api_auth.yaml

drivers:
  daemon:
    services:
      api:
        auth-providers:
          - auth-simple
        auth:
          casbin:
            models:
              - |
                [request_definition]
                r = sub, obj, act

                [policy_definition]
                p = sub, obj, act

                [role_definition]
                g = _, _
                g2 = _, _
                g3 = _, _

                [policy_effect]
                e = some(where (p.eft == allow))

                [matchers]
                m = (r.sub == p.sub && r.obj == p.obj && r.act == p.act) \
                  || (g(r.sub, p.sub) && g2(r.obj, p.obj) && r.act == p.act) \
                  || (g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act) \
                  || (r.sub == p.sub && g2(r.obj, p.obj) && r.act == p.act) \
                  || (r.sub == p.sub && r.obj == p.obj && g3(r.act, p.act)) \
                  || (g(r.sub, p.sub) && g2(r.obj, p.obj) && g3(r.act, p.act)) \
                  || (g(r.sub, p.sub) && r.obj == p.obj && g3(r.act, p.act)) \
                  || (r.sub == p.sub && g2(r.obj, p.obj) && g3(r.act, p.act)) \
                  || (r.sub == p.sub && r.obj == p.obj && g3(r.act, 'read') && p.act == 'write') \
                  || (g(r.sub, p.sub) && g2(r.obj, p.obj) && g3(r.act, 'read') && p.act == 'write') \
                  || (g(r.sub, p.sub) && r.obj == p.obj && g3(r.act, 'read') && p.act == 'write') \
                  || (r.sub == p.sub && g2(r.obj, p.obj) && g3(r.act, 'read') && p.act == 'write') \
                  || (g(r.sub, p.sub) && p.obj == 'everything' && r.act == p.act) \
                  || (r.sub == p.sub && p.obj == 'everything' && r.act == p.act) \
                  || (g(r.sub, p.sub) && p.obj == 'everything' && g3(r.act, p.act)) \
                  || (r.sub == p.sub && p.obj == 'everything' && g3(r.act, p.act)) \
                  || (g(r.sub, p.sub) && p.obj == 'everything' && g3(r.act, 'read') && p.act == 'write') \
                  || (r.sub == p.sub && p.obj == 'everything' && g3(r.act, 'read') && p.act == 'write') \
                  || (r.sub == 'admin')

            policies:
              - |
                # define action groups
                g3, GET, read
                g3, POST, write
                g3, PUT, write

                # define basic policy effects
                p, viewer, everything, read
                p, editor, everything, write