1077868761

Build Type

push

github

Committed by GitHub

Commit Message

Merge pull request #305 from Zxilly/master

Run Details

683 of 954 branches covered (71.59%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

29 existing lines in 1 file now uncovered.

1297 of 1615 relevant lines covered (80.31%)

389.06 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

78.14

/src/coreEnforcer.ts

// Copyright 2018 The Casbin Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

import { compile, compileAsync, addBinaryOp } from 'expression-eval';

import { DefaultEffector, Effect, Effector } from './effect';
import { FunctionMap, Model, newModel, PolicyOp } from './model';
import { Adapter, FilteredAdapter, Watcher, BatchAdapter, UpdatableAdapter } from './persist';
import { DefaultRoleManager, RoleManager } from './rbac';
import { escapeAssertion, generateGFunction, getEvalValue, hasEval, replaceEval, generatorRunSync, generatorRunAsync } from './util';
import { getLogger, logPrint } from './log';
import { MatchingFunc } from './rbac';

type Matcher = ((context: any) => Promise<any>) | ((context: any) => any);

type EnforceResult = Generator<(boolean | [boolean, string[]]) | Promise<boolean | [boolean, string[]]>>;

/**
 * CoreEnforcer defines the core functionality of an enforcer.
 */
export class CoreEnforcer {
  protected modelPath: string;
  protected model: Model;
  protected fm: FunctionMap = FunctionMap.loadFunctionMap();
  protected eft: Effector = new DefaultEffector();
  private matcherMap: Map<string, Matcher> = new Map();

  protected adapter: UpdatableAdapter | FilteredAdapter | Adapter | BatchAdapter;
  protected watcher: Watcher | null = null;
  protected rmMap: Map<string, RoleManager> = new Map<string, RoleManager>([['g', new DefaultRoleManager(10)]]);

  protected enabled = true;
  protected autoSave = true;
  protected autoBuildRoleLinks = true;
  protected autoNotifyWatcher = true;

  private getExpression(asyncCompile: boolean, exp: string): Matcher {
    const matcherKey = `${asyncCompile ? 'ASYNC[' : 'SYNC['}${exp}]`;

    addBinaryOp('in', 1, (a, b) => {
      return (((b as unknown) as Array<any>).includes(a) as unknown) as number;
    });

    let expression = this.matcherMap.get(matcherKey);
    if (!expression) {
      expression = asyncCompile ? compileAsync(exp) : compile(exp);
      this.matcherMap.set(matcherKey, expression);
    }
    return expression;
  }

  /**
   * loadModel reloads the model from the model CONF file.
   * Because the policy is attached to a model,
   * so the policy is invalidated and needs to be reloaded by calling LoadPolicy().
   */
  public loadModel(): void {
    this.model = newModel();
    this.model.loadModel(this.modelPath);
    this.model.printModel();
  }

  /**
   * getModel gets the current model.
   *
   * @return the model of the enforcer.
   */
  public getModel(): Model {
    return this.model;
  }

  /**
   * setModel sets the current model.
   *
   * @param m the model.
   */
  public setModel(m: Model): void {
    this.model = m;
  }

  /**
   * getAdapter gets the current adapter.
   *
   * @return the adapter of the enforcer.
   */
  public getAdapter(): Adapter {
    return this.adapter;
  }

  /**
   * setAdapter sets the current adapter.
   *
   * @param adapter the adapter.
   */
  public setAdapter(adapter: Adapter): void {
    this.adapter = adapter;
  }

  /**
   * setWatcher sets the current watcher.
   *
   * @param watcher the watcher.
   */
  public setWatcher(watcher: Watcher): void {
    this.watcher = watcher;
    watcher.setUpdateCallback(async () => await this.loadPolicy());
  }

  /**
   * setRoleManager sets the current role manager.
   *
   * @param rm the role manager.
   */
  public setRoleManager(rm: RoleManager): void {
    this.rmMap.set('g', rm);
  }

  /**
   * getRoleManager gets the current role manager.
   */
  public getRoleManager(): RoleManager {
    return <RoleManager>this.rmMap.get('g');
  }

  /**
   * getNamedRoleManager gets role manager by name.
   */
  public getNamedRoleManager(name: string): RoleManager | undefined {
    return this.rmMap.get(name);
  }

  /**
   * setEffector sets the current effector.
   *
   * @param eft the effector.
   */
  public setEffector(eft: Effector): void {
    this.eft = eft;
  }

