Skip to content

Commit 846f360

Browse files
authored
Merge pull request #2760 from gofr-dev/fix/rbac_docs
Fix minor errors in RBAC doc
2 parents 2821c7a + ab2eed1 commit 846f360

File tree

1 file changed

+18
-10
lines changed

1 file changed

+18
-10
lines changed

docs/advanced-guide/rbac/page.md

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Role-Based Access Control (RBAC) is a security mechanism that restricts access t
77
-**Pure Config-Based** - All authorization rules in JSON/YAML files
88
-**Two-Level Authorization Model** - Roles define permissions, endpoints require permissions (no direct role-to-route mapping)
99
-**Multiple Auth Methods** - Header-based and JWT-based role extraction
10-
-**Permission-Based** - Fine-grained permissions
10+
-**Permission-Based** - Fine-grained permissions
1111
-**Role Inheritance** - Roles inherit permissions from other roles
1212

1313
## Quick Start
@@ -77,6 +77,7 @@ func main() {
7777

7878
> **💡 Best Practice**: For production/public APIs, use JWT-based RBAC instead of header-based RBAC for better security.
7979
80+
8081
## Configuration
8182

8283
### Role Extraction
@@ -189,13 +190,13 @@ RBAC uses **gorilla/mux route pattern conventions** for endpoint matching. This
189190
For endpoints that need to match multiple paths, use mux patterns:
190191

191192
- **Single-level wildcard**: Use `"/api/{resource}"` instead of `"/api/*"`
192-
- Matches: `/api/users`, `/api/posts` (one segment)
193-
193+
- Matches: `/api/users`, `/api/posts` (one segment)
194+
194195
- **Multi-level wildcard**: Use `"/api/{path:.*}"` instead of `"/api/*"`
195-
- Matches: `/api/users/123`, `/api/posts/comments` (any depth)
196-
196+
- Matches: `/api/users/123`, `/api/posts/comments` (any depth)
197+
197198
- **Middle variable**: Use `"/api/{category}/posts"` instead of `"/api/*/posts"`
198-
- Matches: `/api/tech/posts`, `/api/news/posts`
199+
- Matches: `/api/tech/posts`, `/api/news/posts`
199200

200201
## JWT-Based RBAC
201202

@@ -221,6 +222,7 @@ app.EnableRBAC("configs/rbac.json")
221222
}
222223
```
223224

225+
224226
## Accessing Role in Handlers
225227

226228
For business logic, you can access the user's role from the request context:
@@ -268,6 +270,7 @@ func handler(ctx *gofr.Context) (interface{}, error) {
268270

269271
**Note**: All authorization is handled automatically by the middleware. Accessing the role in handlers is only for business logic purposes (e.g., personalizing UI, filtering data).
270272

273+
271274
## Permission Naming Conventions
272275

273276
### Recommended Format
@@ -277,9 +280,10 @@ Use the format: `resource:action`
277280
- **Resource**: The entity being accessed (e.g., `users`, `posts`, `orders`)
278281
- **Action**: The operation being performed (e.g., `read`, `write`, `delete`, `update`)
279282

280-
### Examples
281283

282-
```
284+
### Examples:
285+
286+
```editorconfig
283287
"users:read" // Read users
284288
"users:write" // Create/update users
285289
"users:delete" // Delete users
@@ -289,6 +293,8 @@ Use the format: `resource:action`
289293
"reports:export" // Export reports
290294
```
291295

296+
297+
292298
**Avoid inconsistent formats**:
293299
-`"read_users"`, `"writeUsers"`, `"DELETE_POSTS"`
294300
-`"users:read"`, `"users:write"`, `"posts:delete"`
@@ -366,6 +372,8 @@ Or use role inheritance to avoid duplication:
366372
}
367373
```
368374

375+
376+
369377
### Resource-Specific Permissions
370378

371379
```json
@@ -467,8 +475,8 @@ The middleware automatically handles all authorization - you just define routes
467475

468476
-**Routes in RBAC config**: Authorization is enforced (requires valid role and permissions)
469477
-**Routes NOT in RBAC config**: Requests are allowed to proceed to normal route matching
470-
- If the route exists in your application, it will be handled normally
471-
- If the route doesn't exist, it will return 404 (route not registered)
478+
- If the route exists in your application, it will be handled normally
479+
- If the route doesn't exist, it will return 404 (route not registered)
472480

473481
**Example**:
474482
```json

0 commit comments

Comments
 (0)