You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@casbin.apache.org by tison <wa...@gmail.com> on 2026/10/23 01:37:38 UTC
Review all the repos
Hi,
Recently we filed [1] to transfer back some legacy repos back to the
original casbin org so that it doesn't bother the management of apache org.
[1] https://issues.apache.org/jira/browse/INFRA-28559
I can spot more repos that do not seem to be maintained, and we should move
them out. Here is the list:
No meaningful content:
https://github.com/apache/casbin-node-casbin-next-authz
https://github.com/apache/casbin-node-casbin-mongodb-watcher
https://github.com/apache/casbin-node-casbin-meteor-authz
https://github.com/apache/casbin-node-casbin-mercurius-authz
https://github.com/apache/casbin-python-litestar-authz
https://github.com/apache/casbin-pycasbin-on-cpp
https://github.com/apache/casbin-node-casbin-nextjs-casbin-example
https://github.com/apache/casbin-iris-authz
https://github.com/apache/casbin-benchmark-data
Forks:
https://github.com/apache/casbin-node-casbin-nestjs-casbin-module (bare
fork, do nothing)
https://github.com/apache/casbin-rust-semantic-release-action-rust (we
should no longer need it)
https://github.com/apache/casbin-lego (doesn't seems to be relevent)
Archived:
https://github.com/apache/casbin-lua-apisix-authz (has an alternative)
https://github.com/apache/casbin-website-v3.github.io
https://github.com/apache/casbin-server-deprecated
https://github.com/apache/casbin-node-casbin-nest-authz-deprecated
I'd ask other developers on this list for help in review all our repos and
sort them out.
Best,
tison.
Re: Review all the repos
Posted by tison <wa...@gmail.com>.
I think the next milestone would be a release and then we can consider
to archive or remove the old repository while keep users informed
where they will find the source coe now.
Best,
tison.
Zixuan Liu <zi...@apache.org> 于2026年10月30日周五 16:07写道：
>
> Hi all,
>
> Now, all repos have been migrated to
> https://github.com/apache/casbin-node-extensions.
>
> Now the code and historical tags/releases have been migrated. What should I
> do with the remaining parts of the previous repos, and also consider the
> issue of version release?
>
> The project hasn't been updated for a long time, and I need to unify the
> version dependencies. I will continue to improve.
>
> Thanks,
> Zixuan
>
> tison <wa...@gmail.com> 于2026年10月26日周一 14:39写道：
>
> > Hi Zixuan,
> >
> > I agree on this direction. I think you can create a repo with self-serve
> > tool [1]
> >
> > [1] https://gitbox.apache.org/boxer/?action=newrepo
> >
> > Then cut a new release and we can archive/delete old repos.
> >
> > Best,
> > tison.
> >
> >
> > Zixuan Liu <zi...@apache.org> 于2026年10月24日周六 09:53写道：
> >
> > > Hi all,
> > >
> > > As part of this review, I went through every node-casbin repository one
> > > by one (primary language via the GitHub API, actual package.json contents
> > > to confirm npm package names, and directory inspection for ambiguous
> > > cases). Below is the Node.js part of the cleanup, together with a
> > > proposal to consolidate the maintained extensions into a monorepo — so
> > > one ASF vote covers one release cycle instead of one vote per repo.
> > >
> > > I suggest we settle the Node side first; if the model works, the other
> > > language ecosystems can follow the same pattern in later threads. This
> > > also continues my earlier monorepo proposal [1] with the concrete repo
> > > list and disposal plan.
> > >
> > > [1] https://lists.apache.org/thread/y4xq09n1lk03h8jszb929h17ctdt6xsy
> > > [DISCUSS] Proposal: Consolidate node-casbin Extensions into a
> > > Monorepo with Unified ASF Release Process (2026-04-11)
> > >
> > > --------------------------------------------------------------------
> > > 1. Monorepo scope
> > > --------------------------------------------------------------------
> > >
> > > https://github.com/apache/casbin-node-casbin (npm: casbin) stays a
> > > separate repository: the core has a different release cadence and issue
> > > volume than the extensions.
> > >
> > > These 21 packages move into the monorepo. npm package names are
> > unchanged;
> > > directory names inside the monorepo will be shorter:
> > >
> > > adapters/ (9)
> > > - https://github.com/apache/casbin-node-casbin-basic-adapter
> > > -> casbin-basic-adapter
> > > - https://github.com/apache/casbin-node-casbin-file-adapter
> > > -> casbin-file-adapter
> > > - https://github.com/apache/casbin-node-casbin-node-redis-adapter
> > > -> casbin-redis-adapter
> > > - https://github.com/apache/casbin-node-casbin-mongoose-adapter
> > > -> casbin-mongoose-adapter
> > > - https://github.com/apache/casbin-node-casbin-couchdb-adapter
> > > -> casbin-couchdb-adapter
> > > - https://github.com/apache/casbin-sequelize-adapter
> > > -> casbin-sequelize-adapter
> > > - https://github.com/apache/casbin-typeorm-adapter
> > > -> typeorm-adapter
> > > - https://github.com/apache/casbin-node-casbin-prisma-adapter
> > > -> casbin-prisma-adapter
> > > - https://github.com/apache/casbin-node-casbin-drizzle-adapter
> > > -> drizzle-adapter
> > >
> > > watchers/ (4, all under the @casbin npm scope)
> > > - https://github.com/apache/casbin-node-casbin-redis-watcher
> > > -> @casbin/redis-watcher
> > > - https://github.com/apache/casbin-node-casbin-etcd-watcher
> > > -> @casbin/etcd-watcher
> > > - https://github.com/apache/casbin-node-casbin-node-pubsub-watcher
> > > -> @casbin/pubsub-watcher
> > > -
> > > https://github.com/apache/casbin-node-casbin-mongo-changestream-watcher
> > > -> @casbin/mongo-changestream-watcher
> > >
> > > middlewares/ (5)
> > > - https://github.com/apache/casbin-express-authz
> > > -> casbin-express-authz
> > > - https://github.com/apache/casbin-node-casbin-koa-authz
> > > -> koa-authz
> > > - https://github.com/apache/casbin-egg-authz
> > > -> egg-authz
> > > - https://github.com/apache/casbin-nest-authz
> > > -> nest-authz
> > > - https://github.com/apache/casbin-node-casbin-hapi-authz
> > > -> @casbin/hapi-authz
> > >
> > > utils/ (3)
> > > - https://github.com/apache/casbin-node-casbin-expression-eval
> > > -> @casbin/expression-eval
> > > - https://github.com/apache/casbin-node-casbin-session-role-manager
> > > -> session-role-manager
> > > - https://github.com/apache/casbin-node-casbin-data-permission
> > > -> node-casbin-data-permission
> > >
> > > Plus a non-published examples/ directory:
> > > - https://github.com/apache/casbin-node-casbin-examples
> > > (angular/react/react-native examples)
> > > - https://github.com/apache/casbin-node-casbin-nest-authz-example
> > >
> > > Reviewers' note: similarly named repos WITHOUT the "node" prefix, e.g.
