Openfga 授权模型搭建

1.根据项目去启动 配置一个 openfga 服务器

先创建一个 config.yaml文件

cd /opt/openFGA/conf
touch ./config.yaml

怎么配置？

根据官网来看

https://github.com/openfga/openfga/blob/main/.config-schema.json

这里讲述详细的每一个配置每一个类型

这些配置有三种形式配置方式

命令行

需要用 - 隔开每个 属性下的属性 和 properties 的 . 类似

环境变量

OpenFGA 服务器支持用于配置的环境变量，它们将优先于您的配置文件。每个变量都必须以 OPENFGA_ 为前缀，后跟大写的选项（例如，--grpc-tls-key 变为 OPENFGA_GRPC_TLS_KEY）。

官方也讲了怎么配置

 config.yaml文件

需要映射数据卷

这里我们选择使用yaml配置

我们其他的用命令行配置，然后 把会变的用 yaml配置

1.配置限制单个 BatchCheck 请求中允许的检查数量。

maxChecksPerBatchCheck: 3000

 2.限制可同时解决的 Check 数量

maxChecksPerBatchCheck: 3000
maxConcurrentChecksPerBatchCheck: 100

3.ListObjects 将返回在分配时间内找到的结果 

maxChecksPerBatchCheck: 3000
maxConcurrentChecksPerBatchCheck: 100
listObjectsDeadline: 10s

4.ListObjects 最多为配置的最大结果数

maxChecksPerBatchCheck: 3000
maxConcurrentChecksPerBatchCheck: 100
listObjectsDeadline: 10s
listObjectsMaxResults: 3000

 5.Listuser将返回在分配时间内找到的结果 

maxChecksPerBatchCheck: 3000
maxConcurrentChecksPerBatchCheck: 100
listObjectsDeadline: 10s
listObjectsMaxResults: 3000
listUsersDeadline: 10s

6.ListObjects 最多为配置的最大结果数

maxChecksPerBatchCheck: 3000
maxConcurrentChecksPerBatchCheck: 100
listObjectsDeadline: 10s
listObjectsMaxResults: 3000
listUsersDeadline: 10s
listUsersMaxResults: 3000

 7.最大元组一次写入

maxChecksPerBatchCheck: 3000
maxConcurrentChecksPerBatchCheck: 100
listObjectsDeadline: 10s
listObjectsMaxResults: 3000
listUsersDeadline: 10s
listUsersMaxResults: 3000
maxTuplesPerWrite: 1000

 8.最大每个授权模型定义的类型

maxChecksPerBatchCheck: 3000
maxConcurrentChecksPerBatchCheck: 100
listObjectsDeadline: 10s
listObjectsMaxResults: 3000
listUsersDeadline: 10s
listUsersMaxResults: 3000
maxTuplesPerWrite: 1000
maxTypesPerAuthorizationModel: 3000

9.持久化授权模型所允许的最大字节数（默认值为256KB）。

maxChecksPerBatchCheck: 3000
maxConcurrentChecksPerBatchCheck: 100
listObjectsDeadline: 10s
listObjectsMaxResults: 3000
listUsersDeadline: 10s
listUsersMaxResults: 3000
maxTuplesPerWrite: 1000
maxTypesPerAuthorizationModel: 3000
maxAuthorizationModelSizeInBytes: 262144
requestTimeout: 10s

常用的配置就这么多

安装

docker-compose.yaml

version: '3.8'

networks:
  openfga:

services:
  mysql:
    image: mysql:8
    container_name: mysql
    restart: always
    networks:
      - openfga
    ports:
      - "3306:3306"
    environment:
      - MYSQL_ROOT_PASSWORD=secret
      - MYSQL_DATABASE=openfga
    healthcheck:
      test: ["CMD", 'mysqladmin', 'ping', '-h', 'localhost', '-u', 'root', '-p$$MYSQL_ROOT_PASSWORD' ]
      timeout: 20s
      retries: 5

  migrate:
    depends_on:
      mysql:
        condition: service_healthy
    image: openfga/openfga:latest
    container_name: migrate
    command: migrate
    environment:
      - OPENFGA_DATASTORE_ENGINE=mysql
      - OPENFGA_DATASTORE_URI=root:secret@tcp(mysql:3306)/openfga?parseTime=true
    networks:
      - openfga

  openfga:
    depends_on:
      migrate:
        condition: service_completed_successfully
    image: openfga/openfga:latest
    restart: always
    container_name: openfga
    environment:
      - OPENFGA_DATASTORE_ENGINE=mysql
      - OPENFGA_DATASTORE_URI=root:secret@tcp(mysql:3306)/openfga?parseTime=true
      - OPENFGA_LOG_FORMAT=json
    volumes:
      - /opt/openFGA/conf:/etc/openfga
    command: run
    networks:
      - openfga
    ports:
      # Needed for the http server
      - "8080:8080"
      # Needed for the grpc server (if used)
      - "8081:8081"
      # Needed for the playground (Do not enable in prod!)
      - "3000:3000"

