-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
858c8ff
commit 635b8cb
Showing
7 changed files
with
304 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,3 @@ | ||
| node_modules | ||
| todo | ||
| todo | ||
| .tmp |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| package fastac_test | ||
|
|
||
| import ( | ||
| "github.com/abichinger/fastac" | ||
| "github.com/abichinger/fastac/model" | ||
| "github.com/abichinger/fastac/model/fm" | ||
| ) | ||
|
|
||
| //the model uses a custom MatchingFunc named customPathMatch | ||
| var example_functions_model = ` | ||
| [request_definition] | ||
| r = sub, obj, act | ||
| [policy_definition] | ||
| p = sub, obj, act | ||
| [policy_effect] | ||
| e = some(where (p.eft == allow)) | ||
| [matchers] | ||
| m = r.sub == p.sub && customPathMatch(r.obj, p.obj) && r.act == p.act` | ||
|
|
||
| var example_functions_policy = [][]string{ | ||
| {"p", "alice", "*", "GET"}, | ||
| {"p", "alice", "/user/alice", "PATCH"}, | ||
| } | ||
|
|
||
| // ExampleFunctions shows how to use a custom util.MatchingFunc | ||
| func Example_functions() { | ||
|
|
||
| //customPathMatch needs to be registered before loading the model | ||
| fm.SetFunction("customPathMatch", func(arguments ...interface{}) (interface{}, error) { | ||
| rObj := arguments[0].(string) | ||
| rSub := arguments[1].(string) | ||
|
|
||
| if rSub == "*" { | ||
| return true, nil | ||
| } | ||
| return rObj == rSub, nil | ||
| }) | ||
|
|
||
| //create enforcer and add rules | ||
| m := model.NewModel() | ||
| _ = m.LoadModelFromText(example_functions_model) | ||
| e, _ := fastac.NewEnforcer(m, nil) | ||
| _ = e.AddRules(example_functions_policy) | ||
|
|
||
| //perform some requests | ||
| printReq(e, "alice", "/user/alice/entry/1", "GET") | ||
| printReq(e, "bob", "/user/alice/entry/1", "GET") | ||
| printReq(e, "alice", "/user/alice", "PATCH") | ||
| printReq(e, "bob", "/user/alice", "PATCH") | ||
|
|
||
| // Output: alice, /user/alice/entry/1, GET => allow | ||
| // bob, /user/alice/entry/1, GET => deny | ||
| // alice, /user/alice, PATCH => allow | ||
| // bob, /user/alice, PATCH => deny | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| package fastac_test | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "strings" | ||
|
|
||
| "github.com/abichinger/fastac" | ||
| "github.com/abichinger/fastac/model" | ||
| "github.com/abichinger/fastac/rbac" | ||
| "github.com/abichinger/fastac/util" | ||
| ) | ||
|
|
||
| //the model uses the built-in MatchingFunc pathMatch | ||
| var example_matcher_model = ` | ||
| [request_definition] | ||
| r = sub, obj, act | ||
| [policy_definition] | ||
| p = sub, obj, act | ||
| [role_definition] | ||
| g = _, _ | ||
| [policy_effect] | ||
| e = some(where (p.eft == allow)) | ||
| [matchers] | ||
| m = g(r.sub, p.sub) && pathMatch(r.obj, p.obj) && r.act == p.act` | ||
|
|
||
| var example_matcher_policy = [][]string{ | ||
| {"p", "role:user", "/user/:uid/entry/:eid", "GET"}, | ||
| {"p", "user:alice", "/user/alice/*", "POST"}, | ||
| {"p", "role:admin", "/user/:uid/entry/:eid", "DELETE"}, | ||
| {"g", "reg:user:.*", "role:user"}, | ||
| {"g", "user:alice", "role:admin"}, | ||
| } | ||
|
|
||
| func printReq(e *fastac.Enforcer, params ...interface{}) { | ||
| b, _ := e.Enforce(params...) | ||
| var rule []string | ||
| for _, param := range params { | ||
| rule = append(rule, param.(string)) | ||
| } | ||
| if b { | ||
| fmt.Printf("%s => allow\n", strings.Join(rule, ", ")) | ||
| } else { | ||
| fmt.Printf("%s => deny\n", strings.Join(rule, ", ")) | ||
| } | ||
| } | ||
|
|
||
| // ExampleMatchers shows the usage of util.MatchingFunc and util.IMatcher | ||
| func Example_matchers() { | ||
|
|
||
| //create enforcer and add rules | ||
| m := model.NewModel() | ||
| _ = m.LoadModelFromText(example_matcher_model) | ||
| e, _ := fastac.NewEnforcer(m, nil) | ||
| _ = e.AddRules(example_matcher_policy) | ||
|
|
||
| //get the default rolemanager | ||
| rm, _ := e.GetModel().GetRoleManager("g") | ||
|
|
||
| // set a role matcher. | ||
| // create a PrefixMatcher. PrefixMatcher implements the interface util.IMatcher | ||
| // each regex pattern needs to be marked with the prefix "reg:" | ||
| roleMatcher := util.NewPrefixMatcher("reg:", util.RegexMatch) | ||
| rm.(rbac.IDefaultRoleManager).SetMatcher(roleMatcher) | ||
|
|
||
| printReq(e, "user:alice", "/user/joe/entry/1", "GET") //allow, because user:alice has role:user | ||
| printReq(e, "user:alice", "/user/alice/entry/2", "POST") | ||
