Module authz_casbin 

Embedded Casbin authorization plugin (authz-casbin).

Ports Apache APISIX’s authz-casbin plugin: an in-process ABAC/RBAC authorization gate backed by the [casbin] crate. No network calls are made — the model and policy are loaded from files on the gateway host or from inline strings, and every request is evaluated locally against the compiled [Enforcer].

For each request the plugin derives a Casbin request tuple (subject, object, action) where:

• subject is the authenticated consumer (consumer.name in context.message) when present, otherwise the value of a configured header (username_header, default x-user), otherwise "anonymous" — mirroring APISIX’s headers[conf.username] or "anonymous";
• object is the request path;
• action is the request method.

enforcer.enforce((sub, obj, act)) decides the outcome: true lets the request continue through the success port; false rejects it with a 403 routed through the error port (code AUTHZ_CASBIN_DENIED).

Enforcer construction (blocking at load)

Casbin’s [Enforcer::new] is async, but plugin from_config is sync and runs at config-load time. We build the enforcer on a dedicated short-lived thread that owns a current-thread Tokio runtime and block_ons the async construction. Running it on its own thread (rather than Handle::block_on/futures::executor::block_on on the current thread) avoids the “cannot start a runtime from within a runtime” panic when config is loaded from inside an existing Tokio context, and still gives Casbin a real Tokio runtime for the file-adapter’s I/O. A bad model/policy fails fast here, at load, never at request time. The built enforcer is wrapped in an Arc and shared read-only across requests (enforce takes &self).

Structs

AuthzCasbinPlugin

Evaluates each request against a compiled Casbin model + policy.

Enums

EnforcerSource 🔒

Where the model and policy come from.

Functions

build_enforcer 🔒

Compiles the enforcer on a dedicated thread with its own Tokio runtime.