启动

cd /opt/openFGA
docker compose up -d

检测配置文件是否生效

docker compose logs -f

 看日志 是生效了

2.下载fga cli

https://github.com/openfga/cli/releases

vim /etc/profile

修改环境变量文件

# 在环境变量文件中末尾，添加如下内容
export OPEN_FGA_HOME=/opt/openFGA/fgacli
export PATH=$OPEN_FGA_HOME:$PATH

# 重新加载环境变量文件
source /etc/profile

编辑配置文件 

vim /root/.fga.yaml
 .fga.yaml 内容如下 
api-url: http://localhost:8080

 根据官网来

试着执行一下命令

fga store create --name "FGA Demo Store"

表示执行成功，也成功在数据库创建了一个Store

 

3.下载Visual Studio Code

下载插件

下载windows版本的 cli

配置环境变量

然后 将fga目录文件也放入环境变量中，

就可以在任何位置使用 fga命令了

vscode 使用 ctrl shift p 选中 插件中的 transform to json 可以把 .fga 转化为 .json文件

然后创建模型开始 接下来就可以开始测试了

跟着官方文档 一步一步走

GitHub - openfga/cli: A cross-platform CLI to interact with an OpenFGA server

4.测试

这里我们作为测试

为了以后逻辑更加清晰，我们以模块化开发chuangj

创建 fga.mod 模块化开发核心组装文件 

schema: '1.2'
contents:
  - core.fga

 创建 核心 core.fga 其中一个模块

module core

type user

type role
  relations
    define member: [user] 

type application
  relations
    define viewer: [user,role#member] 
    define can_view: viewer


type menu
  relations
    define parent: [application]
    define add: can_view from parent

整合创建模型

fga model write --file=fga.mod

测试开始 

Microsoft Windows [版本 10.0.19045.5371]
(c) Microsoft Corporation。保留所有权利。

C:\Users\RJ\Documents\fgatestmodel>fga model get
model
  schema 1.2

type application # module: core, file: core.fga
  relations
    define can_view: viewer
    define viewer: [user, role#member]

type role # module: core, file: core.fga       
  relations
    define member: [user]

type user # module: core, file: core.fga       


C:\Users\RJ\Documents\fgatestmodel>fga model validate -file core.fga
Error: unknown shorthand flag: 'f' in -file

C:\Users\RJ\Documents\fgatestmodel>fga model validate --file core.fga 
{
  "is_valid":false,
  "error":"invalid schema version"
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple write user:jmj member role:admin
{
  "successful": [
    {
      "object":"role:admin",
      "relation":"member",
      "user":"user:jmj"
    }
  ]
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple write user:jmj member role:admin
Error: failed to write tuple: Write validation error for POST Write with body {"code":"write_failed_due_to_invalid_input","message":"cannot write a tuple which already exists: user: 'user:jmj', relation: 'member', object: 'role:admin': tuple to be written already existed or the tuple to be deleted did not exist"}
 with error code write_failed_due_to_invalid_input error message: cannot write a tuple which already exists: user: 'user:jmj', relation: 'member', object: 'role:admin': tuple to be written already existed or the tuple to be deleted did not exist

