2026-03-14 02:09:38 +08:00
|
|
|
|
[request_definition]
|
|
|
|
|
|
r = sub, obj, act
|
|
|
|
|
|
|
|
|
|
|
|
[policy_definition]
|
|
|
|
|
|
p = sub, obj, act
|
|
|
|
|
|
|
|
|
|
|
|
[role_definition]
|
|
|
|
|
|
g = _, _
|
|
|
|
|
|
|
|
|
|
|
|
[policy_effect]
|
|
|
|
|
|
e = some(where (p.eft == allow))
|
|
|
|
|
|
|
feat(auth): implement session-based token management with revocation support
Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.
- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
from path-style to admin/<domain> resource naming
2026-07-05 18:28:08 +08:00
|
|
|
|
# 真源策略：user_roles 表为用户-角色唯一真源；Casbin 仅存 p, role, resource, action。
|
|
|
|
|
|
# EnforceForUser 由 CasbinService 先查 DB 角色再对每个角色调 Enforce(role, obj, act)，
|
|
|
|
|
|
# 因此 matcher 直接匹配 r.sub == p.sub（角色直接匹配），不再依赖 g 分组。
|
|
|
|
|
|
#
|
|
|
|
|
|
# matcher 使用 globMatch（doublestar 语义）：
|
|
|
|
|
|
# - '* 匹配单层资源段（不跨 '/'）；
|
|
|
|
|
|
# - '**' 跨多层（如 admin/** 命中 admin/users/roles/write）。
|
|
|
|
|
|
# 资源命名采用路径式 admin/<domain>[/<sub>]，避免 keyMatch2 把 '*' 当作正则通配
|
|
|
|
|
|
# 跨 '.' 而误匹配；也避免 globMatch 在点号分隔下 '*' 仍跨 '.' 的过宽问题。
|
2026-03-14 02:09:38 +08:00
|
|
|
|
[matchers]
|
feat(auth): implement session-based token management with revocation support
Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.
- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
from path-style to admin/<domain> resource naming
2026-07-05 18:28:08 +08:00
|
|
|
|
m = r.sub == p.sub && globMatch(r.obj, p.obj) && (r.act == p.act || p.act == "*")
|
