2171136807

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/casbin/node-casbin/commit/<a class=hub.com/casbin/node-casbin/commit/<a class="double-link" href="https://git"><a class=hub.com/casbin/node-casbin/commit/<a class="double-link" href="https://git"><a class=hub.com/casbin/node-casbin/commit/<a class="double-link" href="https://git"><a class=hub.com/casbin/node-casbin/commit/4bd83f0b1376201aad21c02b22abe304665a6795">4bd83f0b1">&lt;a href=&quot;https://github.com/casbin/node-casbin/commit/</a><a class="double-link" href="https://github.com/casbin/node-casbin/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/casbin/node-casbin/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/casbin/node-casbin/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/casbin/node-casbin/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/casbin/node-casbin/commit/4bd83f0b1376201aad21c02b22abe304665a6795">4bd83f0b1</a><a href="https://github.com/casbin/node-casbin/commit/4bd83f0b1376201aad21c02b22abe304665a6795">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/casbin/node-casbin/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/casbin/node-casbin/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/casbin/node-casbin/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/casbin/node-casbin/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/casbin/node-casbin/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/casbin/node-casbin/commit/4bd83f0b1376201aad21c02b22abe304665a6795&quot;&gt;4bd83f0b1&lt;/a&gt;&lt;a href=&quot;https://github.com/casbin/node-casbin/commit/4bd83f0b1376201aad21c02b22abe304665a6795&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/casbin/node-casbin/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/casbin/node-casbin/comm... (continued)

Pull Request Pull Request #360: chore: sync with main branch

Run Details

694 of 995 branches covered (69.75%)

Branch coverage included in aggregate %.

11 of 17 new or added lines in 4 files covered. (64.71%)

1331 of 1680 relevant lines covered (79.23%)

158.97 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

75.13

/src/coreEnforcer.ts

// Copyright 2018 The Casbin Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

import { compile, compileAsync, addBinaryOp } from 'expression-eval';

import { DefaultEffector, Effect, Effector } from './effect';
import { FunctionMap, Model, newModel, PolicyOp } from './model';
import { Adapter, FilteredAdapter, Watcher } from './persist';
import { DefaultRoleManager, RoleManager } from './rbac';
import { EnforceContext } from './enforceContext';

import {
  escapeAssertion,
  generateGFunction,
  getEvalValue,
  hasEval,
  replaceEval,
  generatorRunSync,
  generatorRunAsync,
  customIn,
  bracketCompatible,
} from './util';
import { getLogger, logPrint } from './log';
import { MatchingFunc } from './rbac';

type Matcher = ((context: any) => Promise<any>) | ((context: any) => any);

type EnforceResult = Generator<(boolean | [boolean, string[]]) | Promise<boolean | [boolean, string[]]>>;

/**
 * CoreEnforcer defines the core functionality of an enforcer.
 */
export class CoreEnforcer {
  protected modelPath: string;
  protected model: Model;
  protected fm: FunctionMap = FunctionMap.loadFunctionMap();
  protected eft: Effector = new DefaultEffector();
  private matcherMap: Map<string, Matcher> = new Map();
  private defaultEnforceContext: EnforceContext = new EnforceContext('r', 'p', 'e', 'm');

  protected adapter: Adapter;
  protected watcher: Watcher | null = null;
  protected rmMap: Map<string, RoleManager>;

  protected enabled = true;
  protected autoSave = true;
  protected autoBuildRoleLinks = true;
  protected autoNotifyWatcher = true;

  private getExpression(asyncCompile: boolean, exp: string): Matcher {
    const matcherKey = `${asyncCompile ? 'ASYNC[' : 'SYNC['}${exp}]`;

    addBinaryOp('in', 1, customIn);

    let expression = this.matcherMap.get(matcherKey);
    if (!expression) {
      exp = bracketCompatible(exp);
      expression = asyncCompile ? compileAsync(exp) : compile(exp);
      this.matcherMap.set(matcherKey, expression);
    }
    return expression;
  }

  /**
   * loadModel reloads the model from the model CONF string.
   * Because the policy is attached to a model,
   * so the policy is invalidated and needs to be reloaded by calling LoadPolicy().
   */
  public loadModel(): void {
    this.model = newModel();
    this.model.loadModel(this.modelPath);
    this.model.printModel();
  }

  /**
   * getModel gets the current model.
   *
   * @return the model of the enforcer.
   */
  public getModel(): Model {
    return this.model;
  }

  /**
   * setModel sets the current model.
   *
   * @param m the model.
   */
  public setModel(m: Model): void {
    this.model = m;
  }

  /**
   * getAdapter gets the current adapter.
   *
   * @return the adapter of the enforcer.
   */
  public getAdapter(): Adapter {
    return this.adapter;
  }

  /**
   * setAdapter sets the current adapter.
   *
   * @param adapter the adapter.
   */
  public setAdapter(adapter: Adapter): void {
    this.adapter = adapter;
  }

  /**
   * setWatcher sets the current watcher.
   *
   * @param watcher the watcher.
   */
  public setWatcher(watcher: Watcher): void {
    this.watcher = watcher;
    watcher.setUpdateCallback(async () => await this.loadPolicy());
  }

  /**
   * setRoleManager sets the current role manager.
   *
   * @param rm the role manager.
   */
  public setRoleManager(rm: RoleManager): void {
    this.rmMap.set('g', rm);
  }

