Casbin + ThinkORM 打造 Webman RBAC 权限管理实战

composer require -W workerman/webman-framework
composer require -W webman/think-orm
composer require -W casbin/webman-permission

return [
    'default' => 'mysql',
    'connections' => [
        'mysql' => [
            'type' => 'mysql',
            'hostname' => env('DB_HOST', '127.0.0.1'),
            'database' => env('DB_DATABASE', 'rbac_db'),
            'username' => env('DB_USERNAME', 'root'),
            'password' => env('DB_PASSWORD', ''),
            'hostport' => env('DB_PORT', 3306),
            'charset' => 'utf8mb4',
            'prefix' => 'sys_',
        ],
    ],
];

<?php
/**
 * @desc permission.php 描述信息
 * @author Tinywan(ShaoBo Wan)
 */
declare(strict_types=1);

return [
    'default' => 'basic',
    /** 日志配置 */
    'log' => [
        'enabled' => false,
        'logger' => 'Casbin',
        'path' => runtime_path() . '/logs/casbin.log'
    ],
    /** 默认配置 */
    'basic' => [
        'model' => [
            'config_type' => 'file',
            'config_file_path' => config_path() . '/plugin/casbin/webman-permission/rbac_model.conf',
            'config_text' => '',
        ],
        // 适配器
        'adapter' => Casbin\WebmanPermission\Adapter\DatabaseAdapter::class, // ThinkORM 适配器
        // 数据库设置
        'database' => [
            'connection' => '',
            'rules_table' => 'casbin_rule',
            'rules_name' => null
        ],
    ],
];

$builder = new \DI\ContainerBuilder();
$builder->addDefinitions(config('dependence', []));
$builder->useAutowiring(true);
return $builder->build();

namespace app\model;

use think\Model;

class CasbinRule extends Model
{
    protected $table = 'casbin_rule';
    public $timestamps = false;
}

namespace app\model;

usethink\Model;

class SysUser extends Model
{
    protected $table = 'sys_user';
    protected $pk = 'uid';  // 主键字段
    
    // 用户-角色关联（多对多）
    publicfunction roles()
    {
        return$this->belongsToMany(SysRole::class, 'sys_user_role', 'role_id', 'user_id');
    }
    
    // 示例：获取用户所有角色编码
    publicfunction getRoleCodes()
    {
        return$this->roles()->column('code');
    }
}

namespace app\model;

usethink\Model;

class SysRole extends Model
{
    protected $table = 'sys_role';
    
    // 角色-菜单关联
    publicfunction menus()
    {
        return$this->belongsToMany(SysMenu::class, 'sys_role_menu', 'menu_id', 'role_id');
    }
}

namespace app\model;

usethink\Model;

class SysMenu extends Model
{
    protected $table = 'sys_menu';
    
    // 菜单-API 关联
    publicfunction apis()
    {
        return$this->belongsToMany(SysApi::class, 'sys_menu_api', 'api_id', 'menu_id');
    }
}

namespace app\controller;

usesupport\Request;
useapp\model\SysRole;
useCasbin\WebmanPermission\Permission;

class RoleController
{
    publicfunction assignMenu(Request $request)
    {
        $roleId = $request->post('roleId');
        $menuIds = $request->post('menuIds', []);  // 数组，防空
        
        // 步骤3.1: 查找角色
        $role = SysRole::find($roleId);
        if (!$role) {
            return response('角色不存在', 404);
        }
        
        // 步骤3.2: 同步菜单关联（ThinkORM 的 sync 方法会删除旧的，添加新的）
        $role->menus()->sync($menuIds);
        
        // 步骤3.3: 清空旧规则（基于角色编码）
        Permission::deletePermissionsForUser($role->code);
        
        // 步骤3.4: 同步新规则（遍历菜单和 API）
        $role->load('menus.apis');  // 预加载
        foreach ($role->menus as $menu) {
            foreach ($menu->apis as $api) {
                // 添加策略：sub, obj, act
                Permission::addPolicy($role->code, $api->path, $api->type);  // type 如 GET
            }
        }
        
        return response('权限同步成功');
    }
}

<?php
/**
 * @desc 权限检查中间件 AuthorizationMiddleware.php
 * @author Tinywan(ShaoBo Wan)
 */
declare(strict_types=1);

namespaceapp\middleware;

useCasbin\Exceptions\CasbinException;
useCasbin\WebmanPermission\Permission;
useTinywan\ExceptionHandler\Exception\ForbiddenHttpException;
useTinywan\ExceptionHandler\Exception\UnauthorizedHttpException;
useTinywan\Jwt\JwtToken;
useWebman\Http\Request;
useWebman\Http\Response;
useWebman\MiddlewareInterface;

class AuthorizationMiddleware implements MiddlewareInterface
{
    /**
     * @param Request $request
     * @param callable $handler
     * @return Response
     * @throws ForbiddenHttpException
     * @throws UnauthorizedHttpException
     */
    publicfunction process(Request $request, callable $handler): Response
    {
        $role = JwtToken::getExtendVal('role');
        if (empty($role)) {
            throw new UnauthorizedHttpException();
        }
        try {
            $url = request()->path();
            $action = request()->method();
            if (!Permission::enforce($role, $url, strtoupper($action))) {
                throw new ForbiddenHttpException();
            }
        } catch (CasbinException $exception) {
            throw new ForbiddenHttpException();
        }
        return $handler($request);
    }
}

return [
    '' => [ // 全局
        app\middleware\AuthorizationMiddleware ::class,
    ],
];