  /**
   * clearPolicy clears all policy.
   */
  public clearPolicy(): void {
    this.model.clearPolicy();
  }

  public initRmMap(): void {
    this.rmMap = new Map<string, RoleManager>();
    const rm = this.model.model.get('g');
    if (rm) {
      for (const ptype of rm.keys()) {
        this.rmMap.set(ptype, new DefaultRoleManager(10));
      }
    }
  }

  public sortPolicies(): void {
    const policy = this.model.model.get('p')?.get('p')?.policy;
    const tokens = this.model.model.get('p')?.get('p')?.tokens;

    if (policy && tokens) {
      const priorityIndex = tokens.indexOf('p_priority');
      if (priorityIndex !== -1) {
        policy.sort((a, b) => {
          return parseInt(a[priorityIndex], 10) - parseInt(b[priorityIndex], 10);
        });
      }
    }
  }

  /**
   * loadPolicy reloads the policy from file/database.
   */
  public async loadPolicy(): Promise<void> {
    this.model.clearPolicy();
    await this.adapter.loadPolicy(this.model);

    this.sortPolicies();

    this.initRmMap();

    if (this.autoBuildRoleLinks) {
      await this.buildRoleLinksInternal();
    }
  }

  /**
   * loadFilteredPolicy reloads a filtered policy from file/database.
   *
   * @param filter the filter used to specify which type of policy should be loaded.
   */
  // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
  public async loadFilteredPolicy(filter: any): Promise<boolean> {
    this.model.clearPolicy();

    return this.loadIncrementalFilteredPolicy(filter);
  }

  /**
   * LoadIncrementalFilteredPolicy append a filtered policy from file/database.
   *
   * @param filter the filter used to specify which type of policy should be appended.
   */
  // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
  public async loadIncrementalFilteredPolicy(filter: any): Promise<boolean> {
    if ('isFiltered' in this.adapter) {
      await this.adapter.loadFilteredPolicy(this.model, filter);
    } else {
      throw new Error('filtered policies are not supported by this adapter');
    }

    this.sortPolicies();

    this.initRmMap();

    if (this.autoBuildRoleLinks) {
      await this.buildRoleLinksInternal();
    }
    return true;
  }

  /**
   * isFiltered returns true if the loaded policy has been filtered.
   *
   * @return if the loaded policy has been filtered.
   */
  public isFiltered(): boolean {
    if ('isFiltered' in this.adapter) {
      return this.adapter.isFiltered();
    }
    return false;
  }

  /**
   * savePolicy saves the current policy (usually after changed with
   * Casbin API) back to file/database.
   */
  public async savePolicy(): Promise<boolean> {
    if (this.isFiltered()) {
      throw new Error('Cannot save a filtered policy');
    }
    const flag = await this.adapter.savePolicy(this.model);
    if (!flag) {
      return false;
    }
    if (this.watcher) {
      return await this.watcher.update();
    }
    return true;
  }

  /**
   * enableEnforce changes the enforcing state of Casbin, when Casbin is
   * disabled, all access will be allowed by the enforce() function.
   *
   * @param enable whether to enable the enforcer.
   */
  public enableEnforce(enable: boolean): void {
    this.enabled = enable;
  }

  /**
   * enableLog changes whether to print Casbin log to the standard output.
   *
   * @param enable whether to enable Casbin's log.
   */
  public enableLog(enable: boolean): void {
    getLogger().enableLog(enable);
  }

  /**
   * enableAutoSave controls whether to save a policy rule automatically to
   * the adapter when it is added or removed.
   *
   * @param autoSave whether to enable the AutoSave feature.
   */
  public enableAutoSave(autoSave: boolean): void {
    this.autoSave = autoSave;
  }

  /**
   * enableAutoNotifyWatcher controls whether to save a policy rule automatically notify the Watcher when it is added or removed.
   * @param enable whether to enable the AutoNotifyWatcher feature.
   */
  public enableAutoNotifyWatcher(enable: boolean): void {
    this.autoNotifyWatcher = enable;
  }

  /**
   * enableAutoBuildRoleLinks controls whether to save a policy rule
   * automatically to the adapter when it is added or removed.
   *
   * @param autoBuildRoleLinks whether to automatically build the role links.
   */
  public enableAutoBuildRoleLinks(autoBuildRoleLinks: boolean): void {
    this.autoBuildRoleLinks = autoBuildRoleLinks;
  }

  /**
   * add matching function to RoleManager by ptype
   * @param ptype g
   * @param fn the function will be added
   */
  public async addNamedMatchingFunc(ptype: string, fn: MatchingFunc): Promise<void> {
    const rm = this.rmMap.get(ptype);
    if (rm) {
      return await (<DefaultRoleManager>rm).addMatchingFunc(fn);
    }

    throw Error('Target ptype not found.');
  }

  /**
   * add domain matching function to RoleManager by ptype
   * @param ptype g
   * @param fn the function will be added
   */
  public async addNamedDomainMatchingFunc(ptype: string, fn: MatchingFunc): Promise<void> {
    const rm = this.rmMap.get(ptype);
    if (rm) {
      return await (<DefaultRoleManager>rm).addDomainMatchingFunc(fn);
    }
  }