  /**
   * getRoleManager gets the current role manager.
   */
  public getRoleManager(): RoleManager {
    return <RoleManager>this.rmMap.get('g');
  }

  /**
   * getNamedRoleManager gets role manager by name.
   */
  public getNamedRoleManager(name: string): RoleManager | undefined {
    return this.rmMap.get(name);
  }

  /**
   * setEffector sets the current effector.
   *
   * @param eft the effector.
   */
  public setEffector(eft: Effector): void {
    this.eft = eft;
  }

  /**
   * clearPolicy clears all policy.
   */
  public clearPolicy(): void {
    this.model.clearPolicy();
  }

  public initRmMap(): void {
    this.rmMap = new Map<string, RoleManager>();
    const rm = this.model.model.get('g');
    if (rm) {
      for (const ptype of rm.keys()) {
        this.rmMap.set(ptype, new DefaultRoleManager(10));
      }
    }
  }

  public sortPolicies(): void {
    const policy = this.model.model.get('p')?.get('p')?.policy;
    const tokens = this.model.model.get('p')?.get('p')?.tokens;

    if (policy && tokens) {
      const priorityIndex = tokens.indexOf('p_priority');
      if (priorityIndex !== -1) {
        policy.sort((a, b) => {
          return parseInt(a[priorityIndex], 10) - parseInt(b[priorityIndex], 10);
        });
      }
    }
  }

  /**
   * loadPolicy reloads the policy from adapter.
   */
  public async loadPolicy(): Promise<void> {
    this.model.clearPolicy();
    await this.adapter.loadPolicy(this.model);

    this.sortPolicies();

    if (this.autoBuildRoleLinks) {
      await this.buildRoleLinksInternal();
    }
  }

  /**
   * loadFilteredPolicy reloads a filtered policy from adapter.
   *
   * @param filter the filter used to specify which type of policy should be loaded.
   */
  // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
  public async loadFilteredPolicy(filter: any): Promise<boolean> {
    this.model.clearPolicy();

    return this.loadIncrementalFilteredPolicy(filter);
  }

  /**
   * LoadIncrementalFilteredPolicy append a filtered policy from adapter.
   *
   * @param filter the filter used to specify which type of policy should be appended.
   */
  // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
  public async loadIncrementalFilteredPolicy(filter: any): Promise<boolean> {
    if ('isFiltered' in this.adapter) {
      await (this.adapter as FilteredAdapter).loadFilteredPolicy(this.model, filter);
    } else {
      throw new Error('filtered policies are not supported by this adapter');
    }

    this.sortPolicies();

    if (this.autoBuildRoleLinks) {
      await this.buildRoleLinksInternal();
    }
    return true;
  }

  /**
   * isFiltered returns true if the loaded policy has been filtered.
   *
   * @return if the loaded policy has been filtered.
   */
  public isFiltered(): boolean {
    if ('isFiltered' in this.adapter) {
      return (this.adapter as FilteredAdapter).isFiltered();
    }
    return false;
  }

  /**
   * savePolicy saves the current policy (usually after changed with
   * Casbin API) back to adapter.
   */
  public async savePolicy(): Promise<boolean> {
    if (this.isFiltered()) {
      throw new Error('Cannot save a filtered policy');
    }
    const flag = await this.adapter.savePolicy(this.model);
    if (!flag) {
      return false;
    }
    if (this.watcher) {
      return await this.watcher.update();
    }
    return true;
  }

  /**
   * enableEnforce changes the enforcing state of Casbin, when Casbin is
   * disabled, all access will be allowed by the enforce() function.
   *
   * @param enable whether to enable the enforcer.
   */
  public enableEnforce(enable: boolean): void {
    this.enabled = enable;
  }

  /**
   * enableLog changes whether to print Casbin log to the standard output.
   *
   * @param enable whether to enable Casbin's log.
   */
  public enableLog(enable: boolean): void {
    getLogger().enableLog(enable);
  }

  /**
   * enableAutoSave controls whether to save a policy rule automatically to
   * the adapter when it is added or removed.
   *
   * @param autoSave whether to enable the AutoSave feature.
   */
  public enableAutoSave(autoSave: boolean): void {
    this.autoSave = autoSave;
  }

  /**
   * enableAutoNotifyWatcher controls whether to save a policy rule automatically notify the Watcher when it is added or removed.
   * @param enable whether to enable the AutoNotifyWatcher feature.
   */
  public enableAutoNotifyWatcher(enable: boolean): void {
    this.autoNotifyWatcher = enable;
  }

  /**
   * enableAutoBuildRoleLinks controls whether to save a policy rule
   * automatically to the adapter when it is added or removed.
   *
   * @param autoBuildRoleLinks whether to automatically build the role links.
   */
  public enableAutoBuildRoleLinks(autoBuildRoleLinks: boolean): void {
    this.autoBuildRoleLinks = autoBuildRoleLinks;
  }

  /**
   * add matching function to RoleManager by ptype
   * @param ptype g
   * @param fn the function will be added
   */
  public async addNamedMatchingFunc(ptype: string, fn: MatchingFunc): Promise<void> {
    const rm = this.rmMap.get(ptype);
    if (rm) {
      return await (<DefaultRoleManager>rm).addMatchingFunc(fn);
    }

    throw Error('Target ptype not found.');
  }

  /**
   * add domain matching function to RoleManager by ptype
   * @param ptype g
   * @param fn the function will be added
   */
  public async addNamedDomainMatchingFunc(ptype: string, fn: MatchingFunc): Promise<void> {
    const rm = this.rmMap.get(ptype);
    if (rm) {
      return await (<DefaultRoleManager>rm).addDomainMatchingFunc(fn);
    }
  }