C:\Users\RJ\Documents\fgatestmodel>fga tuple write user:jmj member role:gaojimanager
{
  "successful": [
    {
      "object":"role:gaojimanager",
      "relation":"member",
      "user":"user:jmj"
    }
  ]
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple write user:jmj member role:putongguanliyuan1
{
  "successful": [
    {
      "object":"role:putongguanliyuan1",
      "relation":"member",
      "user":"user:jmj"
    }
  ]
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple read --user user:jmj --relation member --object role:admin
{
  "continuation_token":"",
  "tuples": [
    {
      "key": {
        "object":"role:admin",
        "relation":"member",
        "user":"user:jmj"
      },
      "timestamp":"2025-01-25T03:06:32Z"
    }
  ]
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple changes --type admin
{
  "changes": [],
  "continuation_token":""
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple changes --type role 
{
  "changes": [
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:06:32Z",
      "tuple_key": {
        "object":"role:admin",
        "relation":"member",
        "user":"user:jmj"
      }
    },
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:07:37Z",
      "tuple_key": {
        "object":"role:gaojimanager",
        "relation":"member",
        "user":"user:jmj"
      }
    },
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:07:45Z",
      "tuple_key": {
        "object":"role:putongguanliyuan1",
        "relation":"member",
        "user":"user:jmj"
      }
    }
  ],
  "continuation_token":"eyJ1bGlkIjoiMDFKSkRQVzBDRDJNVzVXNTFHQ1ZRMDQ5QzYiLCJPYmplY3RUeXBlIjoicm9sZSJ9"
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple changes --type role
{
  "changes": [
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:06:32Z",
      "tuple_key": {
        "object":"role:admin",
        "relation":"member",
        "user":"user:jmj"
      }
    },
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:07:37Z",
      "tuple_key": {
        "object":"role:gaojimanager",
        "relation":"member",
        "user":"user:jmj"
      }
    },
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:07:45Z",
      "tuple_key": {
        "object":"role:putongguanliyuan1",
        "relation":"member",
        "user":"user:jmj"
      }
    }
  ],
  "continuation_token":"eyJ1bGlkIjoiMDFKSkRQVzBDRDJNVzVXNTFHQ1ZRMDQ5QzYiLCJPYmplY3RUeXBlIjoicm9sZSJ9"
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple changes --type role  
{
  "changes": [
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:06:32Z",
      "tuple_key": {
        "object":"role:admin",
        "relation":"member",
        "user":"user:jmj"
      }
    },
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:07:37Z",
      "tuple_key": {
        "object":"role:gaojimanager",
        "relation":"member",
        "user":"user:jmj"
      }
    },
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:07:45Z",
      "tuple_key": {
        "object":"role:putongguanliyuan1",
        "relation":"member",
        "user":"user:jmj"
      }
    }
  ],
  "continuation_token":"eyJ1bGlkIjoiMDFKSkRQVzBDRDJNVzVXNTFHQ1ZRMDQ5QzYiLCJPYmplY3RUeXBlIjoicm9sZSJ9"
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple changes --type role --continuation-token=eyJ1bGlkIjoiMDFKSkRQVzBDRDJNVzVXNTFHQ1ZRMDQ5QzYiLCJPYmplY3RUeXBlIjoicm9sZSJ9
{
  "changes": [],
  "continuation_token":"eyJ1bGlkIjoiMDFKSkRQVzBDRDJNVzVXNTFHQ1ZRMDQ5QzYiLCJPYmplY3RUeXBlIjoicm9sZSJ9"
}

C:\Users\RJ\Documents\fgatestmodel>
C:\Users\RJ\Documents\fgatestmodel>fga tuple changes --type role --continuation-token=eyJ1bGlkIjoiMDFKSkRQVzBDRDJNVzVXNTFHQ1ZRMDQ5QzYiLCJPYmplY3RUeXBlIjoicm9sZSJ9
{
  "changes": [],
  "continuation_token":"eyJ1bGlkIjoiMDFKSkRQVzBDRDJNVzVXNTFHQ1ZRMDQ5QzYiLCJPYmplY3RUeXBlIjoicm9sZSJ9"
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple changes --type role
{
  "changes": [
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:06:32Z",
      "tuple_key": {
        "object":"role:admin",
        "relation":"member",
        "user":"user:jmj"
      }
    },
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:07:37Z",
      "tuple_key": {
        "object":"role:gaojimanager",
        "relation":"member",
        "user":"user:jmj"
      }
    },
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:07:45Z",
      "tuple_key": {
        "object":"role:putongguanliyuan1",
        "relation":"member",
        "user":"user:jmj"
      }
    }
  ],
  "continuation_token":"eyJ1bGlkIjoiMDFKSkRQVzBDRDJNVzVXNTFHQ1ZRMDQ5QzYiLCJPYmplY3RUeXBlIjoicm9sZSJ9"
}

C:\Users\RJ\Documents\fgatestmodel>fga query check user:jmj member role:admin 
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check user:jmj member role:admin
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query list-objects user:jmj member role
{
  "objects": [
    "role:admin",
    "role:putongguanliyuan1",
    "role:gaojimanager"
  ]
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple write user:a can_view docu
Error: failed to write tuple: Write validation error for POST Write with body {"code":"validation_error","message":"Invalid tuple 'docu#can_view@user:a'. Reason: invalid 'object' field format"}
 with error code validation_error error message: Invalid tuple 'docu#can_view@user:a'. Reason: invalid 'object' field format

