casbin-ruby 1.0.3 → 1.0.4

data/spec/casbin/enforcer_spec.rb

@@ -0,0 +1,302 @@
+# frozen_string_literal: true
+
+require 'casbin-ruby/enforcer'
+require 'casbin-ruby/util'
+require 'support/model_helper'
+
+describe Casbin::Enforcer do
+  describe 'basic' do
+    let(:enf) { described_class.new(model_config('basic'), policy_file('basic')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', 'data1', 'read')).to be_truthy
+      expect(enf.enforce('alice', 'data2', 'read')).to be_falsey
+      expect(enf.enforce('bob', 'data2', 'write')).to be_truthy
+      expect(enf.enforce('bob', 'data1', 'write')).to be_falsey
+    end
+
+    it '#enforce_ex' do
+      expect(enf.enforce_ex('alice', 'data1', 'read')).to match_array([true, %w[alice data1 read]])
+      expect(enf.enforce_ex('alice', 'data2', 'read')).to match_array([false, []])
+      expect(enf.enforce_ex('bob', 'data2', 'write')).to match_array([true, %w[bob data2 write]])
+      expect(enf.enforce_ex('bob', 'data1', 'write')).to match_array([false, []])
+    end
+
+    it '#load_model' do
+      enf.model = nil
+      expect(enf.model).to be_nil
+      enf.load_model
+      expect(enf.model).not_to be_nil
+    end
+  end
+
+  describe 'basic without spaces' do
+    let(:enf) { described_class.new(model_config('basic_without_spaces'), policy_file('basic')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', 'data1', 'read')).to be_truthy
+      expect(enf.enforce('alice', 'data1', 'write')).to be_falsey
+      expect(enf.enforce('alice', 'data2', 'read')).to be_falsey
+      expect(enf.enforce('alice', 'data2', 'write')).to be_falsey
+      expect(enf.enforce('bob', 'data1', 'read')).to be_falsey
+      expect(enf.enforce('bob', 'data1', 'write')).to be_falsey
+      expect(enf.enforce('bob', 'data2', 'read')).to be_falsey
+      expect(enf.enforce('bob', 'data2', 'write')).to be_truthy
+    end
+  end
+
+  describe 'basic with root' do
+    let(:enf) { described_class.new(model_config('basic_with_root'), policy_file('basic')) }
+
+    it '#enforce' do
+      expect(enf.enforce('root', 'any', 'any')).to be_truthy
+    end
+  end
+
+  describe 'basic without resources' do
+    let(:enf) { described_class.new(model_config('basic_without_resources'), policy_file('basic_without_resources')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', 'read')).to be_truthy
+      expect(enf.enforce('alice', 'write')).to be_falsey
+      expect(enf.enforce('bob', 'write')).to be_truthy
+      expect(enf.enforce('bob', 'read')).to be_falsey
+    end
+  end
+
+  describe 'basic without users' do
+    let(:enf) { described_class.new(model_config('basic_without_users'), policy_file('basic_without_users')) }
+
+    it '#enforce' do
+      expect(enf.enforce('data1', 'read')).to be_truthy
+      expect(enf.enforce('data1', 'write')).to be_falsey
+      expect(enf.enforce('data2', 'write')).to be_truthy
+      expect(enf.enforce('data2', 'read')).to be_falsey
+    end
+  end
+
+  describe 'ip match' do
+    let(:enf) { described_class.new(model_config('ip'), policy_file('ip')) }
+
+    it '#enforce' do
+      expect(enf.enforce('192.168.2.1', 'data1', 'read')).to be_truthy
+      expect(enf.enforce('192.168.3.1', 'data1', 'read')).to be_falsey
+    end
+  end
+
+  describe 'key match' do
+    let(:enf) { described_class.new(model_config('key'), policy_file('key')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', '/alice_data/test', 'GET')).to be_truthy
+      expect(enf.enforce('alice', '/bob_data/test', 'GET')).to be_falsey
+      expect(enf.enforce('cathy', '/cathy_data', 'GET')).to be_truthy
+      expect(enf.enforce('cathy', '/cathy_data', 'POST')).to be_truthy
