Text Generation WebUI RBAC ABAC Policy —

Text Generation WebUI + RBAC/ABAC

Text Generation WebUI oobabooga LLM RBAC ABAC Access Control Policy Role Permission Attribute Security Production

Access Model	Based On	Flexibility	Complexity	Best For
RBAC	Role ของ User	กลาง	ต่ำ-กลาง	องค์กรทั่วไป Role ชัดเจน
ABAC	Attribute หลายมิติ	สูงมาก	สูง	องค์กรใหญ่ Policy ซับซ้อน
RBAC+ABAC	Role + Attribute	สูงมาก	กลาง-สูง	แนะนำ ผสมข้อดีทั้งสอง
ACL	List per Resource	ต่ำ	ต่ำ (แต่ Scale ยาก)	ระบบเล็ก Resource น้อย

RBAC Implementation

# === RBAC for Text Generation WebUI ===

from dataclasses import dataclass, field
from enum import Enum

class Permission(Enum):
    CHAT = "chat"
    GENERATE = "generate"
    API_ACCESS = "api_access"
    MODEL_LOAD = "model_load"
    MODEL_MANAGE = "model_manage"
    USER_MANAGE = "user_manage"
    VIEW_HISTORY = "view_history"
    DELETE_HISTORY = "delete_history"
    SETTINGS = "settings"
    EXTENSION_MANAGE = "extension_manage"

@dataclass
class Role:
    name: str
    permissions: list
    rate_limit: int  # requests per minute
    max_tokens: int  # max tokens per request
    models_allowed: list  # allowed model patterns

roles = {
    "admin": Role("Admin",
        [p for p in Permission],  # ALL permissions
        rate_limit=1000,
        max_tokens=8192,
        models_allowed=["*"]),
    "developer": Role("Developer",
        [Permission.CHAT, Permission.GENERATE, Permission.API_ACCESS,
         Permission.MODEL_LOAD, Permission.VIEW_HISTORY],
        rate_limit=100,
        max_tokens=4096,
        models_allowed=["llama-*", "mistral-*", "codellama-*"]),
    "user": Role("User",
        [Permission.CHAT, Permission.GENERATE, Permission.VIEW_HISTORY],
        rate_limit=10,
        max_tokens=2048,
        models_allowed=["llama-7b-chat", "mistral-7b-instruct"]),
    "viewer": Role("Viewer",
        [Permission.VIEW_HISTORY],
        rate_limit=5,
        max_tokens=0,
        models_allowed=[]),
}

def check_permission(user_role: str, required: Permission) -> bool:
    role = roles.get(user_role)
    if not role:
        return False
    return required in role.permissions

print("=== RBAC Roles ===")
for key, role in roles.items():
    perms = [p.value for p in role.permissions]
    print(f"  [{role.name}] Rate: {role.rate_limit}/min | Max Tokens: {role.max_tokens}")
    print(f"    Permissions: {', '.join(perms)}")
    print(f"    Models: {role.models_allowed}")

ABAC Policy Engine

# === ABAC Policy Engine ===

@dataclass
class ABACPolicy:
    name: str
    description: str
    conditions: dict
    effect: str  # "allow" or "deny"

policies = [
    ABACPolicy("confidential_model_access",
        "เฉพาะ Senior Dev เข้าถึง Confidential Model",
        {
            "user.clearance": "high",
            "user.department": ["ai", "ml"],
            "resource.sensitivity": "confidential",
            "environment.time": "business_hours",
            "environment.ip_range": "office_network",
        },
        effect="allow"),
    ABACPolicy("large_model_restriction",
        "Model > 30B ใช้ได้เฉพาะ Developer ขึ้นไป",
        {
            "user.role": ["admin", "developer"],
            "resource.model_size": "> 30B",
        },
        effect="allow"),
    ABACPolicy("rate_limit_by_department",
        "Department AI ได้ Rate Limit สูงกว่า",
        {
            "user.department": "ai",
            "action": "generate",
        },
        effect="allow_with_rate_limit_200"),
    ABACPolicy("deny_after_hours_generation",
        "ห้าม Generate นอกเวลาทำการ สำหรับ User ทั่วไป",
        {
            "user.role": "user",
            "action": "generate",
            "environment.time": "after_hours",
        },
        effect="deny"),
    ABACPolicy("audit_all_api_access",
        "บันทึก Log ทุก API Access",
        {
            "action": "api_access",
        },
        effect="allow_with_audit"),
]

def evaluate_policy(user_attrs, resource_attrs, env_attrs, action):
    results = []
    for policy in policies:
        match = True
        for key, value in policy.conditions.items():
            category, attr = key.split(".", 1) if "." in key else ("action", key)
            # Simplified matching logic
            if category == "user" and attr not in user_attrs:
                match = False
            elif category == "resource" and attr not in resource_attrs:
                match = False
        if match:
            results.append({"policy": policy.name, "effect": policy.effect})
    return results

print("=== ABAC Policies ===")
for p in policies:
    print(f"  [{p.name}] Effect: {p.effect}")
    print(f"    Description: {p.description}")
    print(f"    Conditions: {p.conditions}")

API Security

# === API Gateway with Auth === # Nginx reverse proxy with auth # server { # listen 443 ssl; # server_name llm.internal.company.com; # # ssl_certificate /etc/ssl/certs/llm.pem; # ssl_certificate_key /etc/ssl/private/llm.key; # # # Rate limiting # limit_req_zone $binary_remote_addr zone=llm:10m rate=10r/m; # # location /api/v1/generate { # # Auth check # auth_request /auth; # auth_request_set $user_role $upstream_http_x_user_role; # # # Rate limit based on role # limit_req zone=llm burst=5 nodelay; # # proxy_pass http://localhost:5000; # proxy_set_header X-User-Role $user_role; # proxy_read_timeout 120s; # } # # location = /auth { # internal; # proxy_pass http://localhost:8080/verify; # proxy_pass_request_body off; # proxy_set_header Content-Length ""; # proxy_set_header X-Original-URI $request_uri; # proxy_set_header Authorization $http_authorization; # } # } @dataclass class SecurityLayer: layer: str implementation: str protects_against: str config: str layers = [ SecurityLayer("Authentication", "JWT Token / API Key per User", "Unauthorized Access", "Authorization: Bearer "), SecurityLayer("Authorization (RBAC)", "Role check per endpoint", "Privilege Escalation", "X-User-Role header from auth service"), SecurityLayer("Rate Limiting", "Nginx limit_req per role", "DoS, Resource Abuse", "User: 10/min, Dev: 100/min, Admin: 1000/min"), SecurityLayer("Input Validation", "Max tokens, prompt length, banned words", "Prompt Injection, Resource Abuse", "max_tokens: 2048, max_prompt: 4096 chars"), SecurityLayer("Audit Logging", "Log ทุก Request + Response metadata", "Compliance, Forensics", "ELK Stack / CloudWatch Logs"), SecurityLayer("Network", "VPN / Internal Network Only", "External Attack", "Nginx allow 10.0.0.0/8; deny all;"), ] print("=== Security Layers ===") for s in layers: print(f" [{s.layer}] {s.implementation}") print(f" Protects: {s.protects_against}") print(f" Config: {s.config}")