C:\Users\RJ\Documents\fgatestmodel>fga tuple write user:a can_view docu:aa
Error: failed to write tuple: Write validation error for POST Write with body {"code":"validation_error","message":"Invalid tuple 'docu:aa#can_view@user:a'. Reason: type 'docu' not found"}
 with error code validation_error error message: Invalid tuple 'docu:aa#can_view@user:a'. Reason: type 'docu' not found

C:\Users\RJ\Documents\fgatestmodel>fga tuple write user:bzm member  role:admin
{
  "successful": [
    {
      "object":"role:admin",
      "relation":"member",
      "user":"user:bzm"
    }
  ]
}

C:\Users\RJ\Documents\fgatestmodel>fga query list-relations  user:jmj  role:admin --relation member
{
  "relations": [
    "member"
  ]
}

C:\Users\RJ\Documents\fgatestmodel>fga query list-relations  user:jmj  role --relation member       
{
  "relations": []
}

C:\Users\RJ\Documents\fgatestmodel>fga query list-relations  user:jmj   --relation member     
Error: accepts 2 arg(s), received 1

C:\Users\RJ\Documents\fgatestmodel>fga query list-relations  role:admin   --relation member 
Error: accepts 2 arg(s), received 1

C:\Users\RJ\Documents\fgatestmodel>fga query list-relations  role:admin  user --relation member 
{
  "relations": []
}

C:\Users\RJ\Documents\fgatestmodel>fga query list-relations  role:admin  user:jmj --relation member 
{
  "relations": []
}

C:\Users\RJ\Documents\fgatestmodel>fga query list-relations    user:jmj role:admin --relation member 
{
  "relations": [
    "member"
  ]
}

C:\Users\RJ\Documents\fgatestmodel>fga query expand member  role:admin
{
  "tree": {
    "root": {
      "leaf": {
        "users": {
          "users": [
            "user:bzm",
            "user:jmj"
          ]
        }
      },
      "name":"role:admin#member"
    }
  }
}

C:\Users\RJ\Documents\fgatestmodel>fga query list-uers --object role:admin --relation member --user0filter user
Error: unknown flag: --object

C:\Users\RJ\Documents\fgatestmodel>fga query list-uers --object role:admin --relation member --userfilter user  
Error: unknown flag: --object

C:\Users\RJ\Documents\fgatestmodel>fga query list-uers --object role:admin --relation member --user-filter user 
Error: unknown flag: --object

C:\Users\RJ\Documents\fgatestmodel>fga query list-uers --object  role:admin --relation member --user-filter user
Error: unknown flag: --object

C:\Users\RJ\Documents\fgatestmodel>fga query list-users --object  role:admin --relation member --user-filter user 
{
  "users": [
    {
      "object": {
        "id":"jmj",
        "type":"user"
      }
    },
    {
      "object": {
        "id":"bzm",
        "type":"user"
      }
    }
  ]
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple write role:admin#member viewer application:tigeriotapp
{
  "successful": [
    {
      "object":"application:tigeriotapp",
      "relation":"viewer",
      "user":"role:admin#member"
    }
  ]
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple changes --type application
{
  "changes": [
    {
      "operation":"TUPLE_OPERATION_WRITE",
      "timestamp":"2025-01-25T03:22:43Z",
      "tuple_key": {
        "object":"application:tigeriotapp",
        "relation":"viewer",
        "user":"role:admin#member"
      }
    }
  ],
  "continuation_token":"eyJ1bGlkIjoiMDFKSkRRUUQyQkozQ1M2RDE2NzY4MTBDSloiLCJPYmplY3RUeXBlIjoiYXBwbGljYXRpb24ifQ=="
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple write role:admin#1member viewer application:tigeriotapp
Error: failed to write tuple: Write validation error for POST Write with body {"code":"validation_error","message":"Invalid tuple 'application:tigeriotapp#viewer@role:admin#1member'. Reason: relation 'role#1member' not found"} with error code validation_error error message: Invalid tuple 'application:tigeriotapp#viewer@role:admin#1member'. Reason: relation 'role#1member' not found

C:\Users\RJ\Documents\fgatestmodel>fga query check user:jmj can_view application:tigeriotapp
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check user:bzm can_view application:tigeriotapp 
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check user:cc can_view application:tigeriotapp  
{
  "allowed":false,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check user:cc can_view application:tigeriotapp --contextual-tuple "user:cc member role:admin" 
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga model list
{
  "authorization_models": [
    {
      "id":"01JJDP39W07DXX87KS937GKK9S",
      "created_at":"2025-01-25T02:54:15.936Z"
    }
  ]
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple write application:tigeriotapp parent menu:erwangpingheng 
Error: failed to write tuple: Write validation error for POST Write with body {"code":"validation_error","message":"Invalid tuple 'menu:erwangpingheng#parent@application:tigeriotapp'. Reason: type 'menu' not found"}
 with error code validation_error error message: Invalid tuple 'menu:erwangpingheng#parent@application:tigeriotapp'. Reason: type 'menu' not found

C:\Users\RJ\Documents\fgatestmodel>fga model write --file =fga.mod
Error: failed to read file =fga.mod due to open =fga.mod: The system cannot find the file specified.

