casbin 5.15.0 → 5.16.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +21 -0
- package/lib/cjs/coreEnforcer.js +5 -3
- package/lib/cjs/effect/defaultEffectorStream.d.ts +2 -1
- package/lib/cjs/effect/defaultEffectorStream.js +10 -1
- package/lib/cjs/effect/effectorStream.d.ts +1 -1
- package/lib/cjs/index.js +13 -1
- package/lib/cjs/model/assertion.js +20 -1
- package/lib/cjs/model/functionMap.js +20 -1
- package/lib/cjs/model/model.js +20 -1
- package/lib/cjs/persist/helper.js +5 -2
- package/lib/cjs/rbac/defaultRoleManager.d.ts +1 -0
- package/lib/cjs/rbac/defaultRoleManager.js +4 -1
- package/lib/cjs/rbac/roleManager.d.ts +1 -0
- package/lib/cjs/syncedEnforcer.js +4 -1
- package/lib/cjs/util/builtinOperators.d.ts +2 -1
- package/lib/cjs/util/builtinOperators.js +34 -4
- package/lib/cjs/util/util.js +20 -1
- package/lib/esm/coreEnforcer.js +6 -4
- package/lib/esm/effect/defaultEffectorStream.d.ts +2 -1
- package/lib/esm/effect/defaultEffectorStream.js +10 -1
- package/lib/esm/effect/effectorStream.d.ts +1 -1
- package/lib/esm/persist/helper.js +1 -1
- package/lib/esm/rbac/defaultRoleManager.d.ts +1 -0
- package/lib/esm/rbac/defaultRoleManager.js +4 -1
- package/lib/esm/rbac/roleManager.d.ts +1 -0
- package/lib/esm/util/builtinOperators.d.ts +2 -1
- package/lib/esm/util/builtinOperators.js +33 -4
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,24 @@
|
|
|
1
|
+
# [5.16.0](https://github.com/casbin/node-casbin/compare/v5.15.2...v5.16.0) (2022-08-11)
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
### Features
|
|
5
|
+
|
|
6
|
+
* add support for g() in SyncedEnforcer ([#378](https://github.com/casbin/node-casbin/issues/378)) ([a74067a](https://github.com/casbin/node-casbin/commit/a74067a66aec755e89bd32964e9da4252c117881))
|
|
7
|
+
|
|
8
|
+
## [5.15.2](https://github.com/casbin/node-casbin/compare/v5.15.1...v5.15.2) (2022-06-22)
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
### Bug Fixes
|
|
12
|
+
|
|
13
|
+
* enable esModuleInterop support ([#366](https://github.com/casbin/node-casbin/issues/366)) ([20db339](https://github.com/casbin/node-casbin/commit/20db3390ef70656b8e06a6738d4c377b4dbe5017))
|
|
14
|
+
|
|
15
|
+
## [5.15.1](https://github.com/casbin/node-casbin/compare/v5.15.0...v5.15.1) (2022-04-27)
|
|
16
|
+
|
|
17
|
+
|
|
18
|
+
### Bug Fixes
|
|
19
|
+
|
|
20
|
+
* EnforceEx return allow reason ([#363](https://github.com/casbin/node-casbin/issues/363)) ([6353283](https://github.com/casbin/node-casbin/commit/635328328caf200093e89443d32e9f2fa736509a))
|
|
21
|
+
|
|
1
22
|
# [5.15.0](https://github.com/casbin/node-casbin/compare/v5.14.0...v5.15.0) (2022-04-15)
|
|
2
23
|
|
|
3
24
|
|
package/lib/cjs/coreEnforcer.js
CHANGED
|
@@ -324,7 +324,7 @@ class CoreEnforcer {
|
|
|
324
324
|
const astMap = this.model.model.get('g');
|
|
325
325
|
astMap === null || astMap === void 0 ? void 0 : astMap.forEach((value, key) => {
|
|
326
326
|
const rm = value.rm;
|
|
327
|
-
functions[key] = util_1.generateGFunction(rm);
|
|
327
|
+
functions[key] = asyncCompile ? util_1.generateGFunction(rm) : util_1.generateSyncedGFunction(rm);
|
|
328
328
|
});
|
|
329
329
|
const expString = (_b = (_a = this.model.model.get('m')) === null || _a === void 0 ? void 0 : _a.get('m')) === null || _b === void 0 ? void 0 : _b.value;
|
|
330
330
|
if (!expString) {
|
|
@@ -410,9 +410,11 @@ class CoreEnforcer {
|
|
|
410
410
|
eftRes = effect_1.Effect.Indeterminate;
|
|
411
411
|
}
|
|
412
412
|
}
|
|
413
|
-
const [res, done] = effectStream.pushEffect(eftRes);
|
|
414
|
-
if (
|
|
413
|
+
const [res, rec, done] = effectStream.pushEffect(eftRes);
|
|
414
|
+
if (rec) {
|
|
415
415
|
explainIndex = i;
|
|
416
|
+
}
|
|
417
|
+