  /**
   * buildRoleLinks manually rebuild the role inheritance relations.
   */
  public async buildRoleLinks(): Promise<void> {
    return this.buildRoleLinksInternal();
  }

  /**
   * buildIncrementalRoleLinks provides incremental build the role inheritance relations.
   * @param op policy operation
   * @param ptype g
   * @param rules policies
   */
  public async buildIncrementalRoleLinks(op: PolicyOp, ptype: string, rules: string[][]): Promise<void> {
    let rm = this.rmMap.get(ptype);
    if (!rm) {
      rm = new DefaultRoleManager(10);
      this.rmMap.set(ptype, rm);
    }
    await this.model.buildIncrementalRoleLinks(rm, op, 'g', ptype, rules);
  }

  protected async buildRoleLinksInternal(): Promise<void> {
    for (const rm of this.rmMap.values()) {
      await rm.clear();
      await this.model.buildRoleLinks(this.rmMap);
    }
  }

  private *privateEnforce(
    asyncCompile = true,
    explain = false,
    enforceContext: EnforceContext = new EnforceContext('r', 'p', 'e', 'm'),
    ...rvals: any[]
  ): EnforceResult {
    if (!this.enabled) {
      return true;
    }

    let explainIndex = -1;

    const functions: { [key: string]: any } = {};
    this.fm.getFunctions().forEach((value: any, key: string) => {
      functions[key] = value;
    });

    const astMap = this.model.model.get('g');

    astMap?.forEach((value, key) => {
      const rm = value.rm;
      functions[key] = generateGFunction(rm);
    });

    const expString = this.model.model.get('m')?.get(enforceContext.mType)?.value;
    if (!expString) {
      throw new Error('Unable to find matchers in model');
    }

    const effectExpr = this.model.model.get('e')?.get(enforceContext.eType)?.value;
    if (!effectExpr) {
      throw new Error('Unable to find policy_effect in model');
    }

    const HasEval: boolean = hasEval(expString);
    let expression: Matcher | undefined = undefined;

    const p = this.model.model.get('p')?.get(enforceContext.pType);
    const policyLen = p?.policy?.length;

    const rTokens = this.model.model.get('r')?.get(enforceContext.rType)?.tokens;
    const rTokensLen = rTokens?.length;

    const effectStream = this.eft.newStream(effectExpr);

    if (policyLen && policyLen !== 0) {
      for (let i = 0; i < policyLen; i++) {
        const parameters: { [key: string]: any } = {};

        if (rTokens?.length !== rvals.length) {
          throw new Error(`invalid request size: expected ${rTokensLen}, got ${rvals.length}, rvals: ${rvals}"`);
        }

        rTokens.forEach((token, j) => {
          parameters[token] = rvals[j];
        });

        p?.tokens.forEach((token, j) => {
          parameters[token] = p?.policy[i][j];
        });

        if (HasEval) {
          const ruleNames: string[] = getEvalValue(expString);
          let expWithRule = expString;
          for (const ruleName of ruleNames) {
            if (ruleName in parameters) {
              const rule = escapeAssertion(parameters[ruleName]);
              expWithRule = replaceEval(expWithRule, ruleName, rule);
            } else {
              throw new Error(`${ruleName} not in ${parameters}`);
            }
          }
          expression = this.getExpression(asyncCompile, expWithRule);
        } else {
          if (expression === undefined) {
            expression = this.getExpression(asyncCompile, expString);
          }
        }

        const context = { ...parameters, ...functions };
        const result = asyncCompile ? yield expression(context) : expression(context);

        let eftRes: Effect;
        switch (typeof result) {
          case 'boolean':
            eftRes = result ? Effect.Allow : Effect.Indeterminate;
            break;
          case 'number':
            if (result === 0) {
              eftRes = Effect.Indeterminate;
            } else {
              eftRes = result;
            }
            break;
          case 'string':
            if (result === '') {
              eftRes = Effect.Indeterminate;
            } else {
              eftRes = Effect.Allow;
            }
            break;
          default:
            throw new Error('matcher result should only be of type boolean, number, or string');
        }

        const eft = parameters['p_eft'];
        if (eft && eftRes === Effect.Allow) {
          if (eft === 'allow') {
            eftRes = Effect.Allow;
          } else if (eft === 'deny') {
            eftRes = Effect.Deny;
          } else {
            eftRes = Effect.Indeterminate;
          }
        }

        const [res, done] = effectStream.pushEffect(eftRes);

        if (done) {
          explainIndex = i;
          break;
        }
      }
    } else {
      explainIndex = 0;

      const parameters: { [key: string]: any } = {};

      rTokens?.forEach((token, j): void => {
        parameters[token] = rvals[j];
      });

      p?.tokens?.forEach((token) => {
        parameters[token] = '';
      });

      expression = this.getExpression(asyncCompile, expString);
      const context = { ...parameters, ...functions };
      const result = asyncCompile ? yield expression(context) : expression(context);

      if (result) {
        effectStream.pushEffect(Effect.Allow);
      } else {
        effectStream.pushEffect(Effect.Indeterminate);
      }
    }

    const res = effectStream.current();