C:\Users\RJ\Documents\fgatestmodel>fga model write --file=fga.mod  
{
  "authorization_model_id":"01JJDRB8QK912Y0EW06BMT7VG4"
}

C:\Users\RJ\Documents\fgatestmodel>fga tuple write application:tigeriotapp parent menu:erwangpingheng
{
  "successful": [
    {
      "object":"menu:erwangpingheng",
      "relation":"parent",
      "user":"application:tigeriotapp"
    }
  ]
}

C:\Users\RJ\Documents\fgatestmodel>fga query check user:jmj member role:admin
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check role:admin#rember viewer application:tigeriotapp
Error: check failed: Check validation error for POST Check with body {"code":"validation_error","message":"relation 'role#rember' not found"}
 with error code validation_error error message: relation 'role#rember' not found

C:\Users\RJ\Documents\fgatestmodel>fga query check role:admin#member viewer application:tigeriotapp 
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check role:admin#member can_view  application:tigeriotapp 
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check role:admin add  menu:erwangpingheng                 
{
  "allowed":false,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check application:tigeriotapp add menu:erwangpingheng
{
  "allowed":false,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check application:tigeriotapp parent  menu:erwangpingheng 
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query expand add menu:erwangpingheng
{
  "tree": {
    "root": {
      "leaf": {
        "tupleToUserset": {
          "computed": [
            {
              "userset":"application:tigeriotapp#can_view"
            }
          ],
          "tupleset":"menu:erwangpingheng#parent"
        }
      },
      "name":"menu:erwangpingheng#add"
    }
  }
}

C:\Users\RJ\Documents\fgatestmodel>fga query user:jmj  add  menu:erwangpingheng                        
Run queries (Check, Expand, ListObjects, ListRelations, ListUsers) that are evaluated according to a particular model.

Usage:
  fga query [command]

Available Commands:
  check          Check
  expand         Expand
  list-objects   List Objects
  list-relations List Relations
  list-users     List users

Flags:
      --consistency string             Consistency preference for the request. Valid options are HIGHER_CONSISTENCY and MINIMIZE_LATENCY.
      --context string                 Query context (as a JSON string)
      --contextual-tuple stringArray   Contextual Tuple, output: "user relation object"
  -h, --help                           help for query
      --model-id string                Model ID
      --store-id string                Store ID

Global Flags:
      --api-audience string       API Audience. Used when performing the Client Credentials flow
      --api-scopes stringArray    API Scopes (repeat option for multiple values). Used in the Client Credentials flow
      --api-token string          API Token. Will be sent in as a Bearer in the Authorization header
      --api-token-issuer string   API Token Issuer. API responsible for issuing the API Token. Used in the Client Credentials flow
      --api-url string            OpenFGA API URI e.g. https://api.fga.example:8080 (default "http://localhost:8080")
      --client-id string          Client ID. Sent to the Token Issuer during the Client Credentials flow
      --client-secret string      Client Secret. Sent to the Token Issuer during the Client Credentials flow
      --config string             config file (default is $HOME/.fga.yaml)

Use "fga query [command] --help" for more information about a command.

C:\Users\RJ\Documents\fgatestmodel>fga query check  user:jmj  add  menu:erwangpingheng 
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check  user:jmj  add  menu:erwangpingheng
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check  user:cc  add  menu:erwangpingheng  
{
  "allowed":false,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check  user:jmj  add  menu:erwangpingheng 
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check  role:admin  add  menu:erwangpingheng 
{
  "allowed":false,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check  role:admin#member  add  menu:erwangpingheng 
{
  "allowed":true,
  "resolution":""
}

C:\Users\RJ\Documents\fgatestmodel>fga query check  user:jmj  add  menu:erwangpingheng          
{
  "allowed":true,
  "resolution":""
}

把我的测试记录保存下来了

测试没问题，下一章节我们将 实战入我们自己的项目

5.整合Java SDK

<dependency>
    <groupId>dev.openfga</groupId>
    <artifactId>openfga-sdk</artifactId>
    <version>0.3.1</version>
</dependency>