if (done) {
|
|
416
418
|
break;
|
|
417
419
|
}
|
|
418
420
|
}
|
|
@@ -6,8 +6,9 @@ import { Effect } from './effector';
|
|
|
6
6
|
export declare class DefaultEffectorStream implements EffectorStream {
|
|
7
7
|
private done;
|
|
8
8
|
private res;
|
|
9
|
+
private rec;
|
|
9
10
|
private readonly expr;
|
|
10
11
|
constructor(expr: string);
|
|
11
12
|
current(): boolean;
|
|
12
|
-
pushEffect(eft: Effect): [boolean, boolean];
|
|
13
|
+
pushEffect(eft: Effect): [boolean, boolean, boolean];
|
|
13
14
|
}
|
|
@@ -22,6 +22,7 @@ class DefaultEffectorStream {
|
|
|
22
22
|
constructor(expr) {
|
|
23
23
|
this.done = false;
|
|
24
24
|
this.res = false;
|
|
25
|
+
this.rec = false;
|
|
25
26
|
this.expr = expr;
|
|
26
27
|
}
|
|
27
28
|
current() {
|
|
@@ -33,6 +34,7 @@ class DefaultEffectorStream {
|
|
|
33
34
|
if (eft === effector_1.Effect.Allow) {
|
|
34
35
|
this.res = true;
|
|
35
36
|
this.done = true;
|
|
37
|
+
this.rec = true;
|
|
36
38
|
}
|
|
37
39
|
break;
|
|
38
40
|
case '!some(where (p_eft == deny))':
|
|
@@ -40,27 +42,34 @@ class DefaultEffectorStream {
|
|
|
40
42
|
if (eft === effector_1.Effect.Deny) {
|
|
41
43
|
this.res = false;
|
|
42
44
|
this.done = true;
|
|
45
|
+
this.rec = true;
|
|
43
46
|
}
|
|
44
47
|
break;
|
|
45
48
|
case 'some(where (p_eft == allow)) && !some(where (p_eft == deny))':
|
|
46
49
|
if (eft === effector_1.Effect.Allow) {
|
|
47
50
|
this.res = true;
|
|
51
|
+
this.rec = true;
|
|
48
52
|
}
|
|
49
53
|
else if (eft === effector_1.Effect.Deny) {
|
|
50
54
|
this.res = false;
|
|
51
55
|
this.done = true;
|
|
56
|
+
this.rec = true;
|
|
57
|
+
}
|
|
58
|
+
else {
|
|
59
|
+
this.rec = false;
|
|
52
60
|
}
|
|
53
61
|
break;
|
|
54
62
|
case 'priority(p_eft) || deny':
|
|
55
63
|
if (eft !== effector_1.Effect.Indeterminate) {
|
|
56
64
|
this.res = eft === effector_1.Effect.Allow;
|
|
57
65
|
this.done = true;
|
|
66
|
+
this.rec = true;
|
|
58
67
|
}
|
|
59
68
|
break;
|
|
60
69
|
default:
|
|
61
70
|
throw new Error('unsupported effect');
|
|
62
71
|
}
|
|
63
|
-
return [this.res, this.done];
|
|
72
|
+
return [this.res, this.rec, this.done];
|
|
64
73
|
}
|
|
65
74
|
}
|
|
66
75
|
exports.DefaultEffectorStream = DefaultEffectorStream;
|
package/lib/cjs/index.js
CHANGED
|
@@ -19,12 +19,24 @@ var __createBinding = (this && this.__createBinding) || (Object.create ? (functi
|
|
|
19
19
|
if (k2 === undefined) k2 = k;
|
|
20
20
|
o[k2] = m[k];
|
|
21
21
|
}));
|
|
22
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
23
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
24
|
+
}) : function(o, v) {
|
|
25
|
+
o["default"] = v;
|
|
26
|
+
});
|
|
27
|
+
var __importStar = (this && this.__importStar) || function (mod) {
|
|
28
|
+
if (mod && mod.__esModule) return mod;
|
|
29
|
+
var result = {};
|
|
30
|
+
if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
|
|
31
|
+
__setModuleDefault(result, mod);
|
|
32
|
+
return result;
|
|
33
|
+
};
|
|
22
34
|
var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
23
35
|
for (var p in m) if (p !== "default" && !exports.hasOwnProperty(p)) __createBinding(exports, m, p);
|
|
24
36
|
};
|
|
25
37
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
26
38
|
exports.Util = void 0;
|
|
27
|
-
const Util = require("./util");
|
|
39
|
+
const Util = __importStar(require("./util"));
|
|
28
40
|
exports.Util = Util;
|
|
29
41
|
__exportStar(require("./config"), exports);
|
|
30
42
|
__exportStar(require("./enforcer"), exports);
|
|
@@ -12,9 +12,28 @@
|
|
|
12
12
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
13
13
|
// See the License for the specific language governing permissions and
|
|
14
14
|
// limitations under the License.
