func (h UserHandler) CreateUser(c common.HContext) error {
	u := c.Locals("user").(jwt.MapClaims)
	if role := u["role"].(string); role != "admin" {
		return common.ResponseError(c, common.NewForbiddenError("only admin"))
	}
  // ...
}

func (h UserHandler) ListUser(c common.HContext) error {
	u := c.Locals("user").(jwt.MapClaims)
	if role := u["role"].(string); role != "admin" {
		return common.ResponseError(c, common.NewForbiddenError("only admin"))
	}
  // ...
}

func (h UserHandler) GetUser(c common.HContext) error {
	u := c.Locals("user").(jwt.MapClaims)
	if role := u["role"].(string); role != "admin" {
		return common.ResponseError(c, common.NewForbiddenError("only admin"))
	}
  // ...
}

func (h UserHandler) UpdateUser(c common.HContext) error {
	u := c.Locals("user").(jwt.MapClaims)
	if role := u["role"].(string); role != "admin" {
		return common.ResponseError(c, common.NewForbiddenError("only admin"))
	}
  // ...
}

func (h UserHandler) DeleteUser(c common.HContext) error {
	u := c.Locals("user").(jwt.MapClaims)
	if role := u["role"].(string); role != "admin" {
		return common.ResponseError(c, common.NewForbiddenError("only admin"))
	}
  // ...
}

p, (admin)|(user), /api/v1/auth/profile, (GET)|(PATCH)
p, admin, /api/v1/users, (GET)|(POST)
p, admin, /api/v1/users/*, (GET)|(PATCH)|(DELETE)

# กำหนดรูปแบบของ request
[request_definition]
r = sub, obj, act

# กำหนดรูปแบบของ policy
[policy_definition]
p = sub, obj, act

# ตั้งกฏให้ผ่านเมื่อมี matcher ตัวใดตัวหนึ่งเป็น allow
[policy_effect]
e = some(where (p.eft == allow))

# ตั้งกฏการเปรียบเทียบ request กับ policy
[matchers]
m = regexMatch(r.sub, p.sub) && keyMatch(r.obj, p.obj) && regexMatch(r.act, p.act)

package middleware

import (
	"fmt"
	"goapi/pkg/common"
  "goapi/pkg/common/logger"

	"github.com/casbin/casbin/v2"
	"github.com/golang-jwt/jwt/v4"
)

var (
	ErrUnauthorize = common.NewForbiddenError("you are not allowed to access this resource")
	ErrEnforce     = common.NewUnexpectedError("error occurred while enforce")
)

func Authorize(enforcer *casbin.Enforcer) common.HandleFunc {
	return func(c common.HContext) error {
    // ถ้าเป็น public route ให้ข้ามการตรวจสอบไป
		public := c.Locals("public").(bool)
		if public {
			return c.Next()
		}
		// ดึงค่า role ออกมา
		u := c.Locals("user").(jwt.MapClaims)
		role := u["role"].(string)

    // ส่ง request เข้าไปตรวจสอบ
		ok, err := enforcer.Enforce(role, c.Path(), c.Method())

		if err != nil {
			logger.ErrorWithReqId(err.Error(), c.RequestId())
			return common.ResponseError(c, ErrEnforce)
		}

		if !ok {
			return common.ResponseError(c, ErrUnauthorize)
		}

		return c.Next()
	}
}

func Authentication(secretKey string, excludeList map[string][]string) common.HandleFunc {
	return func(c common.HContext) error {
		public := false

		// ...