  /**
   * buildRoleLinks manually rebuild the role inheritance relations.
   */
  public async buildRoleLinks(): Promise<void> {
    return this.buildRoleLinksInternal();
  }

  /**
   * buildIncrementalRoleLinks provides incremental build the role inheritance relations.
   * @param op policy operation
   * @param ptype g
   * @param rules policies
   */
  public async buildIncrementalRoleLinks(op: PolicyOp, ptype: string, rules: string[][]): Promise<void> {
    let rm = this.rmMap.get(ptype);
    if (!rm) {
      rm = new DefaultRoleManager(10);
      this.rmMap.set(ptype, rm);
    }
    await this.model.buildIncrementalRoleLinks(rm, op, 'g', ptype, rules);
  }

  protected async buildRoleLinksInternal(): Promise<void> {
    for (const rm of this.rmMap.values()) {
      await rm.clear();
      await this.model.buildRoleLinks(this.rmMap);
    }
  }

  private *privateEnforce(asyncCompile = true, explain = false, ...rvals: any[]): EnforceResult {
    if (!this.enabled) {
      return true;
    }

    let explainIndex = -1;

    const functions: { [key: string]: any } = {};
    this.fm.getFunctions().forEach((value: any, key: string) => {
      functions[key] = value;
    });

    const astMap = this.model.model.get('g');

    astMap?.forEach((value, key) => {
      const rm = value.rm;
      functions[key] = generateGFunction(rm);
    });

    const expString = this.model.model.get('m')?.get('m')?.value;
    if (!expString) {
      throw new Error('Unable to find matchers in model');
    }

    const effectExpr = this.model.model.get('e')?.get('e')?.value;
    if (!effectExpr) {
      throw new Error('Unable to find policy_effect in model');
    }

    const HasEval: boolean = hasEval(expString);
    let expression: Matcher | undefined = undefined;

    const p = this.model.model.get('p')?.get('p');
    const policyLen = p?.policy?.length;

    const rTokens = this.model.model.get('r')?.get('r')?.tokens;
    const rTokensLen = rTokens?.length;

    const effectStream = this.eft.newStream(effectExpr);

    if (policyLen && policyLen !== 0) {
      for (let i = 0; i < policyLen; i++) {
        const parameters: { [key: string]: any } = {};

        if (rTokens?.length !== rvals.length) {
          throw new Error(`invalid request size: expected ${rTokensLen}, got ${rvals.length}, rvals: ${rvals}"`);
        }

        rTokens.forEach((token, j) => {
          parameters[token] = rvals[j];
        });

        p?.tokens.forEach((token, j) => {
          parameters[token] = p?.policy[i][j];
        });

        if (HasEval) {
          const ruleNames: string[] = getEvalValue(expString);
          let expWithRule = expString;
          for (const ruleName of ruleNames) {
            if (ruleName in parameters) {
              const rule = escapeAssertion(parameters[ruleName]);
              expWithRule = replaceEval(expWithRule, rule);
            } else {
              throw new Error(`${ruleName} not in ${parameters}`);
            }
          }
          expression = this.getExpression(asyncCompile, expWithRule);
        } else {
          if (expression === undefined) {
            expression = this.getExpression(asyncCompile, expString);
          }
        }

        const context = { ...parameters, ...functions };
        const result = asyncCompile ? yield expression(context) : expression(context);

        let eftRes: Effect;
        switch (typeof result) {
          case 'boolean':
            eftRes = result ? Effect.Allow : Effect.Indeterminate;
            break;
          case 'number':
            if (result === 0) {
              eftRes = Effect.Indeterminate;
            } else {
              eftRes = result;
            }
            break;
          default:
            throw new Error('matcher result should be boolean or number');
        }

        const eft = parameters['p_eft'];
        if (eft && eftRes === Effect.Allow) {
          if (eft === 'allow') {
            eftRes = Effect.Allow;
          } else if (eft === 'deny') {
            eftRes = Effect.Deny;
          } else {
            eftRes = Effect.Indeterminate;
          }
        }

        const [res, done] = effectStream.pushEffect(eftRes);

        if (done) {
          explainIndex = i;
          break;
        }
      }
    } else {
      explainIndex = 0;

      const parameters: { [key: string]: any } = {};

      rTokens?.forEach((token, j): void => {
        parameters[token] = rvals[j];
      });

      p?.tokens?.forEach((token) => {
        parameters[token] = '';
      });

      expression = this.getExpression(asyncCompile, expString);
      const context = { ...parameters, ...functions };
      const result = asyncCompile ? yield expression(context) : expression(context);

      if (result) {
        effectStream.pushEffect(Effect.Allow);
      } else {
        effectStream.pushEffect(Effect.Indeterminate);
      }
    }

    const res = effectStream.current();