|
|
15
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
16
|
+
if (k2 === undefined) k2 = k;
|
|
17
|
+
Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
|
|
18
|
+
}) : (function(o, m, k, k2) {
|
|
19
|
+
if (k2 === undefined) k2 = k;
|
|
20
|
+
o[k2] = m[k];
|
|
21
|
+
}));
|
|
22
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
23
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
24
|
+
}) : function(o, v) {
|
|
25
|
+
o["default"] = v;
|
|
26
|
+
});
|
|
27
|
+
var __importStar = (this && this.__importStar) || function (mod) {
|
|
28
|
+
if (mod && mod.__esModule) return mod;
|
|
29
|
+
var result = {};
|
|
30
|
+
if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
|
|
31
|
+
__setModuleDefault(result, mod);
|
|
32
|
+
return result;
|
|
33
|
+
};
|
|
15
34
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
35
|
exports.Assertion = void 0;
|
|
17
|
-
const rbac = require("../rbac");
|
|
36
|
+
const rbac = __importStar(require("../rbac"));
|
|
18
37
|
const log_1 = require("../log");
|
|
19
38
|
const model_1 = require("./model");
|
|
20
39
|
// Assertion represents an expression in a section of the model.
|
|
@@ -12,9 +12,28 @@
|
|
|
12
12
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
13
13
|
// See the License for the specific language governing permissions and
|
|
14
14
|
// limitations under the License.
|
|
15
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
16
|
+
if (k2 === undefined) k2 = k;
|
|
17
|
+
Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
|
|
18
|
+
}) : (function(o, m, k, k2) {
|
|
19
|
+
if (k2 === undefined) k2 = k;
|
|
20
|
+
o[k2] = m[k];
|
|
21
|
+
}));
|
|
22
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
23
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
24
|
+
}) : function(o, v) {
|
|
25
|
+
o["default"] = v;
|
|
26
|
+
});
|
|
27
|
+
var __importStar = (this && this.__importStar) || function (mod) {
|
|
28
|
+
if (mod && mod.__esModule) return mod;
|
|
29
|
+
var result = {};
|
|
30
|
+
if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
|
|
31
|
+
__setModuleDefault(result, mod);
|
|
32
|
+
return result;
|
|
33
|
+
};
|
|
15
34
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
35
|
exports.FunctionMap = void 0;
|
|
17
|
-
const util = require("../util");
|
|
36
|
+
const util = __importStar(require("../util"));
|
|
18
37
|
// FunctionMap represents the collection of Function.
|
|
19
38
|
class FunctionMap {
|
|
20
39
|
/**
|
package/lib/cjs/model/model.js
CHANGED
|
@@ -12,9 +12,28 @@
|
|
|
12
12
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
13
13
|
// See the License for the specific language governing permissions and
|
|
14
14
|
// limitations under the License.
|
|
15
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
16
|
+
if (k2 === undefined) k2 = k;
|
|
17
|
+
Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
|
|
18
|
+
}) : (function(o, m, k, k2) {
|
|
19
|
+
if (k2 === undefined) k2 = k;
|
|
20
|
+
o[k2] = m[k];
|
|
21
|
+
}));
|
|
22
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
23
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
24
|
+
}) : function(o, v) {
|
|
25
|
+
o["default"] = v;
|
|
26
|
+
});
|
|
27
|
+
var __importStar = (this && this.__importStar) || function (mod) {
|
|
28
|
+
if (mod && mod.__esModule) return mod;
|
|
29
|
+
var result = {};
|
|
30
|
+
if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
|
|
31
|
+
__setModuleDefault(result, mod);
|
|
32
|
+
return result;
|
|
33
|
+
};
|
|
15
34
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
35
|
exports.newModelFromString = exports.newModelFromFile = exports.newModel = exports.Model = exports.requiredSections = exports.PolicyOp = exports.sectionNameMap = void 0;
|
|
17
|
-
const util = require("../util");
|
|
36
|
+
const util = __importStar(require("../util"));
|
|
18
37
|
const config_1 = require("../config");
|
|
19
38
|
const assertion_1 = require("./assertion");
|
|
20
39
|
const log_1 = require("../log");
|
|
@@ -1,13 +1,16 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
+
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
3
|
+
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
4
|
+
};
|
|
2
5
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
6
|
exports.Helper = void 0;
|
|
4
|
-
const
|
|
7
|
+
const sync_1 = __importDefault(require("csv-parse/lib/sync"));
|
|
5
8
|
class Helper {
|
|
6
9
|
static loadPolicyLine(line, model) {
|
|
7
10
|
if (!line || line.trimStart().charAt(0) === '#') {
|
|
8
11
|
return;
|
|
9
12
|
}
|
|
10
|
-
const tokens =
|
|
13
|
+
const tokens = sync_1.default(line, {
|
|
11
14
|
delimiter: ',',
|
|
12
15
|
skip_empty_lines: true,
|
|
13
16
|
trim: true,
|
|
@@ -53,6 +53,7 @@ export declare class DefaultRoleManager implements RoleManager {
|
|
|
53
53
|
* hasLink determines whether role: name1 inherits role: name2.