    // only generate the request --> result string if the message
    // is going to be logged.
    if (getLogger().isEnable()) {
      let reqStr = 'Request: ';
      for (let i = 0; i < rvals.length; i++) {
        if (i !== rvals.length - 1) {
          reqStr += `${rvals[i]}, `;
        } else {
          reqStr += rvals[i];
        }
      }
      reqStr += ` ---> ${res}`;
      logPrint(reqStr);
    }

    if (explain) {
      if (explainIndex === -1) {
        return [res, []];
      }
      return [res, p?.policy[explainIndex]];
    }

    return res;
  }

  /**
   * If the matchers does not contain an asynchronous method, call it faster.
   *
   * enforceSync decides whether a "subject" can access a "object" with
   * the operation "action", input parameters are usually: (sub, obj, act).
   *
   * @param rvals the request needs to be mediated, usually an array
   *              of strings, can be class instances if ABAC is used.
   * @return whether to allow the request.
   */
  public enforceSync(...rvals: any[]): boolean {
    if (rvals[0] instanceof EnforceContext) {
      const enforceContext: EnforceContext = rvals.shift();
      return generatorRunSync(this.privateEnforce(false, false, enforceContext, ...rvals));
    }
    return generatorRunSync(this.privateEnforce(false, false, this.defaultEnforceContext, ...rvals));
  }

  /**
   * If the matchers does not contain an asynchronous method, call it faster.
   *
   * enforceSync decides whether a "subject" can access a "object" with
   * the operation "action", input parameters are usually: (sub, obj, act).
   *
   * @param rvals the request needs to be mediated, usually an array
   *              of strings, can be class instances if ABAC is used.
   * @return whether to allow the request and the reason rule.
   */
  public enforceExSync(...rvals: any[]): [boolean, string[]] {
    if (rvals[0] instanceof EnforceContext) {
      const enforceContext: EnforceContext = rvals.shift();
      return generatorRunSync(this.privateEnforce(false, true, enforceContext, ...rvals));
    }
    return generatorRunSync(this.privateEnforce(false, true, this.defaultEnforceContext, ...rvals));
  }

  /**
   * Same as enforceSync. To be removed.
   */
  public enforceWithSyncCompile(...rvals: any[]): boolean {
    return this.enforceSync(...rvals);
  }

  /**
   * enforce decides whether a "subject" can access a "object" with
   * the operation "action", input parameters are usually: (sub, obj, act).
   *
   * @param rvals the request needs to be mediated, usually an array
   *              of strings, can be class instances if ABAC is used.
   * @return whether to allow the request.
   */
  public async enforce(...rvals: any[]): Promise<boolean> {
    if (rvals[0] instanceof EnforceContext) {
      const enforceContext: EnforceContext = rvals.shift();
      return generatorRunAsync(this.privateEnforce(true, false, enforceContext, ...rvals));
    }
    return generatorRunAsync(this.privateEnforce(true, false, this.defaultEnforceContext, ...rvals));
  }

  /**
   * enforce decides whether a "subject" can access a "object" with
   * the operation "action", input parameters are usually: (sub, obj, act).
   *
   * @param rvals the request needs to be mediated, usually an array
   *              of strings, can be class instances if ABAC is used.
   * @return whether to allow the request and the reason rule.
   */
  public async enforceEx(...rvals: any[]): Promise<[boolean, string[]]> {
    if (rvals[0] instanceof EnforceContext) {
      const enforceContext: EnforceContext = rvals.shift();
      return generatorRunAsync(this.privateEnforce(true, true, enforceContext, ...rvals));
    }
    return generatorRunAsync(this.privateEnforce(true, true, this.defaultEnforceContext, ...rvals));
  }

  /**
   * batchEnforce enforces each request and returns result in a bool array.
   * @param rvals the request need to be mediated, usually an array
   *              of array of strings, can be class instances if ABAC is used.
   * @returns whether to allow the requests.
   */
  public async batchEnforce(rvals: any[]): Promise<boolean[]> {
    return await Promise.all(rvals.map((rval) => this.enforce(...rval)));
  }
}