> > > https://github.com/apache/casbin-redis-adapter ,
> > > https://github.com/apache/casbin-mongodb-adapter ,
> > > https://github.com/apache/casbin-mysql-adapter ,
> > > https://github.com/apache/casbin-pg-adapter ,
> > > https://github.com/apache/casbin-json-adapter , are Go repositories and
> > > are NOT affected by this proposal.
> > >
> > > --------------------------------------------------------------------
> > > 2. Delete outright: empty shells and a bare fork (9 repos)
> > > --------------------------------------------------------------------
> > >
> > > The node entries on your list (next-authz, mongodb-watcher, meteor-authz,
> > > mercurius-authz, nextjs-casbin-example) are confirmed empty: nothing but
> > > LICENSE/README/.gitignore, no published casbin npm package, no meaningful
> > > git history. I found three more in exactly the same shape that are
> > > missing from your list — blitz-authz, elysia-casbin, qwik-authz — plus
> > > nestjs-casbin-module, a bare fork whose npm package
> > > (@switchit/nestjs-casbin) belongs to a third party. All nine:
> > >
> > > - https://github.com/apache/casbin-node-casbin-next-authz
> > > - https://github.com/apache/casbin-node-casbin-mongodb-watcher
> > > - https://github.com/apache/casbin-node-casbin-meteor-authz
> > > - https://github.com/apache/casbin-node-casbin-mercurius-authz
> > > - https://github.com/apache/casbin-node-casbin-nextjs-casbin-example
> > > - https://github.com/apache/casbin-node-casbin-blitz-authz
> > > - https://github.com/apache/casbin-node-casbin-elysia-casbin
> > > - https://github.com/apache/casbin-node-casbin-qwik-authz
> > > - https://github.com/apache/casbin-node-casbin-nestjs-casbin-module
> > >
> > > --------------------------------------------------------------------
> > > 3. What happens to the 23 source repos after migration: delete, not
> > archive
> > > --------------------------------------------------------------------
> > >
> > > Since git history is preserved in the monorepo (git filter-repo import),
> > > an archived source repo no longer serves its main purpose. The trade-off:
> > >
> > > archive PRO: keeps the ~180 open issues and PRs across these repos
> > > readable, keeps old GitHub links resolving.
> > > archive CON: does not reduce the repo count under the apache org at all
> > > — which is the management burden this consolidation is
> > > meant to remove.
> > >
> > > Proposal: delete each source repo once its per-repo checklist is done:
> > >
> > > (a) the equivalent npm version has been published from the monorepo;
> > > (b) its open issues are triaged — stale ones closed with a pointer,
> > > still-relevant ones recreated in the monorepo;
> > >
> > > --------------------------------------------------------------------
> > > 4. Open questions
> > > --------------------------------------------------------------------
> > >
> > > a) https://github.com/apache/casbin-node-casbin-graphql-authz :
> > > despite the name, this repo contains Go code (authz.go, go.mod) — a
> > > graphql-go middleware, not a Node package. It should not keep a
> > > node-casbin name. Options: move it to the Go middleware family with a
> > > proper name, or move it out. Go maintainers, please weigh in.
> > >
> > > b) https://github.com/apache/casbin-node-casbin-nest-authz-deprecated :
> > > real code and a published npm package (casbin-nest-authz) whose
> > > repository link points here. Deleting it would break that link, and it
> > > is not part of the monorepo scope, so I propose archiving it in place
> > > with a README pointer to https://github.com/apache/casbin-nest-authz
> > .
> > >
> > > c) npm publish credentials: six packages live under the @casbin npm scope
> > > (the four watchers, hapi-authz, expression-eval); the rest are
> > unscoped
> > > names. For the unified release flow (changesets -> tag -> VOTE -> npm
> > > publish) we need to agree on who holds publish access and how it is
> > > rotated. Please chime in if you currently publish any of these
> > > packages.
> > >
> > > --------------------------------------------------------------------
> > > 5. Plan
> > > --------------------------------------------------------------------
> > >
> > > 1. Pilot: create the monorepo (proposed name:
> > > casbin-node-casbin-extensions)
> > > and import file-adapter + basic-adapter first (no external services
> > > needed) to validate the whole pipeline end to end: import with
> > history,
> > > CI, changesets, release tag, VOTE, npm publish.
> > > 2. Migrate the rest in batches: adapters -> watchers -> middlewares ->
> > > utils -> examples.
> > > 3. File the INFRA ticket to delete the 9 repos in section 2, and delete
> > > each migrated source repo per the checklist in section 3.
> > > 4. One ASF vote per release cycle covers all packages released in that
> > > snapshot; npm publishing happens after the vote passes.
> > >
> > > Once the Node model is proven, I'm happy to help replicate it for the
> > > other ecosystems (Go/Java/Python have the same sprawl) in follow-up
> > > threads.
> > >
> > > Best,
> > > Zixuan
> > >
> > > tison <wa...@gmail.com> 于2026年10月23日周五 09:41写道：
> > >
> > > > There are also a lot of example repos that lack maintenance.
> > > >
> > > > I think we'd either put them all in one repo, or just let any person to
> > > > host these random examples by themselves, rather than put them under
> > the
> > > > apache org.
> > > >
> > > > Best,
> > > > tison.