    // only generate the request --> result string if the message
    // is going to be logged.
    if (getLogger().isEnable()) {
      let reqStr = 'Request: ';
      for (let i = 0; i < rvals.length; i++) {
        if (i !== rvals.length - 1) {
          reqStr += `${rvals[i]}, `;
        } else {
          reqStr += rvals[i];
        }
      }
      reqStr += ` ---> ${res}`;
      logPrint(reqStr);
    }

    if (explain) {
      if (explainIndex === -1) {
        return [res, []];
      }
      return [res, p?.policy[explainIndex]];
    }

    return res;
  }

  /**
   * If the matchers does not contain an asynchronous method, call it faster.
   *
   * enforceSync decides whether a "subject" can access a "object" with
   * the operation "action", input parameters are usually: (sub, obj, act).
   *
   * @param rvals the request needs to be mediated, usually an array
   *              of strings, can be class instances if ABAC is used.
   * @return whether to allow the request.
   */
  public enforceSync(...rvals: any[]): boolean {
    return generatorRunSync(this.privateEnforce(false, false, ...rvals));
  }

  /**
   * If the matchers does not contain an asynchronous method, call it faster.
   *
   * enforceSync decides whether a "subject" can access a "object" with
   * the operation "action", input parameters are usually: (sub, obj, act).
   *
   * @param rvals the request needs to be mediated, usually an array
   *              of strings, can be class instances if ABAC is used.
   * @return whether to allow the request and the reason rule.
   */
  public enforceExSync(...rvals: any[]): [boolean, string[]] {
    return generatorRunSync(this.privateEnforce(false, true, ...rvals));
  }

  /**
   * Same as enforceSync. To be removed.
   */
  public enforceWithSyncCompile(...rvals: any[]): boolean {
    return this.enforceSync(...rvals);
  }

  /**
   * enforce decides whether a "subject" can access a "object" with
   * the operation "action", input parameters are usually: (sub, obj, act).
   *
   * @param rvals the request needs to be mediated, usually an array
   *              of strings, can be class instances if ABAC is used.
   * @return whether to allow the request.
   */
  public async enforce(...rvals: any[]): Promise<boolean> {
    return generatorRunAsync(this.privateEnforce(true, false, ...rvals));
  }

  /**
   * enforce decides whether a "subject" can access a "object" with
   * the operation "action", input parameters are usually: (sub, obj, act).
   *
   * @param rvals the request needs to be mediated, usually an array
   *              of strings, can be class instances if ABAC is used.
   * @return whether to allow the request and the reason rule.
   */
  public async enforceEx(...rvals: any[]): Promise<[boolean, string[]]> {
    return generatorRunAsync(this.privateEnforce(true, true, ...rvals));
  }
}