|
|
54
54
|
* domain is a prefix to the roles.
|
|
55
55
|
*/
|
|
56
|
+
syncedHasLink(name1: string, name2: string, ...domain: string[]): boolean;
|
|
56
57
|
hasLink(name1: string, name2: string, ...domain: string[]): Promise<boolean>;
|
|
57
58
|
/**
|
|
58
59
|
* getRoles gets the roles that a subject inherits.
|
|
@@ -211,7 +211,7 @@ class DefaultRoleManager {
|
|
|
211
211
|
* hasLink determines whether role: name1 inherits role: name2.
|
|
212
212
|
* domain is a prefix to the roles.
|
|
213
213
|
*/
|
|
214
|
-
|
|
214
|
+
syncedHasLink(name1, name2, ...domain) {
|
|
215
215
|
if (domain.length === 0) {
|
|
216
216
|
domain = [DEFAULT_DOMAIN];
|
|
217
217
|
}
|
|
@@ -234,6 +234,9 @@ class DefaultRoleManager {
|
|
|
234
234
|
const role1 = allRoles.createRole(name1, this.matchingFunc);
|
|
235
235
|
return role1.hasRole(name2, this.maxHierarchyLevel);
|
|
236
236
|
}
|
|
237
|
+
async hasLink(name1, name2, ...domain) {
|
|
238
|
+
return new Promise((resolve) => resolve(this.syncedHasLink(name1, name2, ...domain)));
|
|
239
|
+
}
|
|
237
240
|
/**
|
|
238
241
|
* getRoles gets the roles that a subject inherits.
|
|
239
242
|
* domain is a prefix to the roles.
|
|
@@ -3,6 +3,7 @@ export interface RoleManager {
|
|
|
3
3
|
addLink(name1: string, name2: string, ...domain: string[]): Promise<void>;
|
|
4
4
|
deleteLink(name1: string, name2: string, ...domain: string[]): Promise<void>;
|
|
5
5
|
hasLink(name1: string, name2: string, ...domain: string[]): Promise<boolean>;
|
|
6
|
+
syncedHasLink?(name1: string, name2: string, ...domain: string[]): boolean;
|
|
6
7
|
getRoles(name: string, ...domain: string[]): Promise<string[]>;
|
|
7
8
|
getUsers(name: string, ...domain: string[]): Promise<string[]>;
|
|
8
9
|
printRoles(): Promise<void>;
|
|
@@ -12,10 +12,13 @@
|
|
|
12
12
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
13
13
|
// See the License for the specific language governing permissions and
|
|
14
14
|
// limitations under the License.
|
|
15
|
+
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
16
|
+
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
17
|
+
};
|
|
15
18
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
19
|
exports.newSyncedEnforcer = exports.SyncedEnforcer = void 0;
|
|
17
20
|
const enforcer_1 = require("./enforcer");
|
|
18
|
-
const await_lock_1 = require("await-lock");
|
|
21
|
+
const await_lock_1 = __importDefault(require("await-lock"));
|
|
19
22
|
// SyncedEnforcer wraps Enforcer and provides synchronized access
|
|
20
23
|
class SyncedEnforcer extends enforcer_1.Enforcer {
|
|
21
24
|
constructor() {
|
|
@@ -22,4 +22,5 @@ declare function ipMatchFunc(...args: any[]): boolean;
|
|
|
22
22
|
*/
|
|
23
23
|
declare function globMatch(string: string, pattern: string): boolean;
|
|
24
24
|
declare function generateGFunction(rm: rbac.RoleManager): any;
|
|
25
|
-
|
|
25
|
+
declare function generateSyncedGFunction(rm: rbac.RoleManager): any;
|
|
26
|
+
export { keyMatchFunc, keyGetFunc, keyMatch2Func, keyGet2Func, keyMatch3Func, regexMatchFunc, ipMatchFunc, generateSyncedGFunction, generateGFunction, keyMatch4Func, keyMatch5Func, globMatch, };
|
|
@@ -13,9 +13,9 @@
|
|
|
13
13
|
// See the License for the specific language governing permissions and
|
|
14
14
|
// limitations under the License.
