Text Generation WebUI RBAC ABAC Policy

Text Generation WebUI + RBAC/ABAC

Text Generation WebUI oobabooga LLM RBAC ABAC Access Control Policy Role Permission Attribute Security Production

RBAC Implementation

# === RBAC for Text Generation WebUI ===

from dataclasses import dataclass, field
from enum import Enum

class Permission(Enum):
    CHAT = "chat"
    GENERATE = "generate"
    API_ACCESS = "api_access"
    MODEL_LOAD = "model_load"
    MODEL_MANAGE = "model_manage"
    USER_MANAGE = "user_manage"
    VIEW_HISTORY = "view_history"
    DELETE_HISTORY = "delete_history"
    SETTINGS = "settings"
    EXTENSION_MANAGE = "extension_manage"

@dataclass
class Role:
    name: str
    permissions: list
    rate_limit: int  # requests per minute
    max_tokens: int  # max tokens per request
    models_allowed: list  # allowed model patterns

roles = {
    "admin": Role("Admin",
        [p for p in Permission],  # ALL permissions
        rate_limit=1000,
        max_tokens=8192,
        models_allowed=["*"]),
    "developer": Role("Developer",
        [Permission.CHAT, Permission.GENERATE, Permission.API_ACCESS,
         Permission.MODEL_LOAD, Permission.VIEW_HISTORY],
        rate_limit=100,
        max_tokens=4096,
        models_allowed=["llama-*", "mistral-*", "codellama-*"]),
    "user": Role("User",
        [Permission.CHAT, Permission.GENERATE, Permission.VIEW_HISTORY],
        rate_limit=10,
        max_tokens=2048,
        models_allowed=["llama-7b-chat", "mistral-7b-instruct"]),
    "viewer": Role("Viewer",
        [Permission.VIEW_HISTORY],
        rate_limit=5,
        max_tokens=0,
        models_allowed=[]),
}

def check_permission(user_role: str, required: Permission) -> bool:
    role = roles.get(user_role)
    if not role:
        return False
    return required in role.permissions

print("=== RBAC Roles ===")
for key, role in roles.items():
    perms = [p.value for p in role.permissions]
    print(f"  [{role.name}] Rate: {role.rate_limit}/min | Max Tokens: {role.max_tokens}")
    print(f"    Permissions: {', '.join(perms)}")
    print(f"    Models: {role.models_allowed}")

ABAC Policy Engine

# === ABAC Policy Engine ===

@dataclass
class ABACPolicy:
    name: str
    description: str
    conditions: dict
    effect: str  # "allow" or "deny"

policies = [
    ABACPolicy("confidential_model_access",
        "เฉพาะ Senior Dev เข้าถึง Confidential Model",
        {
            "user.clearance": "high",
            "user.department": ["ai", "ml"],
            "resource.sensitivity": "confidential",
            "environment.time": "business_hours",
            "environment.ip_range": "office_network",
        },
        effect="allow"),
    ABACPolicy("large_model_restriction",
        "Model > 30B ใช้ได้เฉพาะ Developer ขึ้นไป",
        {
            "user.role": ["admin", "developer"],
            "resource.model_size": "> 30B",
        },
        effect="allow"),
    ABACPolicy("rate_limit_by_department",
        "Department AI ได้ Rate Limit สูงกว่า",
        {
            "user.department": "ai",
            "action": "generate",
        },
        effect="allow_with_rate_limit_200"),
    ABACPolicy("deny_after_hours_generation",
        "ห้าม Generate นอกเวลาทำการ สำหรับ User ทั่วไป",
        {
            "user.role": "user",
            "action": "generate",
            "environment.time": "after_hours",
        },
        effect="deny"),
    ABACPolicy("audit_all_api_access",
        "บันทึก Log ทุก API Access",
        {
            "action": "api_access",
        },
        effect="allow_with_audit"),
]

def evaluate_policy(user_attrs, resource_attrs, env_attrs, action):
    results = []
    for policy in policies:
        match = True
        for key, value in policy.conditions.items():
            category, attr = key.split(".", 1) if "." in key else ("action", key)
            # Simplified matching logic
            if category == "user" and attr not in user_attrs:
                match = False
            elif category == "resource" and attr not in resource_attrs:
                match = False
        if match:
            results.append({"policy": policy.name, "effect": policy.effect})
    return results

print("=== ABAC Policies ===")
for p in policies:
    print(f"  [{p.name}] Effect: {p.effect}")
    print(f"    Description: {p.description}")
    print(f"    Conditions: {p.conditions}")