1	// Copyright 2018 The Casbin Authors. All Rights Reserved.
2	//
3	// Licensed under the Apache License, Version 2.0 (the "License");
4	// you may not use this file except in compliance with the License.
5	// You may obtain a copy of the License at
6	//
7	// http://www.apache.org/licenses/LICENSE-2.0
8	//
9	// Unless required by applicable law or agreed to in writing, software
10	// distributed under the License is distributed on an "AS IS" BASIS,
11	// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	// See the License for the specific language governing permissions and
13	// limitations under the License.
14
15	import { compile, compileAsync, addBinaryOp } from 'expression-eval';	36✔
16
17	import { DefaultEffector, Effect, Effector } from './effect';	36✔
18	import { FunctionMap, Model, newModel, PolicyOp } from './model';	36✔
19	import { Adapter, FilteredAdapter, Watcher } from './persist';
20	import { DefaultRoleManager, RoleManager } from './rbac';	36✔
21	import { EnforceContext } from './enforceContext';	36✔
22
23	import {	36✔
24	escapeAssertion,
25	generateGFunction,
26	getEvalValue,
27	hasEval,
28	replaceEval,
29	generatorRunSync,
30	generatorRunAsync,
31	customIn,
32	bracketCompatible,
33	} from './util';
34	import { getLogger, logPrint } from './log';	36✔
35	import { MatchingFunc } from './rbac';
36
37	type Matcher = ((context: any) => Promise<any>) \| ((context: any) => any);
38
39	type EnforceResult = Generator<(boolean \| [boolean, string[]]) \| Promise<boolean \| [boolean, string[]]>>;
40
41	/**
42	* CoreEnforcer defines the core functionality of an enforcer.
43	*/
44	export class CoreEnforcer {	36✔
45	protected modelPath: string;
46	protected model: Model;
47	protected fm: FunctionMap = FunctionMap.loadFunctionMap();	360✔
48	protected eft: Effector = new DefaultEffector();	360✔
49	private matcherMap: Map<string, Matcher> = new Map();	360✔
50	private defaultEnforceContext: EnforceContext = new EnforceContext('r', 'p', 'e', 'm');	360✔
51
52	protected adapter: Adapter;
53	protected watcher: Watcher \| null = null;	360✔
54	protected rmMap: Map<string, RoleManager>;
55
56	protected enabled = true;	360✔
57	protected autoSave = true;	360✔
58	protected autoBuildRoleLinks = true;	360✔
59	protected autoNotifyWatcher = true;	360✔
60
61	private getExpression(asyncCompile: boolean, exp: string): Matcher {
62	const matcherKey = `${asyncCompile ? 'ASYNC[' : 'SYNC['}${exp}]`;	1,239✔
63
64	addBinaryOp('in', 1, customIn);	1,239✔
65
66	let expression = this.matcherMap.get(matcherKey);	1,239✔
67	if (!expression) {	1,239✔
68	exp = bracketCompatible(exp);	174✔
69	expression = asyncCompile ? compileAsync(exp) : compile(exp);	174✔
70	this.matcherMap.set(matcherKey, expression);	174✔
71	}
72	return expression;	1,239✔
73	}
74
75	/**
76	* loadModel reloads the model from the model CONF string.
77	* Because the policy is attached to a model,
78	* so the policy is invalidated and needs to be reloaded by calling LoadPolicy().
79	*/
80	public loadModel(): void {
81	this.model = newModel();	×
82	this.model.loadModel(this.modelPath);	×
83	this.model.printModel();	×
84	}
85
86	/**
87	* getModel gets the current model.
88	*
89	* @return the model of the enforcer.
90	*/
91	public getModel(): Model {
92	return this.model;	15✔
93	}
94
95	/**
96	* setModel sets the current model.
97	*
98	* @param m the model.
99	*/
100	public setModel(m: Model): void {
101	this.model = m;	9✔
102	}
103
104	/**
105	* getAdapter gets the current adapter.
106	*
107	* @return the adapter of the enforcer.
108	*/
109	public getAdapter(): Adapter {
110	return this.adapter;	3✔
111	}
112
113	/**
114	* setAdapter sets the current adapter.
115	*
116	* @param adapter the adapter.
117	*/
118	public setAdapter(adapter: Adapter): void {
119	this.adapter = adapter;	39✔
120	}
121
122	/**
123	* setWatcher sets the current watcher.
124	*
125	* @param watcher the watcher.
126	*/
127	public setWatcher(watcher: Watcher): void {
128	this.watcher = watcher;	×
129	watcher.setUpdateCallback(async () => await this.loadPolicy());	×
130	}
131
132	/**
133	* setRoleManager sets the current role manager.
134	*
135	* @param rm the role manager.
136	*/
137	public setRoleManager(rm: RoleManager): void {
138	this.rmMap.set('g', rm);	×
139	}
140
141	/**
142	* getRoleManager gets the current role manager.
143	*/
144	public getRoleManager(): RoleManager {
145	return <RoleManager>this.rmMap.get('g');	9✔
146	}
147
148	/**
149	* getNamedRoleManager gets role manager by name.
150	*/
151	public getNamedRoleManager(name: string): RoleManager \| undefined {
152	return this.rmMap.get(name);	×
153	}
154
155	/**
156	* setEffector sets the current effector.
157	*
158	* @param eft the effector.
159	*/
160	public setEffector(eft: Effector): void {
161	this.eft = eft;	×
162	}
163
164	/**
165	* clearPolicy clears all policy.
166	*/
167	public clearPolicy(): void {
168	this.model.clearPolicy();	6✔
169	}
170
171	public initRmMap(): void {
172	this.rmMap = new Map<string, RoleManager>();	360✔
173	const rm = this.model.model.get('g');	360✔