> > > >
> > > >
> > > > tison <wa...@gmail.com> 于2026年10月23日周五 09:37写道：
> > > >
> > > > > Hi,
> > > > >
> > > > > Recently we filed [1] to transfer back some legacy repos back to the
> > > > > original casbin org so that it doesn't bother the management of
> > apache
> > > > org.
> > > > >
> > > > > [1] https://issues.apache.org/jira/browse/INFRA-28559
> > > > >
> > > > > I can spot more repos that do not seem to be maintained, and we
> > should
> > > > > move them out. Here is the list:
> > > > >
> > > > > No meaningful content:
> > > > > https://github.com/apache/casbin-node-casbin-next-authz
> > > > > https://github.com/apache/casbin-node-casbin-mongodb-watcher
> > > > > https://github.com/apache/casbin-node-casbin-meteor-authz
> > > > > https://github.com/apache/casbin-node-casbin-mercurius-authz
> > > > > https://github.com/apache/casbin-python-litestar-authz
> > > > > https://github.com/apache/casbin-pycasbin-on-cpp
> > > > > https://github.com/apache/casbin-node-casbin-nextjs-casbin-example
> > > > > https://github.com/apache/casbin-iris-authz
> > > > > https://github.com/apache/casbin-benchmark-data
> > > > >
> > > > > Forks:
> > > > > https://github.com/apache/casbin-node-casbin-nestjs-casbin-module
> > > (bare
> > > > > fork, do nothing)
> > > > > https://github.com/apache/casbin-rust-semantic-release-action-rust
> > (we
> > > > > should no longer need it)
> > > > > https://github.com/apache/casbin-lego (doesn't seems to be relevent)
> > > > >
> > > > > Archived:
> > > > > https://github.com/apache/casbin-lua-apisix-authz (has an
> > alternative)
> > > > > https://github.com/apache/casbin-website-v3.github.io
> > > > > https://github.com/apache/casbin-server-deprecated
> > > > > https://github.com/apache/casbin-node-casbin-nest-authz-deprecated
> > > > >
> > > > > I'd ask other developers on this list for help in review all our
> > repos
> > > > and
> > > > > sort them out.
> > > > >
> > > > > Best,
> > > > > tison.
> > > > >
> > > >
> > >
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@casbin.apache.org
For additional commands, e-mail: dev-help@casbin.apache.org
Re: Review all the repos
Posted by Zixuan Liu <zi...@apache.org>.
Hi all,
Now, all repos have been migrated to
https://github.com/apache/casbin-node-extensions.
Now the code and historical tags/releases have been migrated. What should I
do with the remaining parts of the previous repos, and also consider the
issue of version release?
The project hasn't been updated for a long time, and I need to unify the
version dependencies. I will continue to improve.
Thanks,
Zixuan
tison <wa...@gmail.com> 于2026年10月26日周一 14:39写道：
> Hi Zixuan,
>
> I agree on this direction. I think you can create a repo with self-serve
> tool [1]
>
> [1] https://gitbox.apache.org/boxer/?action=newrepo
>
> Then cut a new release and we can archive/delete old repos.
>
> Best,
> tison.
>
>
> Zixuan Liu <zi...@apache.org> 于2026年10月24日周六 09:53写道：
>
> > Hi all,
> >
> > As part of this review, I went through every node-casbin repository one
> > by one (primary language via the GitHub API, actual package.json contents
> > to confirm npm package names, and directory inspection for ambiguous
> > cases). Below is the Node.js part of the cleanup, together with a
> > proposal to consolidate the maintained extensions into a monorepo — so
> > one ASF vote covers one release cycle instead of one vote per repo.
> >
> > I suggest we settle the Node side first; if the model works, the other
> > language ecosystems can follow the same pattern in later threads. This
> > also continues my earlier monorepo proposal [1] with the concrete repo
> > list and disposal plan.
> >
> > [1] https://lists.apache.org/thread/y4xq09n1lk03h8jszb929h17ctdt6xsy
> > [DISCUSS] Proposal: Consolidate node-casbin Extensions into a
> > Monorepo with Unified ASF Release Process (2026-04-11)
> >
> > --------------------------------------------------------------------
> > 1. Monorepo scope
> > --------------------------------------------------------------------
> >
> > https://github.com/apache/casbin-node-casbin (npm: casbin) stays a
> > separate repository: the core has a different release cadence and issue
> > volume than the extensions.
> >
> > These 21 packages move into the monorepo. npm package names are
> unchanged;
> > directory names inside the monorepo will be shorter:
> >
> > adapters/ (9)
> > - https://github.com/apache/casbin-node-casbin-basic-adapter
> > -> casbin-basic-adapter
> > - https://github.com/apache/casbin-node-casbin-file-adapter
> > -> casbin-file-adapter
> > - https://github.com/apache/casbin-node-casbin-node-redis-adapter
> > -> casbin-redis-adapter
> > - https://github.com/apache/casbin-node-casbin-mongoose-adapter
> > -> casbin-mongoose-adapter
> > - https://github.com/apache/casbin-node-casbin-couchdb-adapter
> > -> casbin-couchdb-adapter
> > - https://github.com/apache/casbin-sequelize-adapter
> > -> casbin-sequelize-adapter
> > - https://github.com/apache/casbin-typeorm-adapter
> > -> typeorm-adapter
> > - https://github.com/apache/casbin-node-casbin-prisma-adapter
> > -> casbin-prisma-adapter
> > - https://github.com/apache/casbin-node-casbin-drizzle-adapter
> > -> drizzle-adapter
> >
> > watchers/ (4, all under the @casbin npm scope)
> > - https://github.com/apache/casbin-node-casbin-redis-watcher
> > -> @casbin/redis-watcher
> > - https://github.com/apache/casbin-node-casbin-etcd-watcher
> > -> @casbin/etcd-watcher
> > - https://github.com/apache/casbin-node-casbin-node-pubsub-watcher
> > -> @casbin/pubsub-watcher
> > -
> > https://github.com/apache/casbin-node-casbin-mongo-changestream-watcher
> > -> @casbin/mongo-changestream-watcher
> >
> > middlewares/ (5)
> > - https://github.com/apache/casbin-express-authz
> > -> casbin-express-authz
> > - https://github.com/apache/casbin-node-casbin-koa-authz
> > -> koa-authz
> > - https://github.com/apache/casbin-egg-authz
> > -> egg-authz
> > - https://github.com/apache/casbin-nest-authz
> > -> nest-authz
> > - https://github.com/apache/casbin-node-casbin-hapi-authz
> > -> @casbin/hapi-authz
> >
> > utils/ (3)
> > - https://github.com/apache/casbin-node-casbin-expression-eval
> > -> @casbin/expression-eval
> > - https://github.com/apache/casbin-node-casbin-session-role-manager
> > -> session-role-manager
> > - https://github.com/apache/casbin-node-casbin-data-permission
> > -> node-casbin-data-permission
> >
> > Plus a non-published examples/ directory:
> > - https://github.com/apache/casbin-node-casbin-examples
> > (angular/react/react-native examples)
> > - https://github.com/apache/casbin-node-casbin-nest-authz-example
> >
> > Reviewers' note: similarly named repos WITHOUT the "node" prefix, e.g.
> > https://github.com/apache/casbin-redis-adapter ,
> > https://github.com/apache/casbin-mongodb-adapter ,
> > https://github.com/apache/casbin-mysql-adapter ,
> > https://github.com/apache/casbin-pg-adapter ,
> > https://github.com/apache/casbin-json-adapter , are Go repositories and
> > are NOT affected by this proposal.
> >
> > --------------------------------------------------------------------
> > 2. Delete outright: empty shells and a bare fork (9 repos)
> > --------------------------------------------------------------------
> >
> > The node entries on your list (next-authz, mongodb-watcher, meteor-authz,
> > mercurius-authz, nextjs-casbin-example) are confirmed empty: nothing but
> > LICENSE/README/.gitignore, no published casbin npm package, no meaningful
> > git history. I found three more in exactly the same shape that are
> > missing from your list — blitz-authz, elysia-casbin, qwik-authz — plus
> > nestjs-casbin-module, a bare fork whose npm package
> > (@switchit/nestjs-casbin) belongs to a third party. All nine:
> >
> > - https://github.com/apache/casbin-node-casbin-next-authz
> > - https://github.com/apache/casbin-node-casbin-mongodb-watcher
> > - https://github.com/apache/casbin-node-casbin-meteor-authz
> > - https://github.com/apache/casbin-node-casbin-mercurius-authz
> > - https://github.com/apache/casbin-node-casbin-nextjs-casbin-example
> > - https://github.com/apache/casbin-node-casbin-blitz-authz
> > - https://github.com/apache/casbin-node-casbin-elysia-casbin
> > - https://github.com/apache/casbin-node-casbin-qwik-authz
> > - https://github.com/apache/casbin-node-casbin-nestjs-casbin-module
> >
> > --------------------------------------------------------------------
> > 3. What happens to the 23 source repos after migration: delete, not
> archive
> > --------------------------------------------------------------------
> >
> > Since git history is preserved in the monorepo (git filter-repo import),
> > an archived source repo no longer serves its main purpose. The trade-off:
> >
> > archive PRO: keeps the ~180 open issues and PRs across these repos
> > readable, keeps old GitHub links resolving.
> > archive CON: does not reduce the repo count under the apache org at all
> > — which is the management burden this consolidation is
> > meant to remove.
> >
> > Proposal: delete each source repo once its per-repo checklist is done:
> >
> > (a) the equivalent npm version has been published from the monorepo;
> > (b) its open issues are triaged — stale ones closed with a pointer,
> > still-relevant ones recreated in the monorepo;
> >
> > --------------------------------------------------------------------
> > 4. Open questions
> > --------------------------------------------------------------------
> >
> > a) https://github.com/apache/casbin-node-casbin-graphql-authz :
> > despite the name, this repo contains Go code (authz.go, go.mod) — a
> > graphql-go middleware, not a Node package. It should not keep a
> > node-casbin name. Options: move it to the Go middleware family with a
> > proper name, or move it out. Go maintainers, please weigh in.
> >
> > b) https://github.com/apache/casbin-node-casbin-nest-authz-deprecated :
> > real code and a published npm package (casbin-nest-authz) whose
> > repository link points here. Deleting it would break that link, and it
> > is not part of the monorepo scope, so I propose archiving it in place
> > with a README pointer to https://github.com/apache/casbin-nest-authz
> .
> >
> > c) npm publish credentials: six packages live under the @casbin npm scope
> > (the four watchers, hapi-authz, expression-eval); the rest are
> unscoped
> > names. For the unified release flow (changesets -> tag -> VOTE -> npm
> > publish) we need to agree on who holds publish access and how it is
> > rotated. Please chime in if you currently publish any of these
> > packages.
> >
> > --------------------------------------------------------------------
> > 5. Plan
> > --------------------------------------------------------------------
> >
> > 1. Pilot: create the monorepo (proposed name:
> > casbin-node-casbin-extensions)
> > and import file-adapter + basic-adapter first (no external services
> > needed) to validate the whole pipeline end to end: import with
> history,
> > CI, changesets, release tag, VOTE, npm publish.
> > 2. Migrate the rest in batches: adapters -> watchers -> middlewares ->
> > utils -> examples.
> > 3. File the INFRA ticket to delete the 9 repos in section 2, and delete
> > each migrated source repo per the checklist in section 3.
> > 4. One ASF vote per release cycle covers all packages released in that
> > snapshot; npm publishing happens after the vote passes.
> >
> > Once the Node model is proven, I'm happy to help replicate it for the
> > other ecosystems (Go/Java/Python have the same sprawl) in follow-up
> > threads.
> >
> > Best,
> > Zixuan
> >
> > tison <wa...@gmail.com> 于2026年10月23日周五 09:41写道：
> >
> > > There are also a lot of example repos that lack maintenance.
> > >
> > > I think we'd either put them all in one repo, or just let any person to
> > > host these random examples by themselves, rather than put them under
> the
> > > apache org.
> > >
> > > Best,
> > > tison.