|
|
15
15
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
|
-
exports.globMatch = exports.keyMatch5Func = exports.keyMatch4Func = exports.generateGFunction = exports.ipMatchFunc = exports.regexMatchFunc = exports.keyMatch3Func = exports.keyGet2Func = exports.keyMatch2Func = exports.keyGetFunc = exports.keyMatchFunc = void 0;
|
|
16
|
+
exports.globMatch = exports.keyMatch5Func = exports.keyMatch4Func = exports.generateGFunction = exports.generateSyncedGFunction = exports.ipMatchFunc = exports.regexMatchFunc = exports.keyMatch3Func = exports.keyGet2Func = exports.keyMatch2Func = exports.keyGetFunc = exports.keyMatchFunc = void 0;
|
|
17
17
|
const ip_1 = require("./ip");
|
|
18
|
-
const
|
|
18
|
+
const picomatch_1 = require("picomatch");
|
|
19
19
|
// regexMatch determines whether key1 matches the pattern of key2 in regular expression.
|
|
20
20
|
function regexMatch(key1, key2) {
|
|
21
21
|
return new RegExp(key2).test(key1);
|
|
@@ -271,13 +271,13 @@ exports.ipMatchFunc = ipMatchFunc;
|
|
|
271
271
|
* ```
|
|
272
272
|
*/
|
|
273
273
|
function globMatch(string, pattern) {
|
|
274
|
-
return
|
|
274
|
+
return picomatch_1.isMatch(string, pattern);
|
|
275
275
|
}
|
|
276
276
|
exports.globMatch = globMatch;
|
|
277
277
|
// generateGFunction is the factory method of the g(_, _) function.
|
|
278
278
|
function generateGFunction(rm) {
|
|
279
279
|
const memorized = new Map();
|
|
280
|
-
return async function
|
|
280
|
+
return async function (...args) {
|
|
281
281
|
const key = args.toString();
|
|
282
282
|
let value = memorized.get(key);
|
|
283
283
|
if (value) {
|
|
@@ -301,3 +301,33 @@ function generateGFunction(rm) {
|
|
|
301
301
|
};
|
|
302
302
|
}
|
|
303
303
|
exports.generateGFunction = generateGFunction;
|
|
304
|
+
// generateSyncedGFunction is the synchronous factory method of the g(_, _) function.
|
|
305
|
+
function generateSyncedGFunction(rm) {
|
|
306
|
+
const memorized = new Map();
|
|
307
|
+
return function (...args) {
|
|
308
|
+
const key = args.toString();
|
|
309
|
+
let value = memorized.get(key);
|
|
310
|
+
if (value) {
|
|
311
|
+
return value;
|
|
312
|
+
}
|
|
313
|
+
const [arg0, arg1] = args;
|
|
314
|
+
const name1 = (arg0 || '').toString();
|
|
315
|
+
const name2 = (arg1 || '').toString();
|
|
316
|
+
if (!rm) {
|
|
317
|
+
value = name1 === name2;
|
|
318
|
+
}
|
|
319
|
+
else if (!(rm === null || rm === void 0 ? void 0 : rm.syncedHasLink)) {
|
|
320
|
+
throw new Error('RoleManager requires syncedHasLink for synchronous execution');
|
|
321
|
+
}
|
|
322
|
+
else if (args.length === 2) {
|
|
323
|
+
value = rm.syncedHasLink(name1, name2);
|
|
324
|
+
}
|
|
325
|
+
else {
|
|
326
|
+
const domain = args[2].toString();
|
|
327
|
+
value = rm.syncedHasLink(name1, name2, domain);
|
|
328
|
+
}
|
|
329
|
+
memorized.set(key, value);
|
|
330
|
+
return value;
|
|
331
|
+
};
|
|
332
|
+
}
|
|
333
|
+
exports.generateSyncedGFunction = generateSyncedGFunction;
|
package/lib/cjs/util/util.js
CHANGED
|
@@ -12,9 +12,28 @@
|
|
|
12
12
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
13
13
|
// See the License for the specific language governing permissions and
|
|
14
14
|
// limitations under the License.