| printReq(e, "user:alice", "/user/bob/entry/3", "POST") | ||
| printReq(e, "user:alice", "/user/bob/entry/3", "DELETE") | ||
| printReq(e, "user:bob", "/user/alice/entry/2", "DELETE") | ||
|
|
||
| // Output: user:alice, /user/joe/entry/1, GET => allow | ||
| // user:alice, /user/alice/entry/2, POST => allow | ||
| // user:alice, /user/bob/entry/3, POST => deny | ||
| // user:alice, /user/bob/entry/3, DELETE => allow | ||
| // user:bob, /user/alice/entry/2, DELETE => deny | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| package fastac_test | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "sort" | ||
|
|
||
| "github.com/abichinger/fastac" | ||
| "github.com/abichinger/fastac/util" | ||
| ) | ||
|
|
||
| var example_rules_policy = [][]string{ | ||
| {"p", "alice", "data1", "read"}, | ||
| {"p", "alice", "data1", "write"}, | ||
| {"p", "bob", "data2", "read"}, | ||
| {"p", "bob", "data2", "write"}, | ||
| {"p", "alice", "data3", "read"}, | ||
| {"p", "bob", "data3", "read"}, | ||
| {"p", "manager", "data3", "write"}, | ||
| {"g", "bob", "manager"}, | ||
| } | ||
|
|
||
| // ExampleManagePolicy demonstrates the usage of functions to modify the policy | ||
| func Example_managePolicy() { | ||
|
|
||
| //create enforcer with rbac model and empty policy | ||
| e, _ := fastac.NewEnforcer("examples/rbac_model.conf", nil) | ||
|
|
||
| //add multiple rules at once | ||
| _ = e.AddRules(example_rules_policy) | ||
|
|
||
| //remove all rules of user bob | ||
| bobRules, _ := e.Filter(fastac.SetMatcher(`p.sub == "bob"`)) | ||
| bobGroupingRules, _ := e.Filter(fastac.SetMatcher(`g.user == "bob"`)) | ||
| _ = e.RemoveRules(append(bobRules, bobGroupingRules...)) | ||
|
|
||
| //make alice a manager | ||
| alice_manager := []string{"g", "alice", "manager"} | ||
| added, _ := e.AddRule(alice_manager) | ||
| if added { | ||
| fmt.Println("rule added successfully") | ||
| } | ||
|
|
||
| //get a list of all rules | ||
| var allRules [][]string | ||
| e.GetModel().RangeRules(func(rule []string) bool { | ||
| allRules = append(allRules, rule) | ||
| return true | ||
| }) | ||
|
|
||
| //sort and print rules | ||
| allRulesStr := util.Join2D(allRules, ", ") | ||
| sort.Strings(allRulesStr) | ||
| for _, rule := range allRulesStr { | ||
| fmt.Println(rule) | ||
| } | ||
|
|
||
| // Output: rule added successfully | ||
| // g, alice, manager | ||
| // p, alice, data1, read | ||
| // p, alice, data1, write | ||
| // p, alice, data3, read | ||
| // p, manager, data3, write | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| package fastac_test | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
| "sort" | ||
| "strings" | ||
|
|
||
| "github.com/abichinger/fastac" | ||
| gormadapter "github.com/abichinger/gorm-adapter" | ||
| "gorm.io/driver/sqlite" | ||
| "gorm.io/gorm" | ||
| ) | ||
|
|
||
| var example_rules_1 = [][]string{ | ||
| {"p", "alice", "data1", "read"}, | ||
| {"p", "alice", "data1", "write"}, | ||
| {"p", "bob", "data1", "read"}, | ||
| } | ||
|
|
||
| func createDB(name string) *gorm.DB { | ||
| _ = os.Mkdir(".tmp", 0755) | ||
| db, _ := gorm.Open(sqlite.Open(".tmp/"+name+".db"), &gorm.Config{}) | ||
| return db | ||
| } | ||
|
|
||
| func removeDB(name string) { | ||
| os.Remove(".tmp/" + name + ".db") | ||
| } | ||
|
|
||
| // ExampleStorageAdapter shows how to store/load policy rules to/from a storage adapter | ||
| func Example_storageAdapter() { | ||
|
|
||
| //init adapter | ||
| db := createDB("example") | ||
| defer removeDB("example") | ||
| a, err := gormadapter.NewAdapter(db) | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| //create enforcer and store rules using the autosave feature | ||
| e, _ := fastac.NewEnforcer("examples/basic_model.conf", a, fastac.OptionAutosave(true)) | ||
| err = e.AddRules(example_rules_1) | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| //second enforcer to demonstrate LoadPolicy | ||
| e2, _ := fastac.NewEnforcer("examples/basic_model.conf", a) | ||
| err = e2.LoadPolicy() | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| loadedRules := []string{} | ||
| e2.GetModel().RangeRules(func(rule []string) bool { | ||
| loadedRules = append(loadedRules, strings.Join(rule, ", ")) | ||
| return true | ||
| }) | ||
|
|
||
| sort.Strings(loadedRules) | ||
| for _, rule := range loadedRules { | ||
| fmt.Println(rule) | ||
| } | ||
| // Output: p, alice, data1, read | ||
| // p, alice, data1, write | ||
| // p, bob, data1, read | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters