Struct AuthzCasbinPlugin 

pub struct AuthzCasbinPlugin {
    enforcer: Arc<Enforcer>,
    username_header: String,
}

Evaluates each request against a compiled Casbin model + policy.

Fields

enforcer: Arc<Enforcer>

The compiled enforcer, shared read-only across requests.

username_header: String

Lowercased header the subject falls back to when no consumer identity is attached.

Implementations

impl AuthzCasbinPlugin

pub fn from_config( config: &HashMap<String, Value>, _resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config, compiling the enforcer eagerly.

Accepted keys (one of the two source pairs is required, matching APISIX’s oneOf):

• model_path (string) + policy_path (string): load the Casbin model and policy from files on the gateway host.
• model (string) + policy (string): inline Casbin model config and CSV policy text (loaded via Casbin’s in-memory string adapter).
• username_header (string, default "x-user"): header the subject is read from when no consumer identity (consumer.name) is present; lowercased for the case-insensitive header map.

Fails fast if neither source pair is fully provided or if Casbin rejects the model/policy.

# inline model + policy
- id: authz
  type: authz-casbin
  config:
    username_header: x-user
    model: |
      [request_definition]
      r = sub, obj, act
      [policy_definition]
      p = sub, obj, act
      [role_definition]
      g = _, _
      [policy_effect]
      e = some(where (p.eft == allow))
      [matchers]
      m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act
    policy: |
      p, admin, /data, GET
      g, alice, admin

# model + policy files on the gateway host
- id: authz
  type: authz-casbin
  config:
    model_path: /etc/featherbit/model.conf
    policy_path: /etc/featherbit/policy.csv
    username_header: x-user

fn subject(&self, ctx: &Context) -> String

Resolves the Casbin subject: the attached consumer identity if present, else the configured header, else "anonymous".

fn deny(ctx: Context) -> Result<PluginOutput, PluginExecutionError>

Builds the 403 denial carrying the context so the graph engine routes through the error port.

Trait Implementations

impl Plugin for AuthzCasbinPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.