6.创建一个新的项目

7.导入依赖

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.4.2</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.jmj</groupId>
    <artifactId>openFGA-snap</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>openFGA-snap</name>
    <description>openFGA-snap</description>
    <url/>
    <licenses>
        <license/>
    </licenses>
    <developers>
        <developer/>
    </developers>
    <scm>
        <connection/>
        <developerConnection/>
        <tag/>
        <url/>
    </scm>
    <properties>
        <java.version>21</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>dev.openfga</groupId>
            <artifactId>openfga-sdk</artifactId>
            <version>0.3.1</version>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <annotationProcessorPaths>
                        <path>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok</artifactId>
                        </path>
                    </annotationProcessorPaths>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <excludes>
                        <exclude>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok</artifactId>
                        </exclude>
                    </excludes>
                </configuration>
            </plugin>
        </plugins>
    </build>

</project>

8.从头开始 创建Store

模型 store -> authmodel -> tuple

一个store 里的 授权模型 是以版本号迭代的 ，也就是一个 store 就一个 授权模型，你可以使用不同版本

我们以模块化开发授权模型

1.fga.mod 归纳模块

schema: '1.2'
contents:
  - core.fga

2.core.fga 核心模块

module core

#核心模块
#用户类型
type user 

#角色类型
#关系
# 成员 ：member ：用户类型
type role 
  relations
    define member: [user]  

#应用类型
#关系
# can_access：能否访问： 角色成员用户集
type application 
  relations
    define can_access: [role#member] 

#页面模块分组
#关系
#parent_model父模型
#可见身份: 用户成员组绑定
#访问身份: 用户成员组绑定 且 必须父模型要有访问权限
#能否查看 查看者 与 访问者 都可以访问
#能否访问 只有访问者可以访问
type page_module_group 
  relations
    define parent_model: [application] 
    define viewer: [role#member]
    define accesser: [role#member] and can_access from parent_model
    define can_viewer: viewer or accesser
    define can_access: accesser

#页面模块
#关系
#parent_model父模型
#可见身份: 用户成员组绑定
#访问身份: 用户成员组绑定 且 必须父模型要有访问权限
#能否查看 查看者 与 访问者 都可以访问
#能否访问 只有访问者可以访问
type page_module
  relations
    define parent_model: [page_module_group] 
    define viewer: [role#member]
    define accesser: [role#member] and can_access from parent_model
    define can_viewer: viewer or accesser
    define can_access: accesser

#页面菜单
#关系
#parent_model父模型
#可见身份: 用户成员组绑定
#访问身份: 用户成员组绑定 且 必须父模型要有访问权限
#能否查看 查看者 与 访问者 都可以访问
#能否访问 只有访问者可以访问
type page_menu
  relations
    define parent_model: [page_module] 
    define viewer: [role#member]
    define accesser: [role#member] and can_access from parent_model
    define can_viewer: viewer or accesser
    define can_access: accesser

#页面界面
#关系
#parent_model父模型
#可见身份: 用户成员组绑定
#访问身份: 用户成员组绑定 且 必须父模型要有访问权限
#能否查看 查看者 与 访问者 都可以访问
#能否访问 只有访问者可以访问
type page_view
  relations
    define parent_model: [page_menu] 
    define viewer: [role#member]
    define accesser: [role#member] and can_access from parent_model
    define can_viewer: viewer or accesser
    define can_access: accesser

 配好环境变量

fga model write --file=fga.mod

一个store 就专注于一个 授权模型，由版本进行迭代维护升级，而不是 多个授权模型

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：/a/960980.html

如若内容造成侵权/违法违规/事实不符，请联系我们进行投诉反馈qq邮箱809451989@qq.com，一经查实，立即删除！

相关文章

零刻SER7接口及配置跑分

零刻SER7接口及配置跑分

今天入手了一台迷你机-零刻SER7 &#xff0c;不得不说这机身是真的小啊&#xff0c;相比于传统台式机&#xff0c;它几乎不占空间&#xff0c;可以轻松放置在桌面、电视柜甚至背包中&#xff0c;非常适合需要频繁移动或空间有限的用户。尽管体积小巧&#xff0c;但零刻SER7在性…
阅读更多...
ResNeSt: Split-Attention Networks 参考论文

ResNeSt: Split-Attention Networks 参考论文

参考文献 [1] Tensorflow Efficientnet. https://github.com/tensorflow/tpu/tree/master/models/official/efficientnet. Accessed: 2020-03-04. 中文翻译&#xff1a;[1] TensorFlow EfficientNet. https://github.com/tensorflow/tpu/tree/master/models/official/efficien…
阅读更多...
能够对设备的历史数据进行学习与分析，通过与设备当前状态的比对，识别潜在故障并做出预判的名厨亮灶开源了。

