如何在项目中加入casbin进行简单的权限验证

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act, eft

[role_definition]
g = _, _

[policy_effect]
e = some(where (p.eft == allow)) && !some(where (p.eft == deny))

[matchers]
m = g(r.sub, p.sub) && keyMatch(r.act, p.act) && keyMatch(r.obj, p.obj)

func KeyMatch(key1 string, key2 string) bool {
    i := strings.Index(key2, "*")
    if i == -1 {
        return key1 == key2
    }

    if len(key1) > i {
        return key1[:i] == key2[:i]
    }
    return key1 == key2[:i]
}

package auth

import (
	"os"

	"github.com/casbin/casbin/v2"
	"github.com/casbin/casbin/v2/model"
	gormadapter "github.com/casbin/gorm-adapter/v3"
)

var Casbin *casbin.Enforcer

func InitCasbin() {
    // os.Getenv("MYSQL_DSN")可以参考gorm官方示例:
    //user:pass@tcp(127.0.0.1:3306)/dbname?charset=utf8mb4&parseTime=True&loc=Local
	a, err := gormadapter.NewAdapter("mysql", os.Getenv("MYSQL_DSN"), true)
	if err != nil {
		panic(err)
	}

	m, err := model.NewModelFromString(`
	[request_definition]
	r = sub, obj, act
	
	[policy_definition]
	p = sub, obj, act, eft
	
	[role_definition]
	g = _, _
	
	[policy_effect]
	e = some(where (p.eft == allow)) && !some(where (p.eft == deny))
	
	[matchers]
	m = g(r.sub, p.sub) && keyMatch(r.act, p.act) && keyMatch(r.obj, p.obj)
	`)
	if err != nil {
		panic(err)
	}

	e, err := casbin.NewEnforcer(m, a)
	if err != nil {
		panic(err)
	}
	Casbin = e

	Casbin.LoadPolicy()

    // 检查基础权限是否存在,请按需修改
	if ok, _ := Casbin.Enforce("common_admin", "admin/user", "POST"); !ok {
		initPolicy()
	}
}

func initPolicy() {
	// add base policies
    // 注意，此处一定要填写allow或deny，否则会报错
	Casbin.AddPolicies(
		[][]string{
            //  写入对应权限，请自行调整
			// suspend user can't do anything
			{model.StatusSuspendUser, "*", "*", "deny"},
			// inactive user can't create
			{model.StatusInactiveUser, "user*", "*", "allow"},
			{model.StatusInactiveUser, "file*", "GET", "allow"},
			{model.StatusInactiveUser, "file*", "DELETE", "allow"},
			{model.StatusInactiveUser, "filefolder*", "GET", "allow"},
			{model.StatusInactiveUser, "filefolder*", "DELETE", "allow"},
			{model.StatusInactiveUser, "filestore*", "GET", "allow"},
			{model.StatusInactiveUser, "share*", "GET", "allow"},
			{model.StatusInactiveUser, "share*", "DELETE", "allow"},
			// active user can create file, filefolder and share
			{model.StatusActiveUser, "share*", "*", "allow"},
			{model.StatusActiveUser, "file*", "*", "allow"},
			{model.StatusActiveUser, "filefolder*", "*", "allow"},
			{model.StatusActiveUser, "rank*", "GET", "allow"},
			// admin user can change user status
			{model.StatusAdmin, "admin/user*", "*", "allow"},
			{model.StatusAdmin, "admin/login*", "*", "allow"},
			// super admin can do anything
			{model.StatusSuperAdmin, "*", "*", "allow"},
		},
	)
	// add group policies
	Casbin.AddGroupingPolicies(
		[][]string{
			{model.StatusActiveUser, model.StatusInactiveUser},
			{model.StatusAdmin, model.StatusActiveUser},
		},
	)
	Casbin.SavePolicy()
}

const (
	// super admin
	StatusSuperAdmin = "super_admin"
	// admin User
	StatusAdmin = "common_admin"
	// active User
	StatusActiveUser = "active"
	// inactive User
	StatusInactiveUser = "inactive"
	// Suspend User
	StatusSuspendUser = "suspend"
)

func Init() {
    //其他初始化
    ............
	// start casbin
	auth.InitCasbin()
}

func CasbinAuth() gin.HandlerFunc {
	return func(c *gin.Context) {
        // 获取用户状态，此处已将状态写入gin.context
		userStatus := c.MustGet("Status").(string)
        // 获取用户申请的资源和方法
		method := c.Request.Method
		path := c.Request.URL.Path
        //过滤默认头部，这里将/api/v1/ 过滤
		object := strings.TrimPrefix(path, "/api/v1/")

        // 使用casbin提供的函数进行权限验证
		if ok, _ := auth.Casbin.Enforce(userStatus, object, method); !ok {
			// 如果无权限则返回无权限
            c.JSON(200, serializer.NotAuthErr("not auth"))
            // 中断后续执行
			c.Abort()
		}
	}
}

v1 := r.Group("/api/v1")
	{
		auth := v1.Group("")
		auth.Use(middleware.CasbinAuth())
		{
            // 放入需要权限验证的api
		}
	}

// e.AddPolicy(...)
// e.RemovePolicy(...)
// Save the policy back to DB.
e.SavePolicy()