|
|
15
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
16
|
+
if (k2 === undefined) k2 = k;
|
|
17
|
+
Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
|
|
18
|
+
}) : (function(o, m, k, k2) {
|
|
19
|
+
if (k2 === undefined) k2 = k;
|
|
20
|
+
o[k2] = m[k];
|
|
21
|
+
}));
|
|
22
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
23
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
24
|
+
}) : function(o, v) {
|
|
25
|
+
o["default"] = v;
|
|
26
|
+
});
|
|
27
|
+
var __importStar = (this && this.__importStar) || function (mod) {
|
|
28
|
+
if (mod && mod.__esModule) return mod;
|
|
29
|
+
var result = {};
|
|
30
|
+
if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
|
|
31
|
+
__setModuleDefault(result, mod);
|
|
32
|
+
return result;
|
|
33
|
+
};
|
|
15
34
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
35
|
exports.bracketCompatible = exports.customIn = exports.deepCopy = exports.generatorRunAsync = exports.generatorRunSync = exports.getEvalValue = exports.replaceEval = exports.hasEval = exports.writeFile = exports.readFile = exports.setEquals = exports.paramsToString = exports.arrayToString = exports.arrayRemoveDuplicates = exports.array2DEquals = exports.arrayEquals = exports.removeComments = exports.escapeAssertion = void 0;
|
|
17
|
-
const fs = require("fs");
|
|
36
|
+
const fs = __importStar(require("fs"));
|
|
18
37
|
// escapeAssertion escapes the dots in the assertion,
|
|
19
38
|
// because the expression evaluation doesn't support such variable names.
|
|
20
39
|
function escapeAssertion(s) {
|
package/lib/esm/coreEnforcer.js
CHANGED
|
@@ -15,7 +15,7 @@ import { compile, compileAsync, addBinaryOp } from 'expression-eval';
|
|
|
15
15
|
import { DefaultEffector, Effect } from './effect';
|
|
16
16
|
import { FunctionMap, newModel } from './model';
|
|
17
17
|
import { DefaultRoleManager } from './rbac';
|
|
18
|
-
import { escapeAssertion, generateGFunction, getEvalValue, hasEval, replaceEval, generatorRunSync, generatorRunAsync, customIn, bracketCompatible, } from './util';
|
|
18
|
+
import { escapeAssertion, generateGFunction, generateSyncedGFunction, getEvalValue, hasEval, replaceEval, generatorRunSync, generatorRunAsync, customIn, bracketCompatible, } from './util';
|
|
19
19
|
import { getLogger, logPrint } from './log';
|
|
20
20
|
/**
|
|
21
21
|
* CoreEnforcer defines the core functionality of an enforcer.
|
|
@@ -321,7 +321,7 @@ export class CoreEnforcer {
|
|
|
321
321
|
const astMap = this.model.model.get('g');
|
|
322
322
|
astMap === null || astMap === void 0 ? void 0 : astMap.forEach((value, key) => {
|
|
323
323
|
const rm = value.rm;
|
|
324
|
-
functions[key] = generateGFunction(rm);
|
|
324
|
+
functions[key] = asyncCompile ? generateGFunction(rm) : generateSyncedGFunction(rm);
|
|
325
325
|
});
|
|
326
326
|
const expString = (_b = (_a = this.model.model.get('m')) === null || _a === void 0 ? void 0 : _a.get('m')) === null || _b === void 0 ? void 0 : _b.value;
|
|
327
327
|
if (!expString) {
|
|
@@ -407,9 +407,11 @@ export class CoreEnforcer {
|
|
|
407
407
|
eftRes = Effect.Indeterminate;
|
|
408
408
|
}
|
|
409
409
|
}
|
|
410
|
-
const [res, done] = effectStream.pushEffect(eftRes);
|
|
411
|
-
if (
|
|
410
|
+
const [res, rec, done] = effectStream.pushEffect(eftRes);
|
|
411
|
+
if (rec) {
|
|
412
412
|
explainIndex = i;
|
|
413
|
+
}
|
|
414
|
+
if (done) {
|
|
413
415
|
break;
|
|
414
416
|
}