+      expect(enf.enforce('cathy', '/cathy_data/12', 'POST')).to be_falsey
+    end
+  end
+
+  describe 'key match2' do
+    let(:enf) { described_class.new(model_config('key2'), policy_file('key2')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', '/alice_data/resource', 'GET')).to be_truthy
+      expect(enf.enforce('alice', '/alice_data2/123/using/456', 'GET')).to be_truthy
+    end
+  end
+
+  describe 'priority' do
+    let(:enf) { described_class.new(model_config('priorities/priority'), policy_file('priorities/priority')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', 'data1', 'read')).to be_truthy
+      expect(enf.enforce('alice', 'data1', 'write')).to be_falsey
+      expect(enf.enforce('alice', 'data2', 'read')).to be_falsey
+      expect(enf.enforce('alice', 'data2', 'write')).to be_falsey
+
+      expect(enf.enforce('bob', 'data1', 'read')).to be_falsey
+      expect(enf.enforce('bob', 'data1', 'write')).to be_falsey
+      expect(enf.enforce('bob', 'data2', 'read')).to be_truthy
+      expect(enf.enforce('bob', 'data2', 'write')).to be_falsey
+    end
+  end
+
+  describe 'priority indeterminate' do
+    let(:enf) { described_class.new(model_config('priorities/priority'), policy_file('priorities/indeterminate')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', 'data1', 'read')).to be_falsey
+    end
+  end
+
+  describe 'rbac' do
+    let(:enf) { described_class.new(model_config('rbac'), policy_file('rbac')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', 'data1', 'read')).to be_truthy
+      expect(enf.enforce('bob', 'data1', 'read')).to be_falsey
+      expect(enf.enforce('bob', 'data2', 'write')).to be_truthy
+      expect(enf.enforce('alice', 'data2', 'read')).to be_truthy
+      expect(enf.enforce('alice', 'data2', 'write')).to be_truthy
+      expect(enf.enforce('bogus', 'data2', 'write')).to be_falsey
+    end
+  end
+
+  describe 'rbac empty policy' do
+    let(:enf) { described_class.new(model_config('rbac'), policy_file('empty')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', 'data1', 'read')).to be_falsey
+      expect(enf.enforce('bob', 'data1', 'read')).to be_falsey
+      expect(enf.enforce('bob', 'data2', 'write')).to be_falsey
+      expect(enf.enforce('alice', 'data2', 'read')).to be_falsey
+      expect(enf.enforce('alice', 'data2', 'write')).to be_falsey
+    end
+  end
+
+  describe 'rbac with_deny' do
+    let(:enf) { described_class.new(model_config('rbac_with_deny'), policy_file('rbac_with_deny')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', 'data1', 'read')).to be_truthy
+      expect(enf.enforce('bob', 'data2', 'write')).to be_truthy
+      expect(enf.enforce('alice', 'data2', 'read')).to be_truthy
+      expect(enf.enforce('alice', 'data2', 'write')).to be_falsey
+    end
+  end
+
+  describe 'rbac with domains' do
+    let(:enf) { described_class.new(model_config('rbac_with_domains'), policy_file('rbac_with_domains')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', 'domain1', 'data1', 'read')).to be_truthy
+      expect(enf.enforce('alice', 'domain1', 'data1', 'write')).to be_truthy
+      expect(enf.enforce('alice', 'domain1', 'data2', 'read')).to be_falsey
+      expect(enf.enforce('alice', 'domain1', 'data2', 'write')).to be_falsey
+
+      expect(enf.enforce('bob', 'domain2', 'data1', 'read')).to be_falsey
+      expect(enf.enforce('bob', 'domain2', 'data1', 'write')).to be_falsey
+      expect(enf.enforce('bob', 'domain2', 'data2', 'read')).to be_truthy
+      expect(enf.enforce('bob', 'domain2', 'data2', 'write')).to be_truthy
+    end
+  end
+
+  describe 'rbac with not deny' do
