Skip to main content

Permission-Based Access Control

PBAC provides granular access control using permission strings (for example, "read:users" or "write:reports").

Permissions are checked against the user's Authorities list.

RequirePermission​

// Requires "read:users", sends 403 on failure
r.Use(auth.RequirePermission("read:users"))

// Custom error handler
r.Use(auth.RequirePermission("read:users", func(c *zen.Ctx) {
    c.Error(403, "access denied")
}))

Must be used after RequireAuth since it reads the user from the context.

Programmatic Checks​

user := auth.GetUser(c)

if user.RequireAuthority("write:reports") {
    // user has the permission
}

if user.RequireAnyPermission("read:reports", "write:reports") {
    // user has at least one of these permissions
}

if user.RequireAllPermissions("read:reports", "write:reports") {
    // user has every listed permission
}

Populating Permissions​

Set permissions when creating the user in your authenticator:

return &auth.User{
    ID:       "123",
    Username: "john",
    Authorities: auth.Authorities("read:users", "write:reports"),
}, nil