danda322

I can't find something, can you send me a link? (casdoor-go-sdk's test cases)

Hi everyone!

I’m currently evaluating role-based access control models, and Casdoor/Casbin looks promising.

Overview of My Use Case:

I have an API that users from various organizations will need to access. I want to be able to assign roles and restrict access for users/roles/organizations to specific routes within the API.

With Casbin, I understand how to set this up. I’m developing a custom service that integrates JWT handling, setting up user accounts, assigning roles, and issuing access/refresh tokens. For each request, I validate the token and check if the user has the necessary permissions for the specific route.

Questions:

1. Can Casdoor handle this setup out of the box? I’ve deployed the Casdoor all-in-one instance via Docker.

2. Token Verification: I was able to create users through the Casdoor interface and retrieve access_tokens for them, but I didn’t find a specific endpoint for token verification (something like /api/verify-token). What is the recommended way to safely verify an access_token issued by Casdoor?

3. Access Control for Specific Resources: How do I check if a user has access to a specific resource? I noticed an /enforce endpoint in Swagger that looks similar to Casbin’s, but I’m not sure what inputs it requires for it to function correctly.

4. JWT Public Key: From what I understand, Casdoor issues tokens in JWT format, which can be verified using a public key. Is there an endpoint to retrieve this public key from Casdoor, or is it something that needs to be extracted manually from the configuration?

I’d really appreciate any guidance, examples, or resources on this!

Thank you!