1	// Copyright 2018 The Casbin Authors. All Rights Reserved.
2	//
3	// Licensed under the Apache License, Version 2.0 (the "License");
4	// you may not use this file except in compliance with the License.
5	// You may obtain a copy of the License at
6	//
7	// http://www.apache.org/licenses/LICENSE-2.0
8	//
9	// Unless required by applicable law or agreed to in writing, software
10	// distributed under the License is distributed on an "AS IS" BASIS,
11	// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	// See the License for the specific language governing permissions and
13	// limitations under the License.
14
15	import { compile, compileAsync, addBinaryOp } from 'expression-eval';	30✔
16
17	import { DefaultEffector, Effect, Effector } from './effect';	30✔
18	import { FunctionMap, Model, newModel, PolicyOp } from './model';	30✔
19	import { Adapter, FilteredAdapter, Watcher, BatchAdapter, UpdatableAdapter } from './persist';
20	import { DefaultRoleManager, RoleManager } from './rbac';	30✔
21	import { escapeAssertion, generateGFunction, getEvalValue, hasEval, replaceEval, generatorRunSync, generatorRunAsync } from './util';	30✔
22	import { getLogger, logPrint } from './log';	30✔
23	import { MatchingFunc } from './rbac';
24
25	type Matcher = ((context: any) => Promise<any>) \| ((context: any) => any);
26
27	type EnforceResult = Generator<(boolean \| [boolean, string[]]) \| Promise<boolean \| [boolean, string[]]>>;
28
29	/**
30	* CoreEnforcer defines the core functionality of an enforcer.
31	*/
32	export class CoreEnforcer {	30✔
33	protected modelPath: string;
34	protected model: Model;
35	protected fm: FunctionMap = FunctionMap.loadFunctionMap();	348✔
36	protected eft: Effector = new DefaultEffector();	348✔
37	private matcherMap: Map<string, Matcher> = new Map();	348✔
38
39	protected adapter: UpdatableAdapter \| FilteredAdapter \| Adapter \| BatchAdapter;
40	protected watcher: Watcher \| null = null;	348✔
41	protected rmMap: Map<string, RoleManager> = new Map<string, RoleManager>([['g', new DefaultRoleManager(10)]]);	348✔
42
43	protected enabled = true;	348✔
44	protected autoSave = true;	348✔
45	protected autoBuildRoleLinks = true;	348✔
46	protected autoNotifyWatcher = true;	348✔
47
48	private getExpression(asyncCompile: boolean, exp: string): Matcher {
49	const matcherKey = `${asyncCompile ? 'ASYNC[' : 'SYNC['}${exp}]`;	1,215✔
50
51	addBinaryOp('in', 1, (a, b) => {	1,215✔
52	return (((b as unknown) as Array<any>).includes(a) as unknown) as number;	3✔
53	});
54
55	let expression = this.matcherMap.get(matcherKey);	1,215✔
56	if (!expression) {	1,215✔
57	expression = asyncCompile ? compileAsync(exp) : compile(exp);	156✔
58	this.matcherMap.set(matcherKey, expression);	156✔
59	}
60	return expression;	1,215✔
61	}
62
63	/**
64	* loadModel reloads the model from the model CONF file.
65	* Because the policy is attached to a model,
66	* so the policy is invalidated and needs to be reloaded by calling LoadPolicy().
67	*/
68	public loadModel(): void {
69	this.model = newModel();	×
UNCOV 70	this.model.loadModel(this.modelPath);	×
UNCOV 71	this.model.printModel();	×
72	}
73
74	/**
75	* getModel gets the current model.
76	*
77	* @return the model of the enforcer.
78	*/
79	public getModel(): Model {
80	return this.model;	18✔
81	}
82
83	/**
84	* setModel sets the current model.
85	*
86	* @param m the model.
87	*/
88	public setModel(m: Model): void {
89	this.model = m;	9✔
90	}
91
92	/**
93	* getAdapter gets the current adapter.
94	*
95	* @return the adapter of the enforcer.
96	*/
97	public getAdapter(): Adapter {
98	return this.adapter;	3✔
99	}
100
101	/**
102	* setAdapter sets the current adapter.
103	*
104	* @param adapter the adapter.
105	*/
106	public setAdapter(adapter: Adapter): void {
107	this.adapter = adapter;	45✔
108	}
109
110	/**
111	* setWatcher sets the current watcher.
112	*
113	* @param watcher the watcher.
114	*/
115	public setWatcher(watcher: Watcher): void {
UNCOV 116	this.watcher = watcher;	×
UNCOV 117	watcher.setUpdateCallback(async () => await this.loadPolicy());	×
118	}
119
120	/**
121	* setRoleManager sets the current role manager.
122	*
123	* @param rm the role manager.
124	*/
125	public setRoleManager(rm: RoleManager): void {
UNCOV 126	this.rmMap.set('g', rm);	×
127	}
128
129	/**
130	* getRoleManager gets the current role manager.
131	*/
132	public getRoleManager(): RoleManager {
133	return <RoleManager>this.rmMap.get('g');	9✔
134	}
135
136	/**
137	* getNamedRoleManager gets role manager by name.
138	*/
139	public getNamedRoleManager(name: string): RoleManager \| undefined {
UNCOV 140	return this.rmMap.get(name);	×
141	}
142
143	/**
144	* setEffector sets the current effector.
145	*
146	* @param eft the effector.
147	*/
148	public setEffector(eft: Effector): void {
UNCOV 149	this.eft = eft;	×
150	}
151
152	/**
153	* clearPolicy clears all policy.
154	*/
155	public clearPolicy(): void {
156	this.model.clearPolicy();	6✔
157	}
158
159	public initRmMap(): void {
160	this.rmMap = new Map<string, RoleManager>();	345✔
161	const rm = this.model.model.get('g');	345✔
162	if (rm) {	345✔
163	for (const ptype of rm.keys()) {	219✔
164	this.rmMap.set(ptype, new DefaultRoleManager(10));	228✔
165	}
166	}
167	}
168
169	public sortPolicies(): void {
170	const policy = this.model.model.get('p')?.get('p')?.policy;	345✔
171	const tokens = this.model.model.get('p')?.get('p')?.tokens;	345✔
172
173	if (policy && tokens) {	345✔
174	const priorityIndex = tokens.indexOf('p_priority');	339✔
175	if (priorityIndex !== -1) {	339✔
176	policy.sort((a, b) => {	9✔
177	return parseInt(a[priorityIndex], 10) - parseInt(b[priorityIndex], 10);	140✔
178	});
179	}
180	}
181	}
182
183	/**
184	* loadPolicy reloads the policy from file/database.
185	*/
186	public async loadPolicy(): Promise<void> {
187	this.model.clearPolicy();	345✔
188	await this.adapter.loadPolicy(this.model);	345✔
189
190	this.sortPolicies();	345✔
191
192	this.initRmMap();	345✔
193
194	if (this.autoBuildRoleLinks) {	345!
195	await this.buildRoleLinksInternal();	345✔
196	}
197	}
198
199	/**
200	* loadFilteredPolicy reloads a filtered policy from file/database.
201	*
202	* @param filter the filter used to specify which type of policy should be loaded.
203	*/
204	// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
205	public async loadFilteredPolicy(filter: any): Promise<boolean> {
206	this.model.clearPolicy();	×
207
UNCOV 208	return this.loadIncrementalFilteredPolicy(filter);	×
209	}
210
211	/**
212	* LoadIncrementalFilteredPolicy append a filtered policy from file/database.
213	*
214	* @param filter the filter used to specify which type of policy should be appended.
215	*/
216	// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
217	public async loadIncrementalFilteredPolicy(filter: any): Promise<boolean> {
UNCOV 218	if ('isFiltered' in this.adapter) {	×
219	await this.adapter.loadFilteredPolicy(this.model, filter);	×
220	} else {
UNCOV 221	throw new Error('filtered policies are not supported by this adapter');	×
222	}
223
224	this.sortPolicies();	×
225
226	this.initRmMap();	×
227
UNCOV 228	if (this.autoBuildRoleLinks) {	×
229	await this.buildRoleLinksInternal();	×
230	}
UNCOV 231	return true;	×
232	}
233
234	/**
235	* isFiltered returns true if the loaded policy has been filtered.
236	*
237	* @return if the loaded policy has been filtered.
238	*/
239	public isFiltered(): boolean {
240	if ('isFiltered' in this.adapter) {	3!
UNCOV 241	return this.adapter.isFiltered();	×
242	}
243	return false;	3✔
244	}
245
246	/**
247	* savePolicy saves the current policy (usually after changed with
248	* Casbin API) back to file/database.
249	*/
250	public async savePolicy(): Promise<boolean> {
251	if (this.isFiltered()) {	3!
UNCOV 252	throw new Error('Cannot save a filtered policy');	×
253	}
254	const flag = await this.adapter.savePolicy(this.model);	3✔
255	if (!flag) {	3!
UNCOV 256	return false;	×
257	}
258	if (this.watcher) {	3!
UNCOV 259	return await this.watcher.update();	×
260	}
261	return true;	3✔
262	}
263
264	/**
265	* enableEnforce changes the enforcing state of Casbin, when Casbin is
266	* disabled, all access will be allowed by the enforce() function.
267	*
268	* @param enable whether to enable the enforcer.
269	*/
270	public enableEnforce(enable: boolean): void {
271	this.enabled = enable;	6✔
272	}
273
274	/**
275	* enableLog changes whether to print Casbin log to the standard output.
276	*
277	* @param enable whether to enable Casbin's log.
278	*/
279	public enableLog(enable: boolean): void {
280	getLogger().enableLog(enable);	3✔
281	}
282
283	/**
284	* enableAutoSave controls whether to save a policy rule automatically to
285	* the adapter when it is added or removed.
286	*
287	* @param autoSave whether to enable the AutoSave feature.
288	*/
289	public enableAutoSave(autoSave: boolean): void {
290	this.autoSave = autoSave;	6✔
291	}
292
293	/**
294	* enableAutoNotifyWatcher controls whether to save a policy rule automatically notify the Watcher when it is added or removed.
295	* @param enable whether to enable the AutoNotifyWatcher feature.
296	*/
297	public enableAutoNotifyWatcher(enable: boolean): void {
UNCOV 298	this.autoNotifyWatcher = enable;	×
299	}
300
301	/**
302	* enableAutoBuildRoleLinks controls whether to save a policy rule
