GoBeegoCasbinFilter

Part of GoAuthTagger: a beego filter that authorizes every request against a Casbin policy.

web.InsertFilter("*", web.BeforeRouter, routers.ApiFilter) func ApiFilter(ctx *context.Context) { allowed, _ := authz.IsAllowed(getSubject(ctx), urlPath, ...) if !allowed { denyRequest(ctx) } // ctx.Output.JSON(...) } func getSubject(ctx) string { if user == "" { return "anonymous" } ... } // authz: Enforcer.Enforce(...), policy loaded from a literal: p, *, POST, /api/signup

A filter counts only when all of these hold:

• it runs before the controller (BeforeStatic, BeforeRouter, BeforeExec), registered by a live (uncommented) InsertFilter; each registration keeps its own pattern;
• its body (or a function it calls, two hops) calls a Casbin Enforce;
• it writes a response under a negated test (if !allowed {): a 401/403, or an Output / ResponseWriter write or Abort, in the block or in a same-package function it calls (two hops) — a flag or a comment is not a refusal;
• an anonymous caller reaches that test: no earlier if token == "" { return } in the filter lets a request without a credential through.

The policy is a Go raw string (or, when no raw string holds one, a .csv / .conf file) of p, ... lines in the same Go module, read through the model definition whose path field the lines fill with paths. Its effect must be the plain allow-override (some(where (p.eft == allow))); a deny row grants nothing, and any other effect leaves the filter unread. A line grants anonymous access when every subject field is *, the subject the filter passes for a caller without a session (return "anonymous" / user = "guest" under an absence test), or a role that subject has through g lines, and its other fields are *. A path is compared with keyMatch2 after the folds the filter itself applies (if strings.HasPrefix(p, "/scim") { return "/scim" }). Every other route under the filter's pattern, in a program whose main package registers the filter (or imports the package that does), is guarded.