+    let(:enf) { described_class.new(model_config('rbac_with_not_deny'), policy_file('rbac_with_deny')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', 'data2', 'write')).to be_falsey
+    end
+  end
+
+  describe 'rbac with resource roles' do
+    let(:enf) { described_class.new(model_config('rbac_with_resource_roles'), policy_file('rbac_with_resource_roles')) }
+
+    it '#enforce' do
+      expect(enf.enforce('alice', 'data1', 'read')).to be_truthy
+      expect(enf.enforce('alice', 'data1', 'write')).to be_truthy
+      expect(enf.enforce('alice', 'data2', 'read')).to be_falsey
+      expect(enf.enforce('alice', 'data2', 'write')).to be_truthy
+
+      expect(enf.enforce('bob', 'data1', 'read')).to be_falsey
+      expect(enf.enforce('bob', 'data1', 'write')).to be_falsey
+      expect(enf.enforce('bob', 'data2', 'read')).to be_falsey
+      expect(enf.enforce('bob', 'data2', 'write')).to be_truthy
+    end
+  end
+
+  describe 'rbac with pattern' do
+    let(:enf) { described_class.new(model_config('rbac_with_pattern'), policy_file('rbac_with_pattern')) }
+
+    it '#enforce' do
+      # set matching function to key_match2
+      enf.add_named_matching_func('g2', ->(key1, key2) { Casbin::Util::BuiltinOperators.key_match2(key1, key2) })
+
+      expect(enf.enforce('alice', '/book/1', 'GET')).to be_truthy
+      expect(enf.enforce('alice', '/book/2', 'GET')).to be_truthy
+      expect(enf.enforce('alice', '/pen/1', 'GET')).to be_truthy
+      expect(enf.enforce('alice', '/pen/2', 'GET')).to be_falsey
+      expect(enf.enforce('bob', '/book/1', 'GET')).to be_falsey
+      expect(enf.enforce('bob', '/book/2', 'GET')).to be_falsey
+      expect(enf.enforce('bob', '/pen/1', 'GET')).to be_truthy
+      expect(enf.enforce('bob', '/pen/2', 'GET')).to be_truthy
+
+      # replace key_match2 with key_match3
+      enf.add_named_matching_func('g2', ->(key1, key2) { Casbin::Util::BuiltinOperators.key_match3(key1, key2) })
+      expect(enf.enforce('alice', '/book2/1', 'GET')).to be_truthy
+      expect(enf.enforce('alice', '/book2/2', 'GET')).to be_truthy
+      expect(enf.enforce('alice', '/pen2/1', 'GET')).to be_truthy
+      expect(enf.enforce('alice', '/pen2/2', 'GET')).to be_falsey
+      expect(enf.enforce('bob', '/book2/1', 'GET')).to be_falsey
+      expect(enf.enforce('bob', '/book2/2', 'GET')).to be_falsey
+      expect(enf.enforce('bob', '/pen2/1', 'GET')).to be_truthy
+      expect(enf.enforce('bob', '/pen2/2', 'GET')).to be_truthy
+    end
+  end
+
+  describe 'abac log enabled' do
+    let(:enf) { described_class.new(model_config('abac')) }
+
+    it '#enforce' do
+      sub = 'alice'
+      obj = { 'Owner' => 'alice', 'id' => 'data1' }
+      expect(enf.enforce(sub, obj, 'write')).to be_truthy
+    end
+  end
+
+  describe 'abac with sub rule' do
+    let(:enf) { described_class.new(model_config('abac_rule'), policy_file('abac_rule')) }
+
+    it '#enforce' do
+      sub1 = { 'name' => 'alice', 'age' => 16 }
+      sub2 = { 'name' => 'bob', 'age' => 20 }
+      sub3 = { 'name' => 'alice', 'age' => 65 }
+
+      expect(enf.enforce(sub1, '/data1', 'read')).to be_falsey
+      expect(enf.enforce(sub1, '/data2', 'read')).to be_falsey
+      expect(enf.enforce(sub1, '/data1', 'write')).to be_falsey
+      expect(enf.enforce(sub1, '/data2', 'write')).to be_truthy
+
+      expect(enf.enforce(sub2, '/data1', 'read')).to be_truthy
+      expect(enf.enforce(sub2, '/data2', 'read')).to be_falsey
+      expect(enf.enforce(sub2, '/data1', 'write')).to be_falsey
+      expect(enf.enforce(sub2, '/data2', 'write')).to be_truthy
+
+      expect(enf.enforce(sub3, '/data1', 'read')).to be_truthy