|
|
415
417
|
}
|
|
@@ -6,8 +6,9 @@ import { Effect } from './effector';
|
|
|
6
6
|
export declare class DefaultEffectorStream implements EffectorStream {
|
|
7
7
|
private done;
|
|
8
8
|
private res;
|
|
9
|
+
private rec;
|
|
9
10
|
private readonly expr;
|
|
10
11
|
constructor(expr: string);
|
|
11
12
|
current(): boolean;
|
|
12
|
-
pushEffect(eft: Effect): [boolean, boolean];
|
|
13
|
+
pushEffect(eft: Effect): [boolean, boolean, boolean];
|
|
13
14
|
}
|
|
@@ -19,6 +19,7 @@ export class DefaultEffectorStream {
|
|
|
19
19
|
constructor(expr) {
|
|
20
20
|
this.done = false;
|
|
21
21
|
this.res = false;
|
|
22
|
+
this.rec = false;
|
|
22
23
|
this.expr = expr;
|
|
23
24
|
}
|
|
24
25
|
current() {
|
|
@@ -30,6 +31,7 @@ export class DefaultEffectorStream {
|
|
|
30
31
|
if (eft === Effect.Allow) {
|
|
31
32
|
this.res = true;
|
|
32
33
|
this.done = true;
|
|
34
|
+
this.rec = true;
|
|
33
35
|
}
|
|
34
36
|
break;
|
|
35
37
|
case '!some(where (p_eft == deny))':
|
|
@@ -37,26 +39,33 @@ export class DefaultEffectorStream {
|
|
|
37
39
|
if (eft === Effect.Deny) {
|
|
38
40
|
this.res = false;
|
|
39
41
|
this.done = true;
|
|
42
|
+
this.rec = true;
|
|
40
43
|
}
|
|
41
44
|
break;
|
|
42
45
|
case 'some(where (p_eft == allow)) && !some(where (p_eft == deny))':
|
|
43
46
|
if (eft === Effect.Allow) {
|
|
44
47
|
this.res = true;
|
|
48
|
+
this.rec = true;
|
|
45
49
|
}
|
|
46
50
|
else if (eft === Effect.Deny) {
|
|
47
51
|
this.res = false;
|
|
48
52
|
this.done = true;
|
|
53
|
+
this.rec = true;
|
|
54
|
+
}
|
|
55
|
+
else {
|
|
56
|
+
this.rec = false;
|
|
49
57
|
}
|
|
50
58
|
break;
|
|
51
59
|
case 'priority(p_eft) || deny':
|
|
52
60
|
if (eft !== Effect.Indeterminate) {
|
|
53
61
|
this.res = eft === Effect.Allow;
|
|
54
62
|
this.done = true;
|
|
63
|
+
this.rec = true;
|
|
55
64
|
}
|
|
56
65
|
break;
|
|
57
66
|
default:
|
|
58
67
|
throw new Error('unsupported effect');
|
|
59
68
|
}
|
|
60
|
-
return [this.res, this.done];
|
|
69
|
+
return [this.res, this.rec, this.done];
|
|
61
70
|
}
|
|
62
71
|
}
|
|
@@ -53,6 +53,7 @@ export declare class DefaultRoleManager implements RoleManager {
|
|
|
53
53
|
* hasLink determines whether role: name1 inherits role: name2.
|
|
54
54
|
* domain is a prefix to the roles.
|
|
55
55
|
*/
|
|
56
|
+
syncedHasLink(name1: string, name2: string, ...domain: string[]): boolean;
|
|
56
57
|
hasLink(name1: string, name2: string, ...domain: string[]): Promise<boolean>;
|
|
57
58
|
/**
|
|
58
59
|
* getRoles gets the roles that a subject inherits.
|
|
@@ -208,7 +208,7 @@ export class DefaultRoleManager {
|
|
|
208
208
|
* hasLink determines whether role: name1 inherits role: name2.
|
|
209
209
|
* domain is a prefix to the roles.
|
|
210
210
|
*/
|
|
211
|
-
|
|
211
|
+
syncedHasLink(name1, name2, ...domain) {
|
|
212
212
|
if (domain.length === 0) {
|
|
213
213
|
domain = [DEFAULT_DOMAIN];
|
|
214
214
|
}
|
|
@@ -231,6 +231,9 @@ export class DefaultRoleManager {
|
|
|
231
231
|
const role1 = allRoles.createRole(name1, this.matchingFunc);
|
|
232
232
|
return role1.hasRole(name2, this.maxHierarchyLevel);
|
|
233
233
|
}
|
|
234
|
+
async hasLink(name1, name2, ...domain) {
|
|
235
|
+
return new Promise((resolve) => resolve(this.syncedHasLink(name1, name2, ...domain)));
|
|
236
|
+
}
|
|
234
237
|
/**
|
|
235
238
|
* getRoles gets the roles that a subject inherits.
|
|
236
239
|
* domain is a prefix to the roles.