API Security

# === API Gateway with Auth ===

# Nginx reverse proxy with auth
# server {
#     listen 443 ssl;
#     server_name llm.internal.company.com;
#
#     ssl_certificate /etc/ssl/certs/llm.pem;
#     ssl_certificate_key /etc/ssl/private/llm.key;
#
#     # Rate limiting
#     limit_req_zone $binary_remote_addr zone=llm:10m rate=10r/m;
#
#     location /api/v1/generate {
#         # Auth check
#         auth_request /auth;
#         auth_request_set $user_role $upstream_http_x_user_role;
#
#         # Rate limit based on role
#         limit_req zone=llm burst=5 nodelay;
#
#         proxy_pass http://localhost:5000;
#         proxy_set_header X-User-Role $user_role;
#         proxy_read_timeout 120s;
#     }
#
#     location = /auth {
#         internal;
#         proxy_pass http://localhost:8080/verify;
#         proxy_pass_request_body off;
#         proxy_set_header Content-Length "";
#         proxy_set_header X-Original-URI $request_uri;
#         proxy_set_header Authorization $http_authorization;
#     }
# }

@dataclass
class SecurityLayer:
    layer: str
    implementation: str
    protects_against: str
    config: str

layers = [
    SecurityLayer("Authentication",
        "JWT Token / API Key per User",
        "Unauthorized Access",
        "Authorization: Bearer "),
    SecurityLayer("Authorization (RBAC)",
        "Role check per endpoint",
        "Privilege Escalation",
        "X-User-Role header from auth service"),
    SecurityLayer("Rate Limiting",
        "Nginx limit_req per role",
        "DoS, Resource Abuse",
        "User: 10/min, Dev: 100/min, Admin: 1000/min"),
    SecurityLayer("Input Validation",
        "Max tokens, prompt length, banned words",
        "Prompt Injection, Resource Abuse",
        "max_tokens: 2048, max_prompt: 4096 chars"),
    SecurityLayer("Audit Logging",
        "Log ทุก Request + Response metadata",
        "Compliance, Forensics",
        "ELK Stack / CloudWatch Logs"),
    SecurityLayer("Network",
        "VPN / Internal Network Only",
        "External Attack",
        "Nginx allow 10.0.0.0/8; deny all;"),
]

print("=== Security Layers ===")
for s in layers:
    print(f"  [{s.layer}] {s.implementation}")
    print(f"    Protects: {s.protects_against}")
    print(f"    Config: {s.config}")

เคล็ดลับ

• RBAC: เริ่มจาก RBAC ก่อน ง่ายกว่า เพิ่ม ABAC ทีหลัง
• Least Privilege: ให้สิทธิ์น้อยที่สุดที่จำเป็น เพิ่มเมื่อต้องการ
• Rate Limit: ตั้ง Rate Limit ทุก Role ป้องกัน Resource Abuse
• Audit: บันทึก Log ทุก Access สำหรับ Compliance Review
• Network: รัน WebUI บน Internal Network เท่านั้น ไม่เปิด Public

Text Generation WebUI คืออะไร

oobabooga Web Interface LLM LLaMA Mistral Chat Notebook API Extension GPTQ GGUF GPU Consumer Hardware รันบนเครื่องตัวเอง

สรุป

Text Generation WebUI RBAC ABAC Policy Access Control Role Permission Attribute Rate Limit Audit Security API Nginx JWT Production