RBAC und ABAC

Owner       — Tenant-Admin, alle Permissions in eigenem Tenant
  ↑
Admin       — App-weit Admin (nur für Operator-Team)
  ↑
Editor      — kann Content erstellen/bearbeiten
  ↑
Viewer      — Read-only
  ↑
Guest       — eingeschränkter Read-Zugriff

const ROLE_PERMISSIONS = {
  viewer:  ['post:read', 'comment:read'],
  editor:  ['post:read', 'post:write', 'comment:read', 'comment:write'],
  admin:   ['post:read', 'post:write', 'post:delete', 'user:manage'],
  owner:   ['*'],  // alle Permissions
};

function can(user, action) {
  const perms = ROLE_PERMISSIONS[user.role] || [];
  return perms.includes('*') || perms.includes(action);
}

app.get('/posts/:id', requirePermission('post:read'), handler);

allow {
  input.action == "delete"
  input.resource.type == "document"
  input.user.tenant == input.resource.tenant
  (
    input.user.role == "admin"
    OR (input.user.role == "editor"
        AND input.resource.status == "draft"
        AND input.user.id == input.resource.authorId)
  )
}

package authz

default allow := false

# Admin darf alles im eigenen Tenant
allow if {
    input.action == "delete"
    input.user.role == "admin"
    input.user.tenant == input.resource.tenant
}

# Author darf eigene Drafts löschen
allow if {
    input.action == "delete"
    input.user.role == "editor"
    input.resource.status == "draft"
    input.user.id == input.resource.authorId
    input.user.tenant == input.resource.tenant
}

// OPA läuft als Sidecar oder zentraler Service
async function checkPermission(user, action, resource) {
  const response = await fetch('http://opa:8181/v1/data/authz/allow', {
    method: 'POST',
    body: JSON.stringify({
      input: { user, action, resource },
    }),
  });
  const { result } = await response.json();
  return result === true;
}

app.delete('/documents/:id', async (req, res) => {
  const doc = await db.documents.findOne({ id: req.params.id });
  if (!(await checkPermission(req.user, 'delete', doc))) {
    return res.status(403).end();
  }
  // ... löschen ...
});

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[role_definition]
g = _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act

p, admin, posts, read
p, admin, posts, write
p, editor, posts, write
p, viewer, posts, read

g, alice, admin
g, bob, editor

import { newEnforcer } from 'casbin';

const enforcer = await newEnforcer('model.conf', 'policy.csv');
const allowed = await enforcer.enforce('alice', 'posts', 'write');  // true

apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: document
  rules:
    - actions: [view]
      effect: EFFECT_ALLOW
      roles: [viewer, editor, admin]

    - actions: [edit, delete]
      effect: EFFECT_ALLOW
      roles: [editor, admin]
      condition:
        match:
          expr: request.principal.attr.tenant == request.resource.attr.tenant

    - actions: [delete]
      effect: EFFECT_ALLOW
      roles: [editor]
      condition:
        match:
          expr: |
            request.resource.attr.status == "draft" &&
            request.resource.attr.authorId == request.principal.id

// RBAC-Basis: Rollen mit Standard-Permissions
const ROLE_PERMISSIONS = {
  viewer:  ['post:read'],
  editor:  ['post:read', 'post:write'],
  admin:   ['post:read', 'post:write', 'post:delete'],
};

// Plus ABAC-Conditions per Resource
const RESOURCE_CONDITIONS = {
  'post:delete': (user, post) => {
    // Admin darf immer, Editor nur eigene drafts
    if (user.role === 'admin') return true;
    if (user.role === 'editor') {
      return post.status === 'draft' && post.authorId === user.id;
    }
    return false;
  },
  'post:write': (user, post) => {
    return post.tenant === user.tenant;
  },
};

function can(user, action, resource = null) {
  const perms = ROLE_PERMISSIONS[user.role] || [];
  if (!perms.includes(action)) return false;
  const condition = RESOURCE_CONDITIONS[action];
  if (condition && resource) return condition(user, resource);
  return true;
}

{
  "sub": "user-42",
  "role": "editor",
  "tenant": "acme",
  "permissions": ["post:read", "post:write"],
  "exp": 1700000000
}