能够对设备的历史数据进行学习与分析，通过与设备当前状态的比对，识别潜在故障并做出预判的名厨亮灶开源了。

明厨亮灶视频监控平台是一款功能强大且简单易用的实时算法视频监控系统。它的愿景是最底层打通各大芯片厂商相互间的壁垒&#xff0c;省去繁琐重复的适配流程&#xff0c;实现芯片、算法、应用的全流程组合&#xff0c;从而大大减少企业级应用约95%的开发成本。AI技术可以24小时…
阅读更多...
大数据学习之Kafka消息队列、Spark分布式计算框架一

大数据学习之Kafka消息队列、Spark分布式计算框架一

Kafka消息队列 章节一.kafka入门 4.kafka入门_消息队列两种模式 5.kafka入门_架构相关名词 Kafka 入门 _ 架构相关名词 事件 记录了世界或您的业务中 “ 发生了某事 ” 的事实。在文档中 也称为记录或消息。当您向 Kafka 读取或写入数据时&#xff0c;您以事件的 形式执行…
阅读更多...
爱书爱考平台说明

爱书爱考平台说明

最近我开发了一个综合性的考试平台&#xff0c;内容包括但不限于职业资格证考试、成人教育、国家公务员考试等内容。目前1.0版本已经开发完成&#xff0c;其他的功能陆续完善中。 微信小程序搜索"爱书爱考" 微信小程序图标如下图: 目前维护了java相关的面试题的考题…
阅读更多...
Docker/K8S

Docker/K8S

文章目录 项目地址一、Docker1.1 创建一个Node服务image1.2 volume1.3 网络1.4 docker compose 二、K8S2.1 集群组成2.2 Pod1. 如何使用Pod(1) 运行一个pod(2) 运行多个pod 2.3 pod的生命周期2.4 pod中的容器1. 容器的生命周期2. 生命周期的回调3. 容器重启策略4. 自定义容器启…
阅读更多...
2023年吉林省职业院校技能大赛网络系统管理样题-网络配置（华三代码）

2023年吉林省职业院校技能大赛网络系统管理样题-网络配置（华三代码）

目录 附录1：拓扑图 附录2：地址规划表 1.S1 2.S3 3.S4 4.S5 5.S7 6.S8 7.S9 8.R1 9.R2 10.R3 11.EG1 12.EG2 13.AC1 14.AC2 附录1：拓扑图 编号 型号
阅读更多...
HTML-新浪新闻-实现标题-排版

HTML-新浪新闻-实现标题-排版

标题排版 图片标签&#xff1a;<img> src&#xff1a;指定图片的url&#xff08;绝对路径/相对路径&#xff09; width&#xff1a;图片的宽度&#xff08;像素/相对于父元素的百分比&#xff09; heigth&#xff1a;图片的高度&#xff08;像素/相对于父元素的百分比&a…
阅读更多...
基于物联网的智能环境监测系统（论文+源码）

基于物联网的智能环境监测系统（论文+源码）

1系统的功能及方案设计 本课题为基于物联网的智能环境监测系统的设计与实现&#xff0c;整个系统采用stm32f103单片机作为主控制器&#xff0c;通过DHT11传感器实现智能环境监测系统温度和湿度的检测&#xff0c;通过MQ传感器实现CO2浓度检测&#xff0c;通过光照传感器实现光照…
阅读更多...
全面解析文件上传下载删除漏洞：风险与应对

全面解析文件上传下载删除漏洞：风险与应对

在数字化转型的时代&#xff0c;文件上传、下载与删除功能已经成为各类应用程序的标准配置&#xff0c;从日常办公使用的协同平台&#xff0c;到云端存储服务&#xff0c;再到社交网络应用&#xff0c;这些功能在给用户带来便捷体验、显著提升工作效率的同时&#xff0c;也隐藏…
阅读更多...
1.2第1章DC/DC变换器的动态建模-1.2Buck-Boost 变换器的交流模型--电力电子系统建模及控制 (徐德鸿)--读书笔记

1.2第1章DC/DC变换器的动态建模-1.2Buck-Boost 变换器的交流模型--电力电子系统建模及控制 (徐德鸿)--读书笔记

1.2 Buck-Boost 变换器的交流模型 Buck- Boost变换器是一种典型的DC/DC变换器&#xff0c;具有升压和降压功能其输出电压的极性与输入电压相反&#xff0c;见图1-4a。当电感L的电流i(t)连续时一个开关周期可以分为两个阶段。在阶段1&#xff0c;开关在位置1时&#xff0c;即&am…
阅读更多...
06-AD向导自动创建P封装(以STM32-LQFP48格式为例)