174	if (rm) {	360✔
175	for (const ptype of rm.keys()) {	255✔
176	this.rmMap.set(ptype, new DefaultRoleManager(10));	264✔
177	}
178	}
179	}
180
181	public sortPolicies(): void {
182	const policy = this.model.model.get('p')?.get('p')?.policy;	357✔
183	const tokens = this.model.model.get('p')?.get('p')?.tokens;	357✔
184
185	if (policy && tokens) {	357✔
186	const priorityIndex = tokens.indexOf('p_priority');	339✔
187	if (priorityIndex !== -1) {	339✔
188	policy.sort((a, b) => {	6✔
189	return parseInt(a[priorityIndex], 10) - parseInt(b[priorityIndex], 10);	78✔
190	});
191	}
192	}
193	}
194
195	/**
196	* loadPolicy reloads the policy from adapter.
197	*/
198	public async loadPolicy(): Promise<void> {
199	this.model.clearPolicy();	357✔
200	await this.adapter.loadPolicy(this.model);	357✔
201
202	this.sortPolicies();	357✔
203
204	if (this.autoBuildRoleLinks) {	357!
205	await this.buildRoleLinksInternal();	357✔
206	}
207	}
208
209	/**
210	* loadFilteredPolicy reloads a filtered policy from adapter.
211	*
212	* @param filter the filter used to specify which type of policy should be loaded.
213	*/
214	// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
215	public async loadFilteredPolicy(filter: any): Promise<boolean> {
216	this.model.clearPolicy();	×
217
218	return this.loadIncrementalFilteredPolicy(filter);	×
219	}
220
221	/**
222	* LoadIncrementalFilteredPolicy append a filtered policy from adapter.
223	*
224	* @param filter the filter used to specify which type of policy should be appended.
225	*/
226	// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
227	public async loadIncrementalFilteredPolicy(filter: any): Promise<boolean> {
228	if ('isFiltered' in this.adapter) {	×
229	await (this.adapter as FilteredAdapter).loadFilteredPolicy(this.model, filter);	×
230	} else {
231	throw new Error('filtered policies are not supported by this adapter');	×
232	}
233
234	this.sortPolicies();	×
235
236	if (this.autoBuildRoleLinks) {	×
237	await this.buildRoleLinksInternal();	×
238	}
239	return true;	×
240	}
241
242	/**
243	* isFiltered returns true if the loaded policy has been filtered.
244	*
245	* @return if the loaded policy has been filtered.
246	*/
247	public isFiltered(): boolean {
248	if ('isFiltered' in this.adapter) {	3!
249	return (this.adapter as FilteredAdapter).isFiltered();	×
250	}
251	return false;	3✔
252	}
253
254	/**
255	* savePolicy saves the current policy (usually after changed with
256	* Casbin API) back to adapter.
257	*/
258	public async savePolicy(): Promise<boolean> {
259	if (this.isFiltered()) {	3!
260	throw new Error('Cannot save a filtered policy');	×
261	}
262	const flag = await this.adapter.savePolicy(this.model);	3✔
263	if (!flag) {	×
264	return false;	×
265	}
266	if (this.watcher) {	×
267	return await this.watcher.update();	×
268	}
269	return true;	×
270	}
271
272	/**
273	* enableEnforce changes the enforcing state of Casbin, when Casbin is
274	* disabled, all access will be allowed by the enforce() function.
275	*
276	* @param enable whether to enable the enforcer.
277	*/
278	public enableEnforce(enable: boolean): void {
279	this.enabled = enable;	6✔
280	}
281
282	/**
283	* enableLog changes whether to print Casbin log to the standard output.
284	*
285	* @param enable whether to enable Casbin's log.
286	*/
287	public enableLog(enable: boolean): void {
288	getLogger().enableLog(enable);	3✔
289	}
290
291	/**
292	* enableAutoSave controls whether to save a policy rule automatically to
293	* the adapter when it is added or removed.
294	*
295	* @param autoSave whether to enable the AutoSave feature.
296	*/
297	public enableAutoSave(autoSave: boolean): void {
298	this.autoSave = autoSave;	6✔
299	}
300
301	/**
302	* enableAutoNotifyWatcher controls whether to save a policy rule automatically notify the Watcher when it is added or removed.
303	* @param enable whether to enable the AutoNotifyWatcher feature.
304	*/
305	public enableAutoNotifyWatcher(enable: boolean): void {
306	this.autoNotifyWatcher = enable;	×
307	}
308
309	/**
310	* enableAutoBuildRoleLinks controls whether to save a policy rule
311	* automatically to the adapter when it is added or removed.
312	*
313	* @param autoBuildRoleLinks whether to automatically build the role links.
314	*/
315	public enableAutoBuildRoleLinks(autoBuildRoleLinks: boolean): void {
316	this.autoBuildRoleLinks = autoBuildRoleLinks;	3✔
317	}
318
319	/**
320	* add matching function to RoleManager by ptype
321	* @param ptype g
322	* @param fn the function will be added
323	*/
324	public async addNamedMatchingFunc(ptype: string, fn: MatchingFunc): Promise<void> {
325	const rm = this.rmMap.get(ptype);	6✔
326	if (rm) {	6!
327	return await (<DefaultRoleManager>rm).addMatchingFunc(fn);	6✔
328	}
329
330	throw Error('Target ptype not found.');	×
331	}
332
333	/**
334	* add domain matching function to RoleManager by ptype
335	* @param ptype g
336	* @param fn the function will be added
337	*/
338	public async addNamedDomainMatchingFunc(ptype: string, fn: MatchingFunc): Promise<void> {
