While adding permissions to a project I found Casbin — an authorization library supporting ACL, RBAC, ABAC and more. Following its ecosystem led me to Casdoor. Here's what that tour taught me.

Casbin: decoupling policy from business code

Casbin's core idea is separating permission models from business code: the model lives in model.conf, policies live in a database or file, and your app just calls enforce(). Authorization logic becomes independently testable and evolvable.

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = r.sub == p.sub && r.obj == p.obj && r.act == p.act

Why a CLI

The recurring pain point: verifying a model or policy set quickly meant writing a pile of test code. So I built Python and .NET command-line tools for Casbin, turning model and policy validation into a single command.

Casdoor: auth out of the box

Casbin answers "what can you do"; Casdoor answers "who are you" — sign-up, login, OAuth 2.0, OIDC, SAML, with a ready-made web UI that makes SSO fast to ship. Together they form a complete "authentication + authorization" story.

Lessons from contributing

  • Good OSS projects are docs-first: my first contribution was reading docs and fixing typos.
  • CLI tools are a great entry point: clear scope, direct feedback, contained blast radius.
  • Community beats code: Issue discussions keep opening new perspectives.

Wrapping up

Security is less glamorous than AI but it's everywhere, and it matters for every system. Open source let me work with real-world permission systems — I hope my tools help more developers in return.