06-AD向导自动创建P封装(以STM32-LQFP48格式为例)

自动向导创建封装 自动向导创建封装STM32-LQFP48Pin封装1.选则4排-LCC或者QUAD格式2.计算焊盘相定位长度3.设置默认引脚位置(芯片逆时针)4.特殊情况下:加额外的标记 其他问题测量距离:Ctrl M测量 && Ctrl C清除如何区分一脚和其他脚?芯片引脚是逆时针看的? 自动向导…
阅读更多...
若依基本使用及改造记录

若依基本使用及改造记录

若依框架想必大家都了解得不少&#xff0c;不可否认这是一款及其简便易用的框架。 在某种情况下&#xff08;比如私活&#xff09;使用起来可谓是快得一匹。 在这里小兵结合自身实际使用情况&#xff0c;记录一下我对若依框架的使用和改造情况。 一、源码下载 前往码云进行…
阅读更多...
面试经典150题——图

面试经典150题——图

文章目录 1、岛屿数量1.1 题目链接1.2 题目描述1.3 解题代码1.4 解题思路 2、被围绕的区域2.1 题目链接2.2 题目描述2.3 解题代码2.4 解题思路 3、克隆图3.1 题目链接3.2 题目描述3.3 解题代码3.4 解题思路 4、除法求值4.1 题目链接4.2 题目描述4.3 解题代码4.4 解题思路 5、课…
阅读更多...
基于SpringBoot电脑组装系统平台系统功能实现六

基于SpringBoot电脑组装系统平台系统功能实现六

一、前言介绍&#xff1a; 1.1 项目摘要 随着科技的进步&#xff0c;计算机硬件技术日新月异&#xff0c;包括处理器&#xff08;CPU&#xff09;、主板、内存、显卡等关键部件的性能不断提升&#xff0c;为电脑组装提供了更多的选择和可能性。不同的硬件组合可以构建出不同类…
阅读更多...
万字长文总结前端开发知识---JavaScriptVue3Axios

万字长文总结前端开发知识---JavaScriptVue3Axios

JavaScript学习目录 一、JavaScript1. 引入方式1.1 内部脚本 (Inline Script)1.2 外部脚本 (External Script) 2. 基础语法2.1 声明变量2.2 声明常量2.3 输出信息 3. 数据类型3.1 基本数据类型3.2 模板字符串 4. 函数4.1 具名函数 (Named Function)4.2 匿名函数 (Anonymous Fun…
阅读更多...
MySQL(单表访问)

MySQL(单表访问)

今天是新年&#xff0c;祝大家新年快乐&#xff0c;但是生活还是得继续。 后面也会持续更新&#xff0c;学到新东西会在其中补充。 建议按顺序食用&#xff0c;欢迎批评或者交流&#xff01; 缺什么东西欢迎评论&#xff01;我都会及时修改的&#xff01; 大部分截图和文章采…
阅读更多...
HarmonyOS简介：应用开发的机遇、挑战和趋势

HarmonyOS简介：应用开发的机遇、挑战和趋势

问题 更多的智能设备并没有带来更好的全场景体验 连接步骤复杂数据难以互通生态无法共享能力难以协同 主要挑战 针对不同设备上的不同操作系统&#xff0c;重复开发&#xff0c;维护多套版本 多种语言栈&#xff0c;对人员技能要求高 多种开发框架&#xff0c;不同的编程…
阅读更多...
【Elasticsearch】Elasticsearch的查询

【Elasticsearch】Elasticsearch的查询

Elasticsearch的查询 DSL查询基础语句叶子查询全文检索查询matchmulti_match 精确查询termrange 复合查询算分函数查询bool查询 排序分页基础分页深度分页 高亮高亮原理实现高亮 RestClient查询基础查询叶子查询复合查询排序和分页高亮 数据聚合DSL实现聚合Bucket聚合带条件聚合…
阅读更多...
使用 KNN 搜索和 CLIP 嵌入构建多模态图像检索系统

使用 KNN 搜索和 CLIP 嵌入构建多模态图像检索系统

作者&#xff1a;来自 Elastic James Gallagher 了解如何使用 Roboflow Inference 和 Elasticsearch 构建强大的语义图像搜索引擎。 在本指南中&#xff0c;我们将介绍如何使用 Elasticsearch 中的 KNN 聚类和使用计算机视觉推理服务器 Roboflow Inference 计算的 CLIP 嵌入构建…
阅读更多...
最新文章

Copyright @ 2022~2023