EFCore persistence

[thoraj]

Can the aspnet core middleware be configured to use EFCore instead of files to persist policy?

[hsluoyz]

@sagilio

[sagilio]

Yes, you can implement a custom IEnforcerProvier like this:

public class CustomEnforcerProvider : IEnforcerProvider
{
    private readonly ICasbinModelProvider _modelProvider;
    private readonly CasbinDbContext<Guid> _casbinDbContext;
    private Enforcer _enforcer;

    public CustomEnforcerProvider(ICasbinModelProvider modelProvider, CasbinDbContext<Guid> casbinDbContext)
    {
        _modelProvider = modelProvider;
        _casbinDbContext = casbinDbContext;
    }

    public Enforcer GetEnforcer()
    {
        _enforcer ??= new Enforcer(_modelProvider.GetModel(), new EFCoreAdapter<Guid>(_casbinDbContext));
        return _enforcer;
    }
}

And add service in Startup.cs like this:

//Add Casbin Authorization
services.AddDbContext<CasbinDbContext<Guid>>(options => options.UseSqlite("Data Source=CasbinSample.db"));
services.AddScoped<IEnforcerProvider, CustomEnforcerProvider>();
services.AddCasbinAuthorization(options =>
{
    options.PreferSubClaimType = ClaimTypes.Name;
    options.DefaultModelPath = Path.Combine("CasbinConfigs", "basic_model.conf");
});

I think we can provide a quick way to configure EFCore Adapter later.

[thoraj]

Thanks,
I noticed that it is possible to register a DefaultEnforcerFactory, and tried this:

            //Add Casbin Authorization
            services.AddCasbinAuthorization(options =>
            {
                options.PreferSubClaimType = ClaimTypes.Name;
                options.DefaultModelPath = Path.Combine("CasbinConfigs", "basic_model.conf");
//                options.DefaultPolicyPath = Path.Combine("CasbinConfigs", "basic_policy.csv");
                options.DefaultRequestTransformer = new CustomRequestTransformer();

                options.DefaultEnforcerFactory = model =>
                {
                    return new Enforcer(model, new DefaultFileAdapter(Path.Combine("CasbinConfigs", "basic_policy.csv")));
                };
            });

Is there a reason not to use the factory method as above instead of using a custom enforcer provider?

[sagilio]

Because the EF Core Adapter needs a dbcontext which is a scope lifetime service. Use DefaultEnforcerFactory may can not get an IServiceProvider to create scope and resolve the dbcontext.
But we can change the DefaultEnforcerFactory to Func<IServiceProvider, ICasbinModel, Enforcer> to fix this problem.

[thoraj]

I will try creating a custom enforcer provider as you suggest. (Although it is probably a good idea to make the changes to DefaultEnforcerFactory also as this is a natural place to customize this).

[sagilio]

Now DefaultEnforcerFactory can get the IServiceProvider, you can use it like this:

services.AddDbContext<CasbinDbContext<Guid>>(options => options.UseSqlite("Data Source=CasbinSample.db"));
//Add Casbin Authorization
services.AddCasbinAuthorization(options =>
{
    options.PreferSubClaimType = ClaimTypes.Name;
    options.DefaultModelPath = Path.Combine("CasbinConfigs", "basic_model.conf");

    options.DefaultEnforcerFactory = (p, m) =>
        new Enforcer(m, new EFCoreAdapter<Guid>(p.GetRequiredService<CasbinDbContext<Guid>>()));
});

[thoraj]

Excellent. Thank you.

We need the casbin database updates to share transaction with updating other parts of the database, so we will check out the best way to handle the CasbinDbContext lifecycle

[VerdonTrigance]

Can we pin this somewhere in the wiki? I guess many of us wants to know how to use it with EF.

[hsluoyz]

@sagilio can we add this to README?

[sagilio]

@hsluoyz @VerdonTrigance
Ok. In fact, I think we should provide a more simple way to use IAdapter.