|
|
@@ -3,6 +3,7 @@ export interface RoleManager {
|
|
|
3
3
|
addLink(name1: string, name2: string, ...domain: string[]): Promise<void>;
|
|
4
4
|
deleteLink(name1: string, name2: string, ...domain: string[]): Promise<void>;
|
|
5
5
|
hasLink(name1: string, name2: string, ...domain: string[]): Promise<boolean>;
|
|
6
|
+
syncedHasLink?(name1: string, name2: string, ...domain: string[]): boolean;
|
|
6
7
|
getRoles(name: string, ...domain: string[]): Promise<string[]>;
|
|
7
8
|
getUsers(name: string, ...domain: string[]): Promise<string[]>;
|
|
8
9
|
printRoles(): Promise<void>;
|
|
@@ -22,4 +22,5 @@ declare function ipMatchFunc(...args: any[]): boolean;
|
|
|
22
22
|
*/
|
|
23
23
|
declare function globMatch(string: string, pattern: string): boolean;
|
|
24
24
|
declare function generateGFunction(rm: rbac.RoleManager): any;
|
|
25
|
-
|
|
25
|
+
declare function generateSyncedGFunction(rm: rbac.RoleManager): any;
|
|
26
|
+
export { keyMatchFunc, keyGetFunc, keyMatch2Func, keyGet2Func, keyMatch3Func, regexMatchFunc, ipMatchFunc, generateSyncedGFunction, generateGFunction, keyMatch4Func, keyMatch5Func, globMatch, };
|
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
// See the License for the specific language governing permissions and
|
|
13
13
|
// limitations under the License.
|
|
14
14
|
import { ip } from './ip';
|
|
15
|
-
import
|
|
15
|
+
import { isMatch } from 'picomatch';
|
|
16
16
|
// regexMatch determines whether key1 matches the pattern of key2 in regular expression.
|
|
17
17
|
function regexMatch(key1, key2) {
|
|
18
18
|
return new RegExp(key2).test(key1);
|
|
@@ -259,12 +259,12 @@ function ipMatchFunc(...args) {
|
|
|
259
259
|
* ```
|
|
260
260
|
*/
|
|
261
261
|
function globMatch(string, pattern) {
|
|
262
|
-
return
|
|
262
|
+
return isMatch(string, pattern);
|
|
263
263
|
}
|
|
264
264
|
// generateGFunction is the factory method of the g(_, _) function.
|
|
265
265
|
function generateGFunction(rm) {
|
|
266
266
|
const memorized = new Map();
|
|
267
|
-
return async function
|
|
267
|
+
return async function (...args) {
|
|
268
268
|
const key = args.toString();
|
|
269
269
|
let value = memorized.get(key);
|
|
270
270
|
if (value) {
|
|
@@ -287,4 +287,33 @@ function generateGFunction(rm) {
|
|
|
287
287
|
return value;
|
|
288
288
|
};
|
|
289
289
|
}
|
|
290
|
-
|
|
290
|
+
// generateSyncedGFunction is the synchronous factory method of the g(_, _) function.
|
|
291
|
+
function generateSyncedGFunction(rm) {
|
|
292
|
+
const memorized = new Map();
|
|
293
|
+
return function (...args) {
|
|
294
|
+
const key = args.toString();
|
|
295
|
+
let value = memorized.get(key);
|
|
296
|
+
if (value) {
|
|
297
|
+
return value;
|
|
298
|
+
}
|
|
299
|
+
const [arg0, arg1] = args;
|
|
300
|
+
const name1 = (arg0 || '').toString();
|
|
301
|
+
const name2 = (arg1 || '').toString();
|
|
302
|
+
if (!rm) {
|
|
303
|
+
value = name1 === name2;
|
|
304
|
+
}
|
|
305
|
+
else if (!(rm === null || rm === void 0 ? void 0 : rm.syncedHasLink)) {
|
|
306
|
+
throw new Error('RoleManager requires syncedHasLink for synchronous execution');
|
|
307
|
+
}
|
|
308
|
+
else if (args.length === 2) {
|
|
309
|
+
value = rm.syncedHasLink(name1, name2);
|
|
310
|
+
}
|
|
311
|
+
else {
|
|
312
|
+
const domain = args[2].toString();
|
|
313
|
+
value = rm.syncedHasLink(name1, name2, domain);
|
|
314
|
+
}
|
|
315
|
+
memorized.set(key, value);
|
|
316
|
+
return value;
|
|
317
|
+
};
|
|
318
|
+
}
|
|
319
|
+
export { keyMatchFunc, keyGetFunc, keyMatch2Func, keyGet2Func, keyMatch3Func, regexMatchFunc, ipMatchFunc, generateSyncedGFunction, generateGFunction, keyMatch4Func, keyMatch5Func, globMatch, };
|
package/package.json
CHANGED