339	const rm = this.rmMap.get(ptype);	×
340	if (rm) {	×
341	return await (<DefaultRoleManager>rm).addDomainMatchingFunc(fn);	×
342	}
343	}
344
345	/**
346	* buildRoleLinks manually rebuild the role inheritance relations.
347	*/
348	public async buildRoleLinks(): Promise<void> {
349	return this.buildRoleLinksInternal();	6✔
350	}
351
352	/**
353	* buildIncrementalRoleLinks provides incremental build the role inheritance relations.
354	* @param op policy operation
355	* @param ptype g
356	* @param rules policies
357	*/
358	public async buildIncrementalRoleLinks(op: PolicyOp, ptype: string, rules: string[][]): Promise<void> {
359	let rm = this.rmMap.get(ptype);	75✔
360	if (!rm) {	75!
361	rm = new DefaultRoleManager(10);	×
362	this.rmMap.set(ptype, rm);	×
363	}
364	await this.model.buildIncrementalRoleLinks(rm, op, 'g', ptype, rules);	75✔
365	}
366
367	protected async buildRoleLinksInternal(): Promise<void> {
368	for (const rm of this.rmMap.values()) {	363✔
369	await rm.clear();	252✔
370	await this.model.buildRoleLinks(this.rmMap);	252✔
371	}
372	}
373
374	private *privateEnforce(
375	asyncCompile = true,	×
376	explain = false,	×
377	enforceContext: EnforceContext = new EnforceContext('r', 'p', 'e', 'm'),	×
378	...rvals: any[]
379	): EnforceResult {
380	if (!this.enabled) {	1,233✔
381	return true;	24✔
382	}
383
384	let explainIndex = -1;	1,209✔
385
386	const functions: { [key: string]: any } = {};	1,209✔
387	this.fm.getFunctions().forEach((value: any, key: string) => {	1,209✔
388	functions[key] = value;	12,096✔
389	});
390
391	const astMap = this.model.model.get('g');	1,209✔
392
393	astMap?.forEach((value, key) => {	1,209✔
394	const rm = value.rm;	582✔
395	functions[key] = generateGFunction(rm);	582✔
396	});
397
398	const expString = this.model.model.get('m')?.get(enforceContext.mType)?.value;	1,209!
399	if (!expString) {	1,209!
400	throw new Error('Unable to find matchers in model');	×
401	}
402
403	const effectExpr = this.model.model.get('e')?.get(enforceContext.eType)?.value;	1,209!
404	if (!effectExpr) {	1,209!
405	throw new Error('Unable to find policy_effect in model');	×
406	}
407
408	const HasEval: boolean = hasEval(expString);	1,209✔
409	let expression: Matcher \| undefined = undefined;	1,209✔
410
411	const p = this.model.model.get('p')?.get(enforceContext.pType);	1,209!
412	const policyLen = p?.policy?.length;	1,209!
413
414	const rTokens = this.model.model.get('r')?.get(enforceContext.rType)?.tokens;	1,209!
415	const rTokensLen = rTokens?.length;	1,209!
416
417	const effectStream = this.eft.newStream(effectExpr);	1,209✔
418
419	if (policyLen && policyLen !== 0) {	1,209✔
420	for (let i = 0; i < policyLen; i++) {	1,089✔
421	const parameters: { [key: string]: any } = {};	3,210✔
422
423	if (rTokens?.length !== rvals.length) {	3,210!
424	throw new Error(`invalid request size: expected ${rTokensLen}, got ${rvals.length}, rvals: ${rvals}"`);	×
425	}
426
427	rTokens.forEach((token, j) => {	3,210✔
428	parameters[token] = rvals[j];	9,786✔
429	});
430
431	p?.tokens.forEach((token, j) => {	3,210!
432	parameters[token] = p?.policy[i][j];	10,347!
433	});
434
435	if (HasEval) {	3,210✔
436	const ruleNames: string[] = getEvalValue(expString);	84✔
437	let expWithRule = expString;	84✔
438	for (const ruleName of ruleNames) {	84✔
439	if (ruleName in parameters) {	102!
440	const rule = escapeAssertion(parameters[ruleName]);	102✔
441	expWithRule = replaceEval(expWithRule, ruleName, rule);	102✔
442	} else {
443	throw new Error(`${ruleName} not in ${parameters}`);	×
444	}
445	}
446	expression = this.getExpression(asyncCompile, expWithRule);	84✔
447	} else {
448	if (expression === undefined) {	3,126✔
449	expression = this.getExpression(asyncCompile, expString);	1,035✔
450	}
451	}
452
453	const context = { ...parameters, ...functions };	3,210✔
454	const result = asyncCompile ? yield expression(context) : expression(context);	3,210✔
455
456	let eftRes: Effect;
457	switch (typeof result) {	3,210✔
458	case 'boolean':	3,210!
459	eftRes = result ? Effect.Allow : Effect.Indeterminate;	3,210✔
460	break;	3,210✔
461	case 'number':
462	if (result === 0) {	×
463	eftRes = Effect.Indeterminate;	×
464	} else {
465	eftRes = result;	×
466	}
467	break;	×
468	case 'string':
NEW 469	if (result === '') {	×
NEW 470	eftRes = Effect.Indeterminate;	×
471	} else {
NEW 472	eftRes = Effect.Allow;	×
473	}
NEW 474	break;	×
475	default:
NEW 476	throw new Error('matcher result should only be of type boolean, number, or string');	×
477	}
478
479	const eft = parameters['p_eft'];	3,210✔
480	if (eft && eftRes === Effect.Allow) {	3,210✔
481	if (eft === 'allow') {	63✔
482	eftRes = Effect.Allow;	33✔
483	} else if (eft === 'deny') {	30✔
484	eftRes = Effect.Deny;	27✔
485	} else {
486	eftRes = Effect.Indeterminate;	3✔
487	}
488	}
489
490	const [res, done] = effectStream.pushEffect(eftRes);	3,210✔
491
492	if (done) {	3,210✔
493	explainIndex = i;	510✔
494	break;	510✔
495	}
496	}
497	} else {
498	explainIndex = 0;	120✔
499
500	const parameters: { [key: string]: any } = {};	120✔
501
