RBAC(Role-Based Access Control) Support #2000
Description
Problem:
GoFr lacks built-in role-based access control, forcing developers to implement custom authorization logic for each route. This leads to inconsistent security implementations and code duplication.
Goal :
Create a declarative RBAC middleware that integrates seamlessly with GoFr.
- JSON Configuration: Define roles and permissions declaratively
- Multiple Usage Patterns:
-
app.Use(rbac.Middleware(config)) // Global -
app.GET("/admin", rbac.RequireRole("admin")(handler)) // Route-specific
- Flexible Role Extraction: Support JWT claims, sessions, and custom extractors
- Pattern Matching: Handle wildcards () and path patterns (/users/)
- Helper Functions: IsAdmin(), HasRole(), GetUserRoles()
Implementation Plan
- Models-
// RoleConfig defines the roles and their allowed paths/permissions.
type RoleConfig struct {
Roles map[string][]string json:"roles" // e.g., {"admin": ["*"], "editor": ["/edit", "/update"]}
}
// Options allow flexible configuration.
type Options struct {
RoleExtractor func(*Context) ([]string, error) // customized function can be passed
Config RoleConfig
}
- func to load RoleConfig (LoadRoleConfig(path string) (rbac.RoleConfig, error)) and validate config
- Implement func Middleware(opt Options) http.Handler for global use
- Implement route-specific like RequireRole(role string) http.Handler
- isAuthorized function should support pattern match(match(pattern, path string) bool) for wildcard and prefix matching
- Implement helper functions: IsAdmin(c *Context) bool , HasRole(c *Context, role string), GetUserRoles(c *Context) ([]string, error)