.

Run lesson18 and count the 24 comparisons. Read the policies added to enforcer and the matcher condition. Notice that admin read/check-in and operator check-in are explicit rather than inferred from a vague role hierarchy. The original Python rule provides a reference for this conversion.

def enforcer():
    model = casbin.Model()
    model.load_model_from_text(MODEL)
    result = casbin.Enforcer(model)
    for role, action in (
        ("customer", "read"),
        ("operator", "check_in"),
        ("admin", "read"),
        ("admin", "check_in"),
    ):
        result.add_policy(role, action)
    return result

python run_checks.py -k lesson18