+      expect(enf.enforce(sub3, '/data2', 'read')).to be_falsey
+      expect(enf.enforce(sub3, '/data1', 'write')).to be_falsey
+      expect(enf.enforce(sub3, '/data2', 'write')).to be_falsey
+    end
+  end
+
+  describe 'abac with multiple sub rules' do
+    let(:enf) { described_class.new(model_config('abac_multiple_rules'), policy_file('abac_multiple_rules')) }
+
+    it '#enforce' do
+      sub1 = { 'name' => 'alice', 'age' => 16 }
+      sub2 = { 'name' => 'bob', 'age' => 20 }
+      sub3 = { 'name' => 'alice', 'age' => 65 }
+      sub4 = { 'name' => 'bob', 'age' => 35 }
+
+      expect(enf.enforce(sub1, '/data1', 'read')).to be_falsey
+      expect(enf.enforce(sub1, '/data2', 'read')).to be_falsey
+      expect(enf.enforce(sub1, '/data1', 'write')).to be_falsey
+      expect(enf.enforce(sub1, '/data2', 'write')).to be_falsey
+
+      expect(enf.enforce(sub2, '/data1', 'read')).to be_falsey
+      expect(enf.enforce(sub2, '/data2', 'read')).to be_falsey
+      expect(enf.enforce(sub2, '/data1', 'write')).to be_falsey
+      expect(enf.enforce(sub2, '/data2', 'write')).to be_truthy
+
+      expect(enf.enforce(sub3, '/data1', 'read')).to be_truthy
+      expect(enf.enforce(sub3, '/data2', 'read')).to be_falsey
+      expect(enf.enforce(sub3, '/data1', 'write')).to be_falsey
+      expect(enf.enforce(sub3, '/data2', 'write')).to be_falsey
+
+      expect(enf.enforce(sub4, '/data1', 'read')).to be_falsey
+      expect(enf.enforce(sub4, '/data2', 'read')).to be_falsey
+      expect(enf.enforce(sub4, '/data1', 'write')).to be_falsey
+      expect(enf.enforce(sub4, '/data2', 'write')).to be_truthy
+    end
+  end
+end

data/spec/casbin/model/function_map_spec.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require 'casbin-ruby/model/function_map'
+require 'casbin-ruby/util/builtin_operators'
+
+describe Casbin::Model::FunctionMap do
+  describe '#load_function_map' do
+    let(:fm) { described_class.load_function_map.fm }
+    let(:args) { ['abc'] }
+
+    it 'returns function map' do
+      {
+        'keyMatch' => :key_match_func,
+        'keyMatch2' => :key_match2_func,
+        'regexMatch' => :regex_match_func,
+        'ipMatch' => :ip_match_func,
+        'globMatch' => :glob_match_func
+      }.each do |key, meth|
+        f = fm[key]
+        expect(f).to be_a Proc
+        expect(f).to be_lambda
+
+        expect(Casbin::Util::BuiltinOperators).to receive(meth).with(*args)
+        f.call(*args)
+      end
+    end
+  end
+end

data/spec/casbin/rbac/default_role_manager/role_manager_spec.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require 'logger'
+require 'casbin-ruby/rbac/default_role_manager/role_manager'
+require 'casbin-ruby/util/builtin_operators'
+
+describe Casbin::Rbac::DefaultRoleManager::RoleManager do
+  let(:role_manager) { described_class.new(1) }
+
+  it '#add_matching_func' do
+    role_manager.add_matching_func(-> { 'simple' })
+    expect(role_manager.matching_func).not_to be_nil
+  end
+
+  describe '#create_role' do
+    it 'when no matching_func' do
+      role_manager.create_role('test_role')
+      expect(role_manager.all_roles).to have_key('test_role')
+    end
+
+    it 'when matching_func truthy' do
+      role_manager.add_matching_func(->(_name, _key) { true })
+      role_manager.create_role('test_role')
+      role_manager.create_role('test_role1')
+
+      expect(role_manager.all_roles['test_role1'].has_direct_role('test_role')).to be_truthy
+    end
+
+    it 'when matching_func falsey' do
+      role_manager.add_matching_func(->(_name, _key) { false })
+      role_manager.create_role('test_role')
+      role_manager.create_role('test_role1')