303	* automatically to the adapter when it is added or removed.
304	*
305	* @param autoBuildRoleLinks whether to automatically build the role links.
306	*/
307	public enableAutoBuildRoleLinks(autoBuildRoleLinks: boolean): void {
308	this.autoBuildRoleLinks = autoBuildRoleLinks;	3✔
309	}
310
311	/**
312	* add matching function to RoleManager by ptype
313	* @param ptype g
314	* @param fn the function will be added
315	*/
316	public async addNamedMatchingFunc(ptype: string, fn: MatchingFunc): Promise<void> {
317	const rm = this.rmMap.get(ptype);	6✔
318	if (rm) {	6!
319	return await (<DefaultRoleManager>rm).addMatchingFunc(fn);	6✔
320	}
321
UNCOV 322	throw Error('Target ptype not found.');	×
323	}
324
325	/**
326	* add domain matching function to RoleManager by ptype
327	* @param ptype g
328	* @param fn the function will be added
329	*/
330	public async addNamedDomainMatchingFunc(ptype: string, fn: MatchingFunc): Promise<void> {
331	const rm = this.rmMap.get(ptype);	×
UNCOV 332	if (rm) {	×
UNCOV 333	return await (<DefaultRoleManager>rm).addDomainMatchingFunc(fn);	×
334	}
335	}
336
337	/**
338	* buildRoleLinks manually rebuild the role inheritance relations.
339	*/
340	public async buildRoleLinks(): Promise<void> {
341	return this.buildRoleLinksInternal();	6✔
342	}
343
344	/**
345	* buildIncrementalRoleLinks provides incremental build the role inheritance relations.
346	* @param op policy operation
347	* @param ptype g
348	* @param rules policies
349	*/
350	public async buildIncrementalRoleLinks(op: PolicyOp, ptype: string, rules: string[][]): Promise<void> {
351	let rm = this.rmMap.get(ptype);	69✔
352	if (!rm) {	69!
UNCOV 353	rm = new DefaultRoleManager(10);	×
UNCOV 354	this.rmMap.set(ptype, rm);	×
355	}
356	await this.model.buildIncrementalRoleLinks(rm, op, 'g', ptype, rules);	69✔
357	}
358
359	protected async buildRoleLinksInternal(): Promise<void> {
360	for (const rm of this.rmMap.values()) {	351✔
361	await rm.clear();	234✔
362	await this.model.buildRoleLinks(this.rmMap);	234✔
363	}
364	}
365
366	private *privateEnforce(asyncCompile = true, explain = false, ...rvals: any[]): EnforceResult {	×
367	if (!this.enabled) {	1,209✔
368	return true;	24✔
369	}
370
371	let explainIndex = -1;	1,185✔
372
373	const functions: { [key: string]: any } = {};	1,185✔
374	this.fm.getFunctions().forEach((value: any, key: string) => {	1,185✔
375	functions[key] = value;	10,671✔
376	});
377
378	const astMap = this.model.model.get('g');	1,185✔
379
380	astMap?.forEach((value, key) => {	1,185✔
381	const rm = value.rm;	582✔
382	functions[key] = generateGFunction(rm);	582✔
383	});
384
385	const expString = this.model.model.get('m')?.get('m')?.value;	1,185!
386	if (!expString) {	1,185!
UNCOV 387	throw new Error('Unable to find matchers in model');	×
388	}
389
390	const effectExpr = this.model.model.get('e')?.get('e')?.value;	1,185!
391	if (!effectExpr) {	1,185!
UNCOV 392	throw new Error('Unable to find policy_effect in model');	×
393	}
394
395	const HasEval: boolean = hasEval(expString);	1,185✔
396	let expression: Matcher \| undefined = undefined;	1,185✔
397
398	const p = this.model.model.get('p')?.get('p');	1,185!
399	const policyLen = p?.policy?.length;	1,185!
400
401	const rTokens = this.model.model.get('r')?.get('r')?.tokens;	1,185!
402	const rTokensLen = rTokens?.length;	1,185!
403
404	const effectStream = this.eft.newStream(effectExpr);	1,185✔
405
406	if (policyLen && policyLen !== 0) {	1,185✔
407	for (let i = 0; i < policyLen; i++) {	1,065✔
408	const parameters: { [key: string]: any } = {};	3,255✔
409
410	if (rTokens?.length !== rvals.length) {	3,255!
UNCOV 411	throw new Error(`invalid request size: expected ${rTokensLen}, got ${rvals.length}, rvals: ${rvals}"`);	×
412	}
413
414	rTokens.forEach((token, j) => {	3,255✔
415	parameters[token] = rvals[j];	9,921✔
416	});
417
418	p?.tokens.forEach((token, j) => {	3,255!
419	parameters[token] = p?.policy[i][j];	10,698!
420	});
421
422	if (HasEval) {	3,255✔
423	const ruleNames: string[] = getEvalValue(expString);	66✔
424	let expWithRule = expString;	66✔
425	for (const ruleName of ruleNames) {	66✔
426	if (ruleName in parameters) {	66!
427	const rule = escapeAssertion(parameters[ruleName]);	66✔
428	expWithRule = replaceEval(expWithRule, rule);	66✔
429	} else {
UNCOV 430	throw new Error(`${ruleName} not in ${parameters}`);	×
431	}
432	}
433	expression = this.getExpression(asyncCompile, expWithRule);	66✔
434	} else {
435	if (expression === undefined) {	3,189✔
436	expression = this.getExpression(asyncCompile, expString);	1,029✔
437	}
438	}
439
440	const context = { ...parameters, ...functions };	3,255✔
441	const result = asyncCompile ? yield expression(context) : expression(context);	3,255✔