502	rTokens?.forEach((token, j): void => {	120!
503	parameters[token] = rvals[j];	357✔
504	});
505
506	p?.tokens?.forEach((token) => {	120!
507	parameters[token] = '';	360✔
508	});
509
510	expression = this.getExpression(asyncCompile, expString);	120✔
511	const context = { ...parameters, ...functions };	120✔
512	const result = asyncCompile ? yield expression(context) : expression(context);	120!
513
514	if (result) {	120✔
515	effectStream.pushEffect(Effect.Allow);	27✔
516	} else {
517	effectStream.pushEffect(Effect.Indeterminate);	93✔
518	}
519	}
520
521	const res = effectStream.current();	1,209✔
522
523	// only generate the request --> result string if the message
524	// is going to be logged.
525	if (getLogger().isEnable()) {	1,209✔
526	let reqStr = 'Request: ';	24✔
527	for (let i = 0; i < rvals.length; i++) {	24✔
528	if (i !== rvals.length - 1) {	72✔
529	reqStr += `${rvals[i]}, `;	48✔
530	} else {
531	reqStr += rvals[i];	24✔
532	}
533	}
534	reqStr += ` ---> ${res}`;	24✔
535	logPrint(reqStr);	24✔
536	}
537
538	if (explain) {	1,209✔
539	if (explainIndex === -1) {	24✔
540	return [res, []];	6✔
541	}
542	return [res, p?.policy[explainIndex]];	18!
543	}
544
545	return res;	1,185✔
546	}
547
548	/**
549	* If the matchers does not contain an asynchronous method, call it faster.
550	*
551	* enforceSync decides whether a "subject" can access a "object" with
552	* the operation "action", input parameters are usually: (sub, obj, act).
553	*
554	* @param rvals the request needs to be mediated, usually an array
555	* of strings, can be class instances if ABAC is used.
556	* @return whether to allow the request.
557	*/
558	public enforceSync(...rvals: any[]): boolean {
559	if (rvals[0] instanceof EnforceContext) {	3!
560	const enforceContext: EnforceContext = rvals.shift();	×
561	return generatorRunSync(this.privateEnforce(false, false, enforceContext, ...rvals));	×
562	}
563	return generatorRunSync(this.privateEnforce(false, false, this.defaultEnforceContext, ...rvals));	3✔
564	}
565
566	/**
567	* If the matchers does not contain an asynchronous method, call it faster.
568	*
569	* enforceSync decides whether a "subject" can access a "object" with
570	* the operation "action", input parameters are usually: (sub, obj, act).
571	*
572	* @param rvals the request needs to be mediated, usually an array
573	* of strings, can be class instances if ABAC is used.
574	* @return whether to allow the request and the reason rule.
575	*/
576	public enforceExSync(...rvals: any[]): [boolean, string[]] {
577	if (rvals[0] instanceof EnforceContext) {	6!
578	const enforceContext: EnforceContext = rvals.shift();	×
579	return generatorRunSync(this.privateEnforce(false, true, enforceContext, ...rvals));	×
580	}
581	return generatorRunSync(this.privateEnforce(false, true, this.defaultEnforceContext, ...rvals));	6✔
582	}
583
584	/**
585	* Same as enforceSync. To be removed.
586	*/
587	public enforceWithSyncCompile(...rvals: any[]): boolean {
588	return this.enforceSync(...rvals);	×
589	}
590
591	/**
592	* enforce decides whether a "subject" can access a "object" with
593	* the operation "action", input parameters are usually: (sub, obj, act).
594	*
595	* @param rvals the request needs to be mediated, usually an array
596	* of strings, can be class instances if ABAC is used.
597	* @return whether to allow the request.
598	*/
599	public async enforce(...rvals: any[]): Promise<boolean> {
600	if (rvals[0] instanceof EnforceContext) {	1,206✔
601	const enforceContext: EnforceContext = rvals.shift();	12✔
602	return generatorRunAsync(this.privateEnforce(true, false, enforceContext, ...rvals));	12✔
603	}
604	return generatorRunAsync(this.privateEnforce(true, false, this.defaultEnforceContext, ...rvals));	1,194✔
605	}
606
607	/**
608	* enforce decides whether a "subject" can access a "object" with
609	* the operation "action", input parameters are usually: (sub, obj, act).
610	*
611	* @param rvals the request needs to be mediated, usually an array
612	* of strings, can be class instances if ABAC is used.
613	* @return whether to allow the request and the reason rule.
614	*/
615	public async enforceEx(...rvals: any[]): Promise<[boolean, string[]]> {
616	if (rvals[0] instanceof EnforceContext) {	18✔
617	const enforceContext: EnforceContext = rvals.shift();	12✔
618	return generatorRunAsync(this.privateEnforce(true, true, enforceContext, ...rvals));	12✔
619	}
620	return generatorRunAsync(this.privateEnforce(true, true, this.defaultEnforceContext, ...rvals));	6✔
621	}
622
623	/**
624	* batchEnforce enforces each request and returns result in a bool array.
625	* @param rvals the request need to be mediated, usually an array
626	* of array of strings, can be class instances if ABAC is used.
627	* @returns whether to allow the requests.
628	*/
629	public async batchEnforce(rvals: any[]): Promise<boolean[]> {
630	return await Promise.all(rvals.map((rval) => this.enforce(...rval)));	6✔
631	}
632	}

casbin / node-casbin / 2171136807

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous