mycasbin

Casbin Multi-Tenant Support

This package provides Casbin enforcer setup with multi-tenant support.

Migration Guide

Old Usage (Deprecated)

// ❌ Old: Direct database connection
enforcer := mycasbin.Setup(db, "")

For security-management (Local Database)

// ✅ security-management uses local database
enforcer, err := mycasbin.SetupForTenant(db, tenantID)

For Microservices (Remote Provider)

// ✅ Microservices use remote provider
provider := grpc_client.NewGrpcCasbinPolicyProvider(connManager)
enforcer, err := mycasbin.SetupWithProvider(provider, tenantID)

API Reference

SetupForTenant

func SetupForTenant(db *gorm.DB, tenantID int) (*casbin.SyncedEnforcer, error)

Creates an independent Casbin enforcer for the specified tenant.

Parameters:

• db: GORM database connection for the tenant's database
• tenantID: Tenant identifier (used for logging and future Redis Watcher channel isolation)

Returns:

• *casbin.SyncedEnforcer: Tenant-specific enforcer instance
• error: Error if setup fails

Example:

db := getTenantDatabase(tenantID)
enforcer, err := mycasbin.SetupForTenant(db, tenantID)
if err != nil {
    return fmt.Errorf("租户 %d Casbin 初始化失败: %w", tenantID, err)
}

// Use enforcer for permission checks
allowed, err := enforcer.Enforce("user", "/api/v1/resource", "GET")

SetupWithProvider

func SetupWithProvider(provider PolicyProvider, tenantID int) (*casbin.SyncedEnforcer, error)

Creates a Casbin enforcer using a PolicyProvider instead of a database connection.

Parameters:

• provider: Policy provider implementation (typically gRPC-based)
• tenantID: Tenant identifier

Returns:

• *casbin.SyncedEnforcer: Enforcer with loaded policies
• error: Error if setup fails

Example:

provider := grpc_client.NewGrpcCasbinPolicyProvider(connManager)
enforcer, err := mycasbin.SetupWithProvider(provider, tenantID)
if err != nil {
    log.Fatalf("Casbin init failed: %v", err)
}

// Use enforcer for permission checks
allowed, err := enforcer.Enforce("user", "/api/v1/resource", "GET")

Usage:

• For microservices (evidence-management, file-storage-service, tenant-service)
• NOT for security-management (use SetupForTenant instead)

Setup (Deprecated)

func Setup(db *gorm.DB, _ string) *casbin.SyncedEnforcer

Legacy function for backward compatibility. Creates a single global enforcer.

Deprecated: Use SetupForTenant instead for proper multi-tenant support.

Redis Watcher

Each tenant gets a dedicated Redis channel for policy synchronization:

// Tenant 1 uses channel: /casbin/tenant/1
// Tenant 2 uses channel: /casbin/tenant/2
// etc.

When a tenant's policies are modified in the database:

1. The modification publishes a message to /casbin/tenant/{tenantID}
2. All instances running that tenant subscribe to the message
3. Each instance's callback reloads policies from the tenant's database
4. The enforcer is updated with the latest policies

Graceful Degradation:

• If Redis is unavailable during SetupForTenant, the enforcer is still created successfully
• A warning is logged, but the tenant can still function
• Policy changes won't be auto-synchronized until Redis is available

Testing

Run tests:

# Unit tests (mock-based)
go test ./sdk/pkg/casbin/... -short

# Integration tests (requires test database)
go test ./sdk/pkg/casbin/... -v

# With coverage
go test ./sdk/pkg/casbin/... -cover -coverprofile=coverage.out

Known Issues

None (as of Stage 2). All multi-tenant isolation issues have been fixed.

Roadmap

• Stage 1: Remove singleton, add SetupForTenant ✅
• Stage 2 (Current): Redis Watcher per-tenant isolation ✅
• Stage 3: Update security-management to use new APIs (pending)

Related Documents

• Casbin Multi-Tenant Isolation Issue Analysis
• Fix Implementation Plan