Projects sharing features with Casl

Casbin is an authorization library that provides a model-based engine for enforcing access control across diverse application environments. It decouples authorization logic from application code by using a configuration-driven approach, allowing developers to define access rules and evaluation logic independently. The system supports a wide range of access control models, including role-based, attribute-based, and relationship-based patterns, which are evaluated at runtime to determine if a subject is permitted to perform an action on a resource. The project distinguishes itself through a hig

Jeesite is a full-stack low-code development framework designed for building enterprise administrative portals using Spring Boot, MyBatis, and Vue. It functions as a comprehensive platform for creating administrative dashboards with integrated role-based access control and organizational data permission systems. The framework distinguishes itself through a combination of automated CRUD code generation and an integrated RAG platform that connects large language models to enterprise data via vector stores. It further incorporates a BPMN-based workflow engine to automate complex business process

SpiceDB is a distributed permission store and relationship-based access control system. It provides a scalable database for storing and querying fine-grained authorization relationships, implementing a consistency model inspired by Google Zanzibar to manage access rights across large-scale applications. The system uses a dedicated schema language to define the rules and logic governing how relationships translate into permissions independently of application code. It functions as a pluggable authorization engine that persists relationship tuples in external relational databases such as Postgr

Platform is a framework for building back-office applications and administrative dashboards using Laravel. It functions as a schema-driven UI framework and CRUD generator that automatically constructs database management interfaces, input forms, and validation rules from programmatic model definitions. The project distinguishes itself through a comprehensive backend UI kit that supports advanced data capture, including geographic coordinate mapping, tabular JSON data matrices, and marketing metadata tracking. It features a robust role-based access control system for managing resource visibili

Pundit is a Ruby authorization framework that implements policy-based access control. It maps domain models to dedicated logic classes that determine whether a user is permitted to perform specific actions on data objects. The framework utilizes plain Ruby objects to decouple authorization logic from the model. It includes mechanisms for data query scoping to filter record collections based on user permissions, as well as attribute-level permission control to restrict which specific model fields a user can modify. The system provides tools for authorization coverage verification to ensure se

This is a role-based access control system for Laravel applications that manages user permissions and roles within a database. It provides a database permissions manager to assign specific abilities to users and roles, utilizing authorization gates to restrict access to routes and interface elements. The project features a wildcard permission system that uses pattern matching to grant broad access across multiple related permissions. It also supports team-scoped access control, allowing users to maintain different roles and permission levels across separate organizational contexts or teams.

Payload is a headless content management system and application framework that uses a code-first approach to define data schemas and administrative interfaces. By utilizing a centralized, type-safe configuration object, it automatically generates database schemas, API endpoints, and a fully customizable admin panel. The system is built on a database-agnostic architecture, allowing it to interface with various storage engines while providing a unified, type-safe API for server-side operations, REST, and GraphQL. What distinguishes Payload is its deep extensibility and developer-centric design.

Moto is a cloud service mockery framework and API mock server that simulates AWS infrastructure locally. It allows developers to test cloud-dependent code and verify infrastructure-as-code templates without deploying real resources or incurring costs. The project functions as an SDK interceptor that can patch existing service clients to redirect requests to a local mock environment. It can also be run as a standalone HTTP server, enabling any programming language to interact with the simulated endpoints. The framework covers a vast array of simulated capabilities, including data storage, com

graphql-engine is an automated GraphQL API engine that transforms database tables and relationships into a queryable GraphQL schema. It functions as a federation gateway and mapper, instantly generating APIs with built-in filtering, pagination, and mutations from existing databases and remote schemas. The project distinguishes itself through a fine-grained access control layer that enforces row-level and field-level permissions. It further provides a real-time data subscription server that converts standard queries into live streams and a system for triggering event-driven webhooks and notifi

Parse Server is a backend-as-a-service solution and Node.js framework that provides a ready-to-use REST and GraphQL API for mobile and web applications. It functions as a core backend infrastructure for managing database schemas, user authentication, and API routing. The system distinguishes itself with a real-time data engine that pushes database updates to clients via WebSockets and a GraphQL server that automatically generates schemas based on application data models. It also features an adapter-based storage layer that abstracts interactions with various cloud and local backends. The pla

WPGraphQL is a GraphQL interface for WordPress that transforms a WordPress installation into a headless content source. It functions as a GraphQL schema provider that maps database structures and relational data into a standardized schema, exposing posts, pages, and custom data types through a single flexible endpoint. The project includes an integrated API query builder and schema explorer, allowing for the visual composition of queries and real-time validation of responses. It provides a system for extending the schema with custom fields and relationships to expose specific business data.

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

Laravel Boilerplate is a pre-built admin panel and application scaffolding for Laravel that provides a complete backend foundation including user management, role-based permissions, and a CoreUI interface. It serves as a starting point for web application development by bundling essential administrative features into a single, ready-to-use package. The project distinguishes itself through a comprehensive identity management system that combines multi-language support across over 20 locales with two-factor authentication and user impersonation capabilities. Its role-based access control system

Twill is a Laravel CMS toolkit and admin panel generator designed for building custom administrative consoles and content management systems. It serves as a headless CMS framework and a toolkit for defining content models and managing structured data through a dedicated administrative interface. The project features a visual block editor that allows publishers to arrange and configure reusable content sections via a drag-and-drop interface. It includes a dedicated digital asset manager for storing, cropping, and optimizing images and files across local or cloud storage, as well as a multiling

Vendure is a Node.js e-commerce engine and headless commerce framework built with NestJS and TypeScript. It serves as a multi-channel commerce platform that manages product catalogs, orders, and customers via a strongly typed GraphQL API. The platform is distinguished by its highly extensible architecture, featuring a customizable administrative dashboard where developers can inject custom React components and entity views. It supports multi-channel commerce, allowing the isolation of products, currencies, and regional catalogs from a single unified backend. The engine covers a broad range o

Boto3 is the AWS SDK for Python, providing a programmatic interface for managing and automating AWS cloud infrastructure and services. It serves as a cloud management API client and resource manager for provisioning, configuring, and scaling virtual servers, databases, and storage. The library enables the implementation of infrastructure-as-code through declarative templates and scripts, allowing for the deployment of identical resource stacks across multiple accounts and geographic regions. It also provides a framework for coordinating distributed workflows, serverless functions, and contain

CanCan is an authorization library for Ruby on Rails applications that provides a declarative framework for defining user permissions. It functions as a role-based access control system that decouples security logic from controllers by centralizing all ability definitions in a single location. The library distinguishes itself by translating permission rules into database-driven filters. This allows the system to retrieve only the specific records a user is permitted to see based on attribute conditions and defined scopes, rather than verifying permissions after data has been loaded. The fram

This project is a reference implementation and a collection of code samples for deploying the Apache Shiro security framework within Java-based web applications. It serves as a demonstration for implementing authentication, authorization, and user identity management. The implementation features distributed session management to coordinate user states across multiple server instances for high availability. It also includes samples for third-party OAuth2 integration, enabling external account authentication, and single sign-on support to grant access to multiple related applications. The proj

Apostrophe is a full-stack JavaScript content management framework built on Node.js. It functions as both a traditional CMS, integrating a backend data store with frontend template rendering, and a headless CMS that exposes content via JSON APIs for decoupled frameworks and mobile applications. The system features an in-context content editor that allows users to modify text and media directly on live pages. It also includes a multi-site management dashboard for coordinating and controlling several distinct websites from a single installation. The framework provides schema-driven content mod

vue-pure-admin is a comprehensive Vue 3 admin dashboard template and TypeScript boilerplate designed for building enterprise web applications. It provides a Vite-based frontend scaffold that incorporates a role-based access control system and a micro-frontend architecture for dividing large administrative applications into smaller, independently deployable units. The project features an advanced permission management framework that handles route protection, menu access filtering, and component-level visibility control. It includes specialized support for multi-tenant system administration, al

GAM is a command-line tool for administering Google Workspace and Cloud Identity. It translates command-line arguments into structured API calls, enabling administrators to manage users, groups, organizational units, and domain settings across a Google Workspace environment. The tool handles authentication through OAuth2 flows, service accounts, and workload identity federation, and supports multi-tenant configurations for managing multiple domains or cloud projects from a single installation. GAM distinguishes itself through its batch processing and automation capabilities. It can process la

Graphene-Django is a GraphQL integration framework and schema mapper used to build typed APIs for Django applications. It functions as a database API layer that transforms Django model fields and relationships into a graph schema, allowing clients to request specific data in a single call. The project implements the Relay specification, providing tools for global object identification and standardized connection-based pagination to manage large datasets. It distinguishes itself by mapping database models, forms, and serializers directly into GraphQL object types and mutations. The framework

Tinyauth is an authentication middleware service and identity provider that verifies user identities to grant system access. It operates as a standalone server or as an authentication gateway, utilizing a reverse proxy model to intercept requests and validate credentials before traffic reaches protected backend services. The project functions as an OpenID Connect provider for single sign-on experiences and an OAuth 2.0 gateway that delegates verification to external providers such as Google and GitHub. It also acts as an LDAP authentication server, allowing for centralized user management and

Casbin is an authorization library designed to manage application access control and permissions through a configurable model-based engine. It serves as a centralized system for verifying whether a user has permission to perform specific actions on a resource. The engine supports multiple access control models, including Role-Based Access Control, Attribute-Based Access Control, and Access Control Lists. It allows for the definition of role hierarchies and the evaluation of user, resource, and environment attributes to make access decisions. The library decouples authorization logic from dat

flask-login is a session management extension for Flask web applications. It functions as an authentication middleware and identity tracker that manages user login and logout processes and provides a mechanism to identify the active user across different application views. The toolkit distinguishes between different session states by tracking session freshness to protect sensitive operations. It also includes security guards to prevent session hijacking and theft by monitoring IP addresses and user agents. The project covers broad capabilities including web access control to restrict specifi

SpringBoot-Shiro-Vue is a permission management framework and role-based access control system. It provides a backend implemented with Spring Boot and a frontend built with Vue.js to manage user roles and map them to specific interface and API access rights. The project utilizes a token-based authentication system to verify user identities and enable stateless communication between the frontend and backend. It implements granular UI permission control to show or hide specific buttons and interface elements based on the current user's assigned access rights. The framework covers API security

ABP is an opinionated architectural framework for building enterprise software solutions using .NET and ASP.NET Core. It serves as a structural toolkit for implementing domain-driven design and microservices patterns, providing a modular enterprise architecture where functionality is organized into independent, pluggable modules. The platform is specifically designed to support multi-tenant SaaS architectures, isolating data and configurations for multiple independent customers within a single application instance. It provides enterprise boilerplate infrastructure and pre-configured templates