+		c.Locals("public", public)

		return c.Next()
	}
}

-func (a *app) InitRouter() {
+func (a *app) InitRouter(enforcer *casbin.Enforcer) {
	// ...
	r.Use(util.WrapFiberHandler(middleware.Authentication(a.Config.Token.SecretKey, excludeList)))
+	// authorization with casbin
+	r.Use(util.WrapFiberHandler(middleware.Authorize(enforcer)))

	a.Router = r
}

func main() {
	// Load config
	cfg := config.LoadConfig()
+	// Load acl model and policy
+	enforcer, err := casbin.NewEnforcer("config/acl_model.conf", "config/policy.csv")
	if err != nil {
		panic(err)
	}

	app := app.New(cfg)
	// Cleanup when server stopped
	defer app.Close()

	// For Liveness Probe
	app.CreateLivenessFile()

	// Initialize data sources
	app.InitDS()

	// Create router (mux/gin/fiber)
-	app.InitRouter()
+	app.InitRouter(enforcer)

	// Initialize module with dependency injection
	module.Init(app.Context)
	// Start server
	app.ServeHTTP()
}

p, (admin)|(user), /api/v1/auth/profile, (GET)|(PATCH)
p, admin, /api/v1/users, (GET)|(POST)
p, admin, /api/v1/users/*, (GET)|(PATCH)|(DELETE)

+p2, /api/v1/auth/register, POST
+p2, /api/v1/auth/login, POST

# กำหนดรูปแบบของ request
[request_definition]
r = sub, obj, act
+r2 = obj, act

# กำหนดรูปแบบของ policy
[policy_definition]
p = sub, obj, act
+p2 = obj, act

# ตั้งกฏให้ผ่านเมื่อมี matcher ตัวใดตัวหนึ่งเป็น allow
[policy_effect]
e = some(where (p.eft == allow))
+# ใช้ p.eft นะ ไม่ใช่ p2.eft
+e2 = some(where (p.eft == allow))

# ตั้งกฏการเปรียบเทียบ request กับ policy
[matchers]
m = regexMatch(r.sub, p.sub) && keyMatch(r.obj, p.obj) && regexMatch(r.act, p.act)
+m2 = keyMatch(r2.obj, p2.obj) && regexMatch(r2.act, p2.act)

func AuthenticationCasbin(secretKey string, enforcer *casbin.Enforcer) common.HandleFunc {
	return func(c common.HContext) error {
		public := false

    // ระบุ suffix เช่น 2 จะใช้ r2, p2, e2, m2
		enforceContext := casbin.NewEnforceContext("2")
		// ต้องส่ง enforceContext เข้าไปด้วย ถ้าไม่ส่งจะเรียกที่ r, p, e, m ตลอดนะ
		public, err := enforcer.Enforce(enforceContext, c.Path(), c.Method())
		if err != nil {
			fmt.Println(err)
			return common.ResponseError(c, ErrEnforce)
		}

		if !public && strings.Contains(c.Path(), "/healthz") {
			public = true
		}

		if !public && strings.Contains(c.Path(), "/swagger/") {
			public = true
		}

		if !public && strings.Contains(c.Path(), "/thirdpartySwagger/") {
			public = true
		}

		if !public {
			auth := c.Authorization()
			// validate token
			if auth == "" {
				return common.ResponseError(c, ErrNoToken)
			}

			token := strings.TrimPrefix(auth, "Bearer ")
			valid, claims, err := util.ValidateToken(token, secretKey)

			if err != nil {
				logger.ErrorWithReqId(err.Error(), c.RequestId())
				return common.ResponseError(c, ErrValidateToken)
			}

			if !valid {
				return common.ResponseError(c, ErrInvalidToken)
			}

			c.Locals("user", claims)
		}

		c.Locals("public", public)

		return c.Next()
	}
}

func (a *app) InitRouter(enforcer *casbin.Enforcer) {
	// ...

	// authentication with exclude list
-	excludeList := map[string][]string{
-	  "/api/v1/auth/register": {http.MethodPost},
-	 	"/api/v1/auth/login":    {http.MethodPost},
-	 }
-	r.Use(util.WrapFiberHandler(middleware.Authentication(a.Config.Token.SecretKey, excludeList)))
+	r.Use(util.WrapFiberHandler(middleware.AuthenticationCasbin(a.Config.Token.SecretKey, enforcer)))
	// authorization with casbin
	r.Use(util.WrapFiberHandler(middleware.Authorize(enforcer)))

	a.Router = r
}