1. Project Overview

Grit (accumulating sand into a heap...)

Permission management system, or resource authorization management center, or permission control platform

2. Open Source License

Licensed under Apache-2.0

3. Screenshots

4. Feature Overview

The main functions include:

• Resource management
• Resource space (equivalent to application system)
• Resource group (equivalent to channel, module)
• Resource
• Visible (equivalent to menu)
• Not visible (equivalent to permission code)
• Subject management
• Subject group
• Visible (equivalent to enterprise, institution, department)
• Not visible (equivalent to role)
• Subject (equivalent to login user)

5. Tech Stack

Start

Understand the framework and components

Development framework

Description

grit.client

Grit interface declaration and data entity definition. Supports Remote calls and Local calls

grit-solon-solon

Grit.client and solon.auth integration

grit.server

Grit.client interface implementation (can be used as a plugin to integrate with other services)

grit.server.ui-durian

Grit.server + management interface implementation (can be used as a plugin to integrate with other management backends)

Mirror output

Description

noearorg/gritdock:1.4.2

Grit permission management, interface service, and menu navigation service

Single project, can be integrated with grit.server.ui-durian to get client interface and management capabilities

Developing applications

1) Configuration

• pom.xml / Maven configuration

<!-- Client version -->
<dependency>
    <groupId>org.noear</groupId>
    <artifactId>grit.client</artifactId>
    <version>1.4.2</version>
</dependency>

<!-- solon cloud integration version (also applicable to Spring Boot projects) -->
<!-- Add a configuration service plugin when used, for example: water-solon-cloud-plugin -->
<dependency>
    <groupId>org.noear</groupId>
    <artifactId>grit-solon-plugin</artifactId>
    <version>1.4.2</version>
</dependency>

• app.yml / Configuration explanation

solon.app:
  name: "demoadmin"
  group: "demo"

solon.cloud.water:
  server: "waterapi:9371"           #WATER service address
  config:
    load: "grit:gritclient.yml"     # Load gritclient configuration

2) Code

//1, define authentication processor
public class AuthProcessorImpl extends GritAuthProcessor {
    
}

//2, configure verification rules
@Configuration
public class DemoConfig{
    @Bean
    public void initAuth() {
        //adapt authentication framework
        AuthUtil.adapter()
                .loginUrl("/login")
                .addRule(r -> r.include("**").verifyIp().failure((c, t) -> c.output(c.realIp() + ", not whitelist"))) //add ip whitelist verification rule
                .addRule(r -> r.exclude("/login**").exclude(HealthHandler.HANDLER_PATH).exclude("/_**").verifyPath()) //add uri verification rule
                .processor(new AuthProcessorImpl()) //bind verification processor
                .failure((ctx, rst) -> {
                    ctx.outputAsJson(new ONode().set("code", 403).set("msg", "You don't have permission!").toJson());
                });
    }
}

//3, login example
@Controller
public class LoginController{
    @Mapping("/login")
    public Result login(String userName, String userPassword){
        //try to login
        Subject subject = GritClient.global().auth().login(userName, userPassword);

        if (Subject.isEmpty(subject)) {
            return Result.failure("Prompt: account or password is incorrect!");
        } else {
            //load user subject information to session state
            Session.current().loadSubject(subject);
            
            //find a visible uri that the user has permission to
            Resource res = GritClient.global().auth().getUriFrist(subject.subject_id);

            if (Utils.isEmpty(res.link_uri)) {
                //if not found
                return Result.failure("Prompt: please contact administrator to open permission!");
            } else {
                //if found, let frontend jump to target address
                String resUrl = GritUtil.buildDockUri(res);
                return Result.succeed(resUrl);
            }
        }
    }
}

//4, permission control example
@Controller
public class DemoController{
    //annotation mode
    @AuthPermissions("demo:admin")
    public void demo_ajax_del(String key){
        //delete operation, only demo:admin has permission
    }

    //code mode
    public void demo_ajax_del2(String key){
        //delete operation, only demo:admin has permission
        if(GritClient.global().auth().hasPermission(subject_id, "demo:admin")){
            return;
        }
    } 
}

//5, build dynamic menu example
@Component("view:header")
public class HeaderTag implements TemplateDirectiveModel{
    public void execute(){
        //get user's visible uri groups
        List<ResourceGroup> groupList = GritClient.global().auth().getUriGroupList(subjectId);

        //get uri resource list of each group (virtual tree)
        List<ResourceEntity> list = GritClient.global().auth().getUriListByGroup(subjectId, group.resource_id);
        
        //get the first uri resource of each group
        ResourceEntity frist = GritClient.global().auth().getUriFristByGroup(subjectId, group.resource_id);
    }
}

Two deployment modes:

1. Based on configuration service deployment (take water as an example)

• water_docker-compose: Based on water's docker-compose deployment mode
• water_k8s: Based on water's k8s deployment mode

2. Based on data source deployment

Please create a database: grit, and initialize the data structure through grit.sql

• ds_docker-compose: Based on data source deployment's docker-compose deployment mode
• ds_k8s: Based on data source deployment's k8s deployment mode

Image list

Image

Image port

Description

noearorg/gritdock:1.4.2

7281

Management control panel

Appendix: LDAP Login Support:

• Based on water environment

# Configuration item grit/grit.yml, add ldap connection configuration:
grit.ldap:
  url: "ldap://127.0.0.1"
  baseDn: "DC=company,DC=com"
  bindDn: "cn=admin,dc=company,dc=com"
  password: "123456"
  userFilter: "cn=%s"
  groupFilter: "cn=%s

• Self-built data source

Add the above configuration as environment variables for gritdock, and it's done