> > >
> > >
> > > tison <wa...@gmail.com> 于2026年10月23日周五 09:37写道：
> > >
> > > > Hi,
> > > >
> > > > Recently we filed [1] to transfer back some legacy repos back to the
> > > > original casbin org so that it doesn't bother the management of
> apache
> > > org.
> > > >
> > > > [1] https://issues.apache.org/jira/browse/INFRA-28559
> > > >
> > > > I can spot more repos that do not seem to be maintained, and we
> should
> > > > move them out. Here is the list:
> > > >
> > > > No meaningful content:
> > > > https://github.com/apache/casbin-node-casbin-next-authz
> > > > https://github.com/apache/casbin-node-casbin-mongodb-watcher
> > > > https://github.com/apache/casbin-node-casbin-meteor-authz
> > > > https://github.com/apache/casbin-node-casbin-mercurius-authz
> > > > https://github.com/apache/casbin-python-litestar-authz
> > > > https://github.com/apache/casbin-pycasbin-on-cpp
> > > > https://github.com/apache/casbin-node-casbin-nextjs-casbin-example
> > > > https://github.com/apache/casbin-iris-authz
> > > > https://github.com/apache/casbin-benchmark-data
> > > >
> > > > Forks:
> > > > https://github.com/apache/casbin-node-casbin-nestjs-casbin-module
> > (bare
> > > > fork, do nothing)
> > > > https://github.com/apache/casbin-rust-semantic-release-action-rust
> (we
> > > > should no longer need it)
> > > > https://github.com/apache/casbin-lego (doesn't seems to be relevent)
> > > >
> > > > Archived:
> > > > https://github.com/apache/casbin-lua-apisix-authz (has an
> alternative)
> > > > https://github.com/apache/casbin-website-v3.github.io
> > > > https://github.com/apache/casbin-server-deprecated
> > > > https://github.com/apache/casbin-node-casbin-nest-authz-deprecated
> > > >
> > > > I'd ask other developers on this list for help in review all our
> repos
> > > and
> > > > sort them out.
> > > >
> > > > Best,
> > > > tison.
> > > >
> > >
> >
>
Re: Review all the repos
Posted by tison <wa...@gmail.com>.
Hi Zixuan,
I agree on this direction. I think you can create a repo with self-serve
tool [1]
[1] https://gitbox.apache.org/boxer/?action=newrepo
Then cut a new release and we can archive/delete old repos.
Best,
tison.
Zixuan Liu <zi...@apache.org> 于2026年10月24日周六 09:53写道：
> Hi all,
>
> As part of this review, I went through every node-casbin repository one
> by one (primary language via the GitHub API, actual package.json contents
> to confirm npm package names, and directory inspection for ambiguous
> cases). Below is the Node.js part of the cleanup, together with a
> proposal to consolidate the maintained extensions into a monorepo — so
> one ASF vote covers one release cycle instead of one vote per repo.
>
> I suggest we settle the Node side first; if the model works, the other
> language ecosystems can follow the same pattern in later threads. This
> also continues my earlier monorepo proposal [1] with the concrete repo
> list and disposal plan.
>
> [1] https://lists.apache.org/thread/y4xq09n1lk03h8jszb929h17ctdt6xsy
> [DISCUSS] Proposal: Consolidate node-casbin Extensions into a
> Monorepo with Unified ASF Release Process (2026-04-11)
>
> --------------------------------------------------------------------
> 1. Monorepo scope
> --------------------------------------------------------------------
>
> https://github.com/apache/casbin-node-casbin (npm: casbin) stays a
> separate repository: the core has a different release cadence and issue
> volume than the extensions.
>
> These 21 packages move into the monorepo. npm package names are unchanged;
> directory names inside the monorepo will be shorter:
>
> adapters/ (9)
> - https://github.com/apache/casbin-node-casbin-basic-adapter
> -> casbin-basic-adapter
> - https://github.com/apache/casbin-node-casbin-file-adapter
> -> casbin-file-adapter
> - https://github.com/apache/casbin-node-casbin-node-redis-adapter
> -> casbin-redis-adapter
> - https://github.com/apache/casbin-node-casbin-mongoose-adapter
> -> casbin-mongoose-adapter
> - https://github.com/apache/casbin-node-casbin-couchdb-adapter
> -> casbin-couchdb-adapter
> - https://github.com/apache/casbin-sequelize-adapter
> -> casbin-sequelize-adapter
> - https://github.com/apache/casbin-typeorm-adapter
> -> typeorm-adapter
> - https://github.com/apache/casbin-node-casbin-prisma-adapter
> -> casbin-prisma-adapter
> - https://github.com/apache/casbin-node-casbin-drizzle-adapter
> -> drizzle-adapter
>
> watchers/ (4, all under the @casbin npm scope)
> - https://github.com/apache/casbin-node-casbin-redis-watcher
> -> @casbin/redis-watcher
> - https://github.com/apache/casbin-node-casbin-etcd-watcher
> -> @casbin/etcd-watcher
> - https://github.com/apache/casbin-node-casbin-node-pubsub-watcher
> -> @casbin/pubsub-watcher
> -
> https://github.com/apache/casbin-node-casbin-mongo-changestream-watcher
> -> @casbin/mongo-changestream-watcher
>
> middlewares/ (5)
> - https://github.com/apache/casbin-express-authz
> -> casbin-express-authz
> - https://github.com/apache/casbin-node-casbin-koa-authz
> -> koa-authz
> - https://github.com/apache/casbin-egg-authz
> -> egg-authz
> - https://github.com/apache/casbin-nest-authz
> -> nest-authz
> - https://github.com/apache/casbin-node-casbin-hapi-authz
> -> @casbin/hapi-authz
>
> utils/ (3)
> - https://github.com/apache/casbin-node-casbin-expression-eval
> -> @casbin/expression-eval
> - https://github.com/apache/casbin-node-casbin-session-role-manager
> -> session-role-manager
> - https://github.com/apache/casbin-node-casbin-data-permission
> -> node-casbin-data-permission
>
> Plus a non-published examples/ directory:
> - https://github.com/apache/casbin-node-casbin-examples
> (angular/react/react-native examples)
> - https://github.com/apache/casbin-node-casbin-nest-authz-example
>
> Reviewers' note: similarly named repos WITHOUT the "node" prefix, e.g.
> https://github.com/apache/casbin-redis-adapter ,
> https://github.com/apache/casbin-mongodb-adapter ,
> https://github.com/apache/casbin-mysql-adapter ,
> https://github.com/apache/casbin-pg-adapter ,
> https://github.com/apache/casbin-json-adapter , are Go repositories and
> are NOT affected by this proposal.
>
> --------------------------------------------------------------------
> 2. Delete outright: empty shells and a bare fork (9 repos)
> --------------------------------------------------------------------
>
> The node entries on your list (next-authz, mongodb-watcher, meteor-authz,
> mercurius-authz, nextjs-casbin-example) are confirmed empty: nothing but
> LICENSE/README/.gitignore, no published casbin npm package, no meaningful
> git history. I found three more in exactly the same shape that are
> missing from your list — blitz-authz, elysia-casbin, qwik-authz — plus
> nestjs-casbin-module, a bare fork whose npm package
> (@switchit/nestjs-casbin) belongs to a third party. All nine:
>
> - https://github.com/apache/casbin-node-casbin-next-authz
> - https://github.com/apache/casbin-node-casbin-mongodb-watcher
> - https://github.com/apache/casbin-node-casbin-meteor-authz
> - https://github.com/apache/casbin-node-casbin-mercurius-authz
> - https://github.com/apache/casbin-node-casbin-nextjs-casbin-example
> - https://github.com/apache/casbin-node-casbin-blitz-authz
> - https://github.com/apache/casbin-node-casbin-elysia-casbin
> - https://github.com/apache/casbin-node-casbin-qwik-authz
> - https://github.com/apache/casbin-node-casbin-nestjs-casbin-module
>
> --------------------------------------------------------------------
> 3. What happens to the 23 source repos after migration: delete, not archive
> --------------------------------------------------------------------
>
> Since git history is preserved in the monorepo (git filter-repo import),
> an archived source repo no longer serves its main purpose. The trade-off:
>
> archive PRO: keeps the ~180 open issues and PRs across these repos
> readable, keeps old GitHub links resolving.
> archive CON: does not reduce the repo count under the apache org at all
> — which is the management burden this consolidation is
> meant to remove.
>
> Proposal: delete each source repo once its per-repo checklist is done:
>
> (a) the equivalent npm version has been published from the monorepo;
> (b) its open issues are triaged — stale ones closed with a pointer,
> still-relevant ones recreated in the monorepo;
>
> --------------------------------------------------------------------
> 4. Open questions
> --------------------------------------------------------------------
>
> a) https://github.com/apache/casbin-node-casbin-graphql-authz :
> despite the name, this repo contains Go code (authz.go, go.mod) — a
> graphql-go middleware, not a Node package. It should not keep a
> node-casbin name. Options: move it to the Go middleware family with a
> proper name, or move it out. Go maintainers, please weigh in.
>
> b) https://github.com/apache/casbin-node-casbin-nest-authz-deprecated :
> real code and a published npm package (casbin-nest-authz) whose
> repository link points here. Deleting it would break that link, and it
> is not part of the monorepo scope, so I propose archiving it in place
> with a README pointer to https://github.com/apache/casbin-nest-authz .
>
> c) npm publish credentials: six packages live under the @casbin npm scope
> (the four watchers, hapi-authz, expression-eval); the rest are unscoped
> names. For the unified release flow (changesets -> tag -> VOTE -> npm
> publish) we need to agree on who holds publish access and how it is
> rotated. Please chime in if you currently publish any of these
> packages.
>
> --------------------------------------------------------------------
> 5. Plan
> --------------------------------------------------------------------
>
> 1. Pilot: create the monorepo (proposed name:
> casbin-node-casbin-extensions)
> and import file-adapter + basic-adapter first (no external services
> needed) to validate the whole pipeline end to end: import with history,
> CI, changesets, release tag, VOTE, npm publish.
> 2. Migrate the rest in batches: adapters -> watchers -> middlewares ->
> utils -> examples.
> 3. File the INFRA ticket to delete the 9 repos in section 2, and delete
> each migrated source repo per the checklist in section 3.
> 4. One ASF vote per release cycle covers all packages released in that
> snapshot; npm publishing happens after the vote passes.
>
> Once the Node model is proven, I'm happy to help replicate it for the
> other ecosystems (Go/Java/Python have the same sprawl) in follow-up
> threads.
>
> Best,
> Zixuan
>
> tison <wa...@gmail.com> 于2026年10月23日周五 09:41写道：
>
> > There are also a lot of example repos that lack maintenance.
> >
> > I think we'd either put them all in one repo, or just let any person to
> > host these random examples by themselves, rather than put them under the
> > apache org.
> >
> > Best,
> > tison.
> >
> >
> > tison <wa...@gmail.com> 于2026年10月23日周五 09:37写道：
> >
> > > Hi,
> > >
> > > Recently we filed [1] to transfer back some legacy repos back to the
> > > original casbin org so that it doesn't bother the management of apache
> > org.
> > >
> > > [1] https://issues.apache.org/jira/browse/INFRA-28559
> > >
> > > I can spot more repos that do not seem to be maintained, and we should
> > > move them out. Here is the list:
> > >
> > > No meaningful content:
> > > https://github.com/apache/casbin-node-casbin-next-authz
> > > https://github.com/apache/casbin-node-casbin-mongodb-watcher
> > > https://github.com/apache/casbin-node-casbin-meteor-authz
> > > https://github.com/apache/casbin-node-casbin-mercurius-authz
> > > https://github.com/apache/casbin-python-litestar-authz
> > > https://github.com/apache/casbin-pycasbin-on-cpp
> > > https://github.com/apache/casbin-node-casbin-nextjs-casbin-example
> > > https://github.com/apache/casbin-iris-authz
> > > https://github.com/apache/casbin-benchmark-data
> > >
> > > Forks:
> > > https://github.com/apache/casbin-node-casbin-nestjs-casbin-module
> (bare
> > > fork, do nothing)
> > > https://github.com/apache/casbin-rust-semantic-release-action-rust (we
> > > should no longer need it)
> > > https://github.com/apache/casbin-lego (doesn't seems to be relevent)
> > >
> > > Archived:
> > > https://github.com/apache/casbin-lua-apisix-authz (has an alternative)
> > > https://github.com/apache/casbin-website-v3.github.io
> > > https://github.com/apache/casbin-server-deprecated
> > > https://github.com/apache/casbin-node-casbin-nest-authz-deprecated
> > >
> > > I'd ask other developers on this list for help in review all our repos
> > and
> > > sort them out.
> > >
> > > Best,
> > > tison.
> > >
> >
>
Re: Review all the repos
Posted by Zixuan Liu <zi...@apache.org>.
Hi all,
As part of this review, I went through every node-casbin repository one
by one (primary language via the GitHub API, actual package.json contents
to confirm npm package names, and directory inspection for ambiguous
cases). Below is the Node.js part of the cleanup, together with a
proposal to consolidate the maintained extensions into a monorepo — so
one ASF vote covers one release cycle instead of one vote per repo.
I suggest we settle the Node side first; if the model works, the other
language ecosystems can follow the same pattern in later threads. This
also continues my earlier monorepo proposal [1] with the concrete repo
list and disposal plan.
[1] https://lists.apache.org/thread/y4xq09n1lk03h8jszb929h17ctdt6xsy
[DISCUSS] Proposal: Consolidate node-casbin Extensions into a
Monorepo with Unified ASF Release Process (2026-04-11)
--------------------------------------------------------------------
1. Monorepo scope
--------------------------------------------------------------------
https://github.com/apache/casbin-node-casbin (npm: casbin) stays a
separate repository: the core has a different release cadence and issue
volume than the extensions.
These 21 packages move into the monorepo. npm package names are unchanged;
directory names inside the monorepo will be shorter:
adapters/ (9)
- https://github.com/apache/casbin-node-casbin-basic-adapter
-> casbin-basic-adapter
- https://github.com/apache/casbin-node-casbin-file-adapter
-> casbin-file-adapter
- https://github.com/apache/casbin-node-casbin-node-redis-adapter
-> casbin-redis-adapter
- https://github.com/apache/casbin-node-casbin-mongoose-adapter
-> casbin-mongoose-adapter
- https://github.com/apache/casbin-node-casbin-couchdb-adapter
-> casbin-couchdb-adapter
- https://github.com/apache/casbin-sequelize-adapter
-> casbin-sequelize-adapter
- https://github.com/apache/casbin-typeorm-adapter
-> typeorm-adapter
- https://github.com/apache/casbin-node-casbin-prisma-adapter
-> casbin-prisma-adapter
- https://github.com/apache/casbin-node-casbin-drizzle-adapter
-> drizzle-adapter
watchers/ (4, all under the @casbin npm scope)
- https://github.com/apache/casbin-node-casbin-redis-watcher
-> @casbin/redis-watcher
- https://github.com/apache/casbin-node-casbin-etcd-watcher
-> @casbin/etcd-watcher
- https://github.com/apache/casbin-node-casbin-node-pubsub-watcher
-> @casbin/pubsub-watcher
- https://github.com/apache/casbin-node-casbin-mongo-changestream-watcher
-> @casbin/mongo-changestream-watcher
middlewares/ (5)
- https://github.com/apache/casbin-express-authz
-> casbin-express-authz
- https://github.com/apache/casbin-node-casbin-koa-authz
-> koa-authz
- https://github.com/apache/casbin-egg-authz
-> egg-authz
- https://github.com/apache/casbin-nest-authz
-> nest-authz
- https://github.com/apache/casbin-node-casbin-hapi-authz
-> @casbin/hapi-authz
utils/ (3)
- https://github.com/apache/casbin-node-casbin-expression-eval
-> @casbin/expression-eval
- https://github.com/apache/casbin-node-casbin-session-role-manager
-> session-role-manager
- https://github.com/apache/casbin-node-casbin-data-permission
-> node-casbin-data-permission
Plus a non-published examples/ directory:
- https://github.com/apache/casbin-node-casbin-examples
(angular/react/react-native examples)
- https://github.com/apache/casbin-node-casbin-nest-authz-example
Reviewers' note: similarly named repos WITHOUT the "node" prefix, e.g.
https://github.com/apache/casbin-redis-adapter ,
https://github.com/apache/casbin-mongodb-adapter ,
https://github.com/apache/casbin-mysql-adapter ,
https://github.com/apache/casbin-pg-adapter ,
https://github.com/apache/casbin-json-adapter , are Go repositories and
are NOT affected by this proposal.
--------------------------------------------------------------------
2. Delete outright: empty shells and a bare fork (9 repos)
--------------------------------------------------------------------
The node entries on your list (next-authz, mongodb-watcher, meteor-authz,
mercurius-authz, nextjs-casbin-example) are confirmed empty: nothing but
LICENSE/README/.gitignore, no published casbin npm package, no meaningful
git history. I found three more in exactly the same shape that are
missing from your list — blitz-authz, elysia-casbin, qwik-authz — plus
nestjs-casbin-module, a bare fork whose npm package
(@switchit/nestjs-casbin) belongs to a third party. All nine:
- https://github.com/apache/casbin-node-casbin-next-authz
- https://github.com/apache/casbin-node-casbin-mongodb-watcher
- https://github.com/apache/casbin-node-casbin-meteor-authz
- https://github.com/apache/casbin-node-casbin-mercurius-authz
- https://github.com/apache/casbin-node-casbin-nextjs-casbin-example
- https://github.com/apache/casbin-node-casbin-blitz-authz
- https://github.com/apache/casbin-node-casbin-elysia-casbin
- https://github.com/apache/casbin-node-casbin-qwik-authz
- https://github.com/apache/casbin-node-casbin-nestjs-casbin-module
--------------------------------------------------------------------
3. What happens to the 23 source repos after migration: delete, not archive
--------------------------------------------------------------------
Since git history is preserved in the monorepo (git filter-repo import),
an archived source repo no longer serves its main purpose. The trade-off:
archive PRO: keeps the ~180 open issues and PRs across these repos
readable, keeps old GitHub links resolving.
archive CON: does not reduce the repo count under the apache org at all
— which is the management burden this consolidation is
meant to remove.
Proposal: delete each source repo once its per-repo checklist is done:
(a) the equivalent npm version has been published from the monorepo;
(b) its open issues are triaged — stale ones closed with a pointer,
still-relevant ones recreated in the monorepo;
--------------------------------------------------------------------
4. Open questions
--------------------------------------------------------------------
a) https://github.com/apache/casbin-node-casbin-graphql-authz :
despite the name, this repo contains Go code (authz.go, go.mod) — a
graphql-go middleware, not a Node package. It should not keep a
node-casbin name. Options: move it to the Go middleware family with a
proper name, or move it out. Go maintainers, please weigh in.
b) https://github.com/apache/casbin-node-casbin-nest-authz-deprecated :
real code and a published npm package (casbin-nest-authz) whose
repository link points here. Deleting it would break that link, and it
is not part of the monorepo scope, so I propose archiving it in place
with a README pointer to https://github.com/apache/casbin-nest-authz .
c) npm publish credentials: six packages live under the @casbin npm scope
(the four watchers, hapi-authz, expression-eval); the rest are unscoped
names. For the unified release flow (changesets -> tag -> VOTE -> npm
publish) we need to agree on who holds publish access and how it is
rotated. Please chime in if you currently publish any of these
packages.
--------------------------------------------------------------------
5. Plan
--------------------------------------------------------------------
1. Pilot: create the monorepo (proposed name: casbin-node-casbin-extensions)
and import file-adapter + basic-adapter first (no external services
needed) to validate the whole pipeline end to end: import with history,
CI, changesets, release tag, VOTE, npm publish.
2. Migrate the rest in batches: adapters -> watchers -> middlewares ->
utils -> examples.
3. File the INFRA ticket to delete the 9 repos in section 2, and delete
each migrated source repo per the checklist in section 3.
4. One ASF vote per release cycle covers all packages released in that
snapshot; npm publishing happens after the vote passes.
Once the Node model is proven, I'm happy to help replicate it for the
other ecosystems (Go/Java/Python have the same sprawl) in follow-up
threads.
Best,
Zixuan
tison <wa...@gmail.com> 于2026年10月23日周五 09:41写道：
> There are also a lot of example repos that lack maintenance.
>
> I think we'd either put them all in one repo, or just let any person to
> host these random examples by themselves, rather than put them under the
> apache org.
>
> Best,
> tison.
>
>
> tison <wa...@gmail.com> 于2026年10月23日周五 09:37写道：
>
> > Hi,
> >
> > Recently we filed [1] to transfer back some legacy repos back to the
> > original casbin org so that it doesn't bother the management of apache
> org.
> >
> > [1] https://issues.apache.org/jira/browse/INFRA-28559
> >
> > I can spot more repos that do not seem to be maintained, and we should
> > move them out. Here is the list:
> >
> > No meaningful content:
> > https://github.com/apache/casbin-node-casbin-next-authz
> > https://github.com/apache/casbin-node-casbin-mongodb-watcher
> > https://github.com/apache/casbin-node-casbin-meteor-authz
> > https://github.com/apache/casbin-node-casbin-mercurius-authz
> > https://github.com/apache/casbin-python-litestar-authz
> > https://github.com/apache/casbin-pycasbin-on-cpp
> > https://github.com/apache/casbin-node-casbin-nextjs-casbin-example
> > https://github.com/apache/casbin-iris-authz
> > https://github.com/apache/casbin-benchmark-data
> >
> > Forks:
> > https://github.com/apache/casbin-node-casbin-nestjs-casbin-module (bare
> > fork, do nothing)
> > https://github.com/apache/casbin-rust-semantic-release-action-rust (we
> > should no longer need it)
> > https://github.com/apache/casbin-lego (doesn't seems to be relevent)
> >
> > Archived:
> > https://github.com/apache/casbin-lua-apisix-authz (has an alternative)
> > https://github.com/apache/casbin-website-v3.github.io
> > https://github.com/apache/casbin-server-deprecated
> > https://github.com/apache/casbin-node-casbin-nest-authz-deprecated
> >
> > I'd ask other developers on this list for help in review all our repos
> and
> > sort them out.
> >
> > Best,
> > tison.
> >
>
Re: Review all the repos
Posted by tison <wa...@gmail.com>.
There are also a lot of example repos that lack maintenance.
I think we'd either put them all in one repo, or just let any person to
host these random examples by themselves, rather than put them under the
apache org.
Best,
tison.
tison <wa...@gmail.com> 于2026年10月23日周五 09:37写道：
> Hi,
>
> Recently we filed [1] to transfer back some legacy repos back to the
> original casbin org so that it doesn't bother the management of apache org.
>
> [1] https://issues.apache.org/jira/browse/INFRA-28559
>
> I can spot more repos that do not seem to be maintained, and we should
> move them out. Here is the list:
>
> No meaningful content:
> https://github.com/apache/casbin-node-casbin-next-authz
> https://github.com/apache/casbin-node-casbin-mongodb-watcher
> https://github.com/apache/casbin-node-casbin-meteor-authz
> https://github.com/apache/casbin-node-casbin-mercurius-authz
> https://github.com/apache/casbin-python-litestar-authz
> https://github.com/apache/casbin-pycasbin-on-cpp
> https://github.com/apache/casbin-node-casbin-nextjs-casbin-example
> https://github.com/apache/casbin-iris-authz
> https://github.com/apache/casbin-benchmark-data
>
> Forks:
> https://github.com/apache/casbin-node-casbin-nestjs-casbin-module (bare
> fork, do nothing)
> https://github.com/apache/casbin-rust-semantic-release-action-rust (we
> should no longer need it)
> https://github.com/apache/casbin-lego (doesn't seems to be relevent)
>
> Archived:
> https://github.com/apache/casbin-lua-apisix-authz (has an alternative)
> https://github.com/apache/casbin-website-v3.github.io
> https://github.com/apache/casbin-server-deprecated
> https://github.com/apache/casbin-node-casbin-nest-authz-deprecated
>
> I'd ask other developers on this list for help in review all our repos and
> sort them out.
>
> Best,
> tison.
>