How to Add Custom Super‑Admin Functions in Casbin

The official Casbin documentation shows only how to designate a single user (e.g., "root") as a super‑admin. To support multiple super‑admin accounts, you can define a custom function and integrate it into the policy model.

Steps to create a custom function

Prepare the custom function logic.

Register the function with the Casbin Enforcer.

Reference the function in the model configuration file (CONF).

When using the function, ensure the number of parameters matches the definition.

Example: Custom function implementation

public function isSuperAdmin(string $key1) {
    $superAdminMap = ['root', 'admin'];
    if (in_array($key1, $superAdminMap, true)) {
        return true;
    }
    return false;
}

Convert it to an anonymous function so it can capture external variables:

$superAdminMap = ['root', 'admin'];
$isSuperAdmin = function (string $key1) use ($superAdminMap) {
    if (in_array($key1, $superAdminMap, true)) {
        return true;
    }
    return false;
};

Use the use keyword to pass $superAdminMap into the anonymous function.

Registering the function with Casbin

// Register function
Enforcer::addFunction('isSuperAdmin', $isSuperAdmin);

Or register it directly without a separate variable:

$superAdminMap = ['root', 'admin'];
Enforcer::addFunction('isSuperAdmin', function (string $key1) use ($superAdminMap) {
    if (in_array($key1, $superAdminMap, true)) {
        return true;
    }
    return false;
});

Using the custom function in the model

[matchers]
m = g(r.sub, p.sub) && keyMatch2(r.obj, p.obj) && regexMatch(r.act, p.act) || isSuperAdmin(r.sub)

With this matcher, any request where r.sub matches one of the entries in $superAdminMap will be treated as coming from a super‑admin, bypassing the usual policy checks.