442
443	let eftRes: Effect;
444	switch (typeof result) {	3,255✔
445	case 'boolean':	3,255!
446	eftRes = result ? Effect.Allow : Effect.Indeterminate;	3,255✔
447	break;	3,255✔
448	case 'number':
UNCOV 449	if (result === 0) {	×
450	eftRes = Effect.Indeterminate;	×
451	} else {
452	eftRes = result;	×
453	}
454	break;	×
455	default:
UNCOV 456	throw new Error('matcher result should be boolean or number');	×
457	}
458
459	const eft = parameters['p_eft'];	3,255✔
460	if (eft && eftRes === Effect.Allow) {	3,255✔
461	if (eft === 'allow') {	87✔
462	eftRes = Effect.Allow;	45✔
463	} else if (eft === 'deny') {	42✔
464	eftRes = Effect.Deny;	39✔
465	} else {
466	eftRes = Effect.Indeterminate;	3✔
467	}
468	}
469
470	const [res, done] = effectStream.pushEffect(eftRes);	3,255✔
471
472	if (done) {	3,255✔
473	explainIndex = i;	498✔
474	break;	498✔
475	}
476	}
477	} else {
478	explainIndex = 0;	120✔
479
480	const parameters: { [key: string]: any } = {};	120✔
481
482	rTokens?.forEach((token, j): void => {	120!
483	parameters[token] = rvals[j];	357✔
484	});
485
486	p?.tokens?.forEach((token) => {	120!
487	parameters[token] = '';	360✔
488	});
489
490	expression = this.getExpression(asyncCompile, expString);	120✔
491	const context = { ...parameters, ...functions };	120✔
492	const result = asyncCompile ? yield expression(context) : expression(context);	120!
493
494	if (result) {	120✔
495	effectStream.pushEffect(Effect.Allow);	27✔
496	} else {
497	effectStream.pushEffect(Effect.Indeterminate);	93✔
498	}
499	}
500
501	const res = effectStream.current();	1,185✔
502
503	// only generate the request --> result string if the message
504	// is going to be logged.
505	if (getLogger().isEnable()) {	1,185✔
506	let reqStr = 'Request: ';	24✔
507	for (let i = 0; i < rvals.length; i++) {	24✔
508	if (i !== rvals.length - 1) {	72✔
509	reqStr += `${rvals[i]}, `;	48✔
510	} else {
511	reqStr += rvals[i];	24✔
512	}
513	}
514	reqStr += ` ---> ${res}`;	24✔
515	logPrint(reqStr);	24✔
516	}
517
518	if (explain) {	1,185✔
519	if (explainIndex === -1) {	12✔
520	return [res, []];	6✔
521	}
522	return [res, p?.policy[explainIndex]];	6!
523	}
524
525	return res;	1,173✔
526	}
527
528	/**
529	* If the matchers does not contain an asynchronous method, call it faster.
530	*
531	* enforceSync decides whether a "subject" can access a "object" with
532	* the operation "action", input parameters are usually: (sub, obj, act).
533	*
534	* @param rvals the request needs to be mediated, usually an array
535	* of strings, can be class instances if ABAC is used.
536	* @return whether to allow the request.
537	*/
538	public enforceSync(...rvals: any[]): boolean {
539	return generatorRunSync(this.privateEnforce(false, false, ...rvals));	3✔
540	}
541
542	/**
543	* If the matchers does not contain an asynchronous method, call it faster.
544	*
545	* enforceSync decides whether a "subject" can access a "object" with
546	* the operation "action", input parameters are usually: (sub, obj, act).
547	*
548	* @param rvals the request needs to be mediated, usually an array
549	* of strings, can be class instances if ABAC is used.
550	* @return whether to allow the request and the reason rule.
551	*/
552	public enforceExSync(...rvals: any[]): [boolean, string[]] {
553	return generatorRunSync(this.privateEnforce(false, true, ...rvals));	6✔
554	}
555
556	/**
557	* Same as enforceSync. To be removed.
558	*/
559	public enforceWithSyncCompile(...rvals: any[]): boolean {
UNCOV 560	return this.enforceSync(...rvals);	×
561	}
562
563	/**
564	* enforce decides whether a "subject" can access a "object" with
565	* the operation "action", input parameters are usually: (sub, obj, act).
566	*
567	* @param rvals the request needs to be mediated, usually an array
568	* of strings, can be class instances if ABAC is used.
569	* @return whether to allow the request.
570	*/
571	public async enforce(...rvals: any[]): Promise<boolean> {
572	return generatorRunAsync(this.privateEnforce(true, false, ...rvals));	1,194✔
573	}
574
575	/**
576	* enforce decides whether a "subject" can access a "object" with
577	* the operation "action", input parameters are usually: (sub, obj, act).
578	*
579	* @param rvals the request needs to be mediated, usually an array
580	* of strings, can be class instances if ABAC is used.
581	* @return whether to allow the request and the reason rule.
582	*/
583	public async enforceEx(...rvals: any[]): Promise<[boolean, string[]]> {
584	return generatorRunAsync(this.privateEnforce(true, true, ...rvals));	6✔
585	}
586	}

casbin / node-casbin / 1077868761

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous