Add authorization infrastructure with Casbin policy management

- New SQLAlchemy models for authorization including CasbinRuleModel, PermissionModel, AuthorizationResourceModel, RoleModel, RolePermissionModel, and UserHasRoleModel with proper relationships and constraints - Implementation of SQLAlchemyCasbinPolicyRepository with full CRUD operations for roles, permissions, and policies including cursor-based pagination - CasbinAuthorizationService integrating with the repository layer and providing dynamic enforcer building for access control decisions - Infrastructure setup for authorization module with proper domain entities, services, and repository patterns following the application architecture This commit establishes a comprehensive authorization system backend with database persistence, supporting role-based access control through Casbin policies and efficient data management through SQLAlchemy ORM.
fiqrikm18 · Jun 21, 2026 · Jun 21, 2026 · Jun 21, 2026 · 989280b3d37b61ea8acc2a4e5b914138285775e7
commit 989280b3d37b61ea8acc2a4e5b914138285775e7
diff --git a/.gitignore b/.gitignore
@@ -1,51 +1,6 @@
 ```
-# Python
 __pycache__/
 *.pyc
 *.pyo
 *.pyd
-.Python
-*.so
-*.egg-info/
-.eggs/
-
-# Virtual environments
-venv/
-.venv/
-env/
-ENV/
-.ENV
-
-# Build artifacts
-build/
-dist/
-*.egg
-
-# Testing
-.coverage
-htmlcov/
-.pytest_cache/
-.mypy_cache/
-
-# Logs
-*.log
-
-# Environment variables
-.env
-.env.local
-*.env.*
-
-# IDE
-.vscode/
-.idea/
-*.swp
-*.swo
-*.tmp
-
-# OS
-.DS_Store
-Thumbs.db
-
-# Coverage
-coverage/
 ```
diff --git a/src/core/authorization/infrastructure/models/__init__.py b/src/core/authorization/infrastructure/models/__init__.py
diff --git a/src/core/authorization/infrastructure/models/casbin_rule_model.py b/src/core/authorization/infrastructure/models/casbin_rule_model.py
@@ -0,0 +1,16 @@
+from sqlalchemy import String
+from sqlalchemy.orm import Mapped, mapped_column
+
+from src.shared.database.model import Base
+
+
+class CasbinRuleModel(Base):
+    __tablename__ = "casbin_rules"
+
+    ptype: Mapped[str] = mapped_column(String(16), index=True)
+    v0: Mapped[str | None] = mapped_column(String(255), index=True, nullable=True)
+    v1: Mapped[str | None] = mapped_column(String(255), index=True, nullable=True)
+    v2: Mapped[str | None] = mapped_column(String(255), index=True, nullable=True)
+    v3: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    v4: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    v5: Mapped[str | None] = mapped_column(String(255), nullable=True)
diff --git a/src/core/authorization/infrastructure/models/permission_model.py b/src/core/authorization/infrastructure/models/permission_model.py
@@ -0,0 +1,20 @@
+from uuid import UUID
+
+from sqlalchemy import String, UniqueConstraint
+from sqlalchemy.orm import Mapped, mapped_column
+
+from src.shared.database.mixin.timestamp import SoftDeleteMixin, TimeStampMixin
+from src.shared.database.model import Base
+
+
+class PermissionModel(Base, TimeStampMixin, SoftDeleteMixin):
+    __tablename__ = "permissions"
+    __table_args__ = (
+        UniqueConstraint("resource", "action", name="uq_permissions_resource_action"),
+    )
+
+    key: Mapped[str] = mapped_column(String(255), unique=True, index=True)
+    resource_id: Mapped[UUID] = mapped_column(index=True)
+    resource: Mapped[str] = mapped_column(String(100), index=True)
+    action: Mapped[str] = mapped_column(String(100), index=True)
+    description: Mapped[str | None] = mapped_column(String(255), nullable=True)
diff --git a/src/core/authorization/infrastructure/models/resource_model.py b/src/core/authorization/infrastructure/models/resource_model.py
@@ -0,0 +1,13 @@
+from sqlalchemy import String
+from sqlalchemy.orm import Mapped, mapped_column
+
+from src.shared.database.mixin.timestamp import SoftDeleteMixin, TimeStampMixin
+from src.shared.database.model import Base
+
+
+class AuthorizationResourceModel(Base, TimeStampMixin, SoftDeleteMixin):
+    __tablename__ = "authorization_resources"
+
+    key: Mapped[str] = mapped_column(String(100), unique=True, index=True)
+    name: Mapped[str] = mapped_column(String(150), nullable=False)
+    description: Mapped[str | None] = mapped_column(String(255), nullable=True)
diff --git a/src/core/authorization/infrastructure/models/role_model.py b/src/core/authorization/infrastructure/models/role_model.py
@@ -0,0 +1,12 @@
+from sqlalchemy import String
+from sqlalchemy.orm import Mapped, mapped_column
+
+from src.shared.database.mixin.timestamp import SoftDeleteMixin, TimeStampMixin
+from src.shared.database.model import Base
+
+
+class RoleModel(Base, TimeStampMixin, SoftDeleteMixin):
+    __tablename__ = "roles"
+
+    name: Mapped[str] = mapped_column(String(100), unique=True, index=True)
+    description: Mapped[str | None] = mapped_column(String(255), nullable=True)
diff --git a/src/core/authorization/infrastructure/models/role_permission_model.py b/src/core/authorization/infrastructure/models/role_permission_model.py
@@ -0,0 +1,20 @@
+from uuid import UUID
+
+from sqlalchemy import UniqueConstraint
+from sqlalchemy.orm import Mapped, mapped_column
+
+from src.shared.database.model import Base
+
+
+class RolePermissionModel(Base):
+    __tablename__ = "role_permissions"
+    __table_args__ = (
+        UniqueConstraint(
+            "role_id",
+            "permission_id",
+            name="uq_role_permissions_role_id_permission_id",
+        ),
+    )
+
+    role_id: Mapped[UUID] = mapped_column(index=True)
+    permission_id: Mapped[UUID] = mapped_column(index=True)
diff --git a/src/core/authorization/infrastructure/models/user_has_role_model.py b/src/core/authorization/infrastructure/models/user_has_role_model.py
@@ -0,0 +1,16 @@
+from uuid import UUID
+
+from sqlalchemy import UniqueConstraint
+from sqlalchemy.orm import Mapped, mapped_column
+
+from src.shared.database.model import Base
+
+
+class UserHasRoleModel(Base):
+    __tablename__ = "user_has_roles"
+    __table_args__ = (
+        UniqueConstraint("user_id", "role_id", name="uq_user_has_roles_user_id_role_id"),
+    )
+
+    user_id: Mapped[UUID] = mapped_column(index=True)
+    role_id: Mapped[UUID] = mapped_column(index=True)
diff --git a/src/core/authorization/infrastructure/repositories/__init__.py b/src/core/authorization/infrastructure/repositories/__init__.py