+      expect(role_manager.all_roles['test_role1'].has_direct_role('test_role')).to be_falsey
+    end
+  end
+
+  describe '#has_role' do
+    it 'when no matching_func' do
+      expect(role_manager.has_role('test_role')).to be_falsey
+      role_manager.create_role('test_role')
+      expect(role_manager.has_role('test_role')).to be_truthy
+    end
+
+    it 'when matching_func truthy' do
+      role_manager.add_matching_func(->(_name, _key) { true })
+      role_manager.create_role('test_role')
+      role_manager.create_role('test_role1')
+      expect(role_manager.all_roles['test_role1'].has_direct_role('test_role')).to be_truthy
+    end
+
+    it 'when matching_func falsey' do
+      role_manager.add_matching_func(->(_name, _key) { false })
+      role_manager.create_role('test_role')
+      role_manager.create_role('test_role1')
+      expect(role_manager.all_roles['test_role1'].has_direct_role('test_role')).to be_falsey
+    end
+  end
+
+  it '#clear' do
+    role_manager.create_role('test_role')
+    expect(role_manager.all_roles).not_to be_empty
+
+    role_manager.clear
+    expect(role_manager.all_roles).to be_empty
+  end
+
+  it '#add_link' do
+    role_manager.add_link('test1', 'test2', 'domain')
+    expect(role_manager.has_role('domain::test1')).to be_truthy
+    expect(role_manager.all_roles['domain::test1'].has_direct_role('domain::test2')).to be_truthy
+  end
+
+  it '#delete_link' do
+    role_manager.add_link('test1', 'test2', 'domain')
+    role_manager.delete_link('test1', 'test2', 'domain')
+    expect(role_manager.all_roles['domain::test1'].has_direct_role('domain::test2')).to be_falsey
+  end
+
+  describe '#has_link' do
+    it 'when same name' do
+      expect(role_manager.has_link('test1', 'test1', 'domain')).to be_truthy
+    end
+
+    it 'when not have role' do
+      expect(role_manager.has_link('test1', 'test2', 'domain')).to be_falsey
+    end
+
+    it 'when have role' do
+      role_manager.add_link('test1', 'test2', 'domain')
+      expect(role_manager.has_link('test1', 'test2', 'domain')).to be_truthy
+    end
+
+    context 'with matching function' do
+      before do
+        role_manager.add_matching_func ->(key1, key2) { Casbin::Util::BuiltinOperators.key_match2 key1, key2 }
+        role_manager.add_link '/book/:id', 'book_admin'
+      end
+
+      it 'correctly matches' do
+        expect(role_manager.has_link('/book/1', 'book_admin')).to be_truthy
+        expect(role_manager.has_link('/book/2', 'book_admin')).to be_truthy
+        expect(role_manager.has_link('/other/1', 'book_admin')).to be_falsey
+      end
+    end
+  end
+
+  it '#get_roles' do
+    role_manager.create_role('test_role')
+    role_manager.create_role('test_rol1')
+    role_manager.all_roles['test_role'].add_role(role_manager.create_role('test_role'))
+    role_manager.all_roles['test_rol1'].add_role(role_manager.create_role('test_role'))
+    roles = role_manager.get_roles('test_role')
+    expect(roles.size).to eq 1
+    expect(roles[0]).to eq 'test_role'
+  end
+
+  it '#get_users' do
+    role_manager.create_role('test_role')
+    role_manager.create_role('test_role1')
+    role_manager.all_roles['test_role'].add_role(role_manager.create_role('test_role'))
+    role_manager.all_roles['test_role1'].add_role(role_manager.create_role('test_role'))
+    expect(role_manager.get_users('test_role')).to match_array(%w[test_role test_role1])
+  end
+
+  it '#print_roles' do
+    role_manager.create_role('test_role')
+    role_manager.create_role('test_rol2')
+    allow(Logger).to receive(:info).with('test_role, test_rol2')
+    role_manager.print_roles
+  end
+end