casbin 5.41.0 → 5.43.0

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+# [5.43.0](https://github.com/casbin/node-casbin/compare/v5.42.0...v5.43.0) (2025-12-08)
+
+
+### Features
+
+* add no-policy ABAC example and test ([#523](https://github.com/casbin/node-casbin/issues/523)) ([d982c05](https://github.com/casbin/node-casbin/commit/d982c058ef098716dbc5c7d4b218cc19950421a8))
+
+# [5.42.0](https://github.com/casbin/node-casbin/compare/v5.41.0...v5.42.0) (2025-12-08)
+
+
+### Features
+
+* configure CI workflow to trigger on master branch ([#521](https://github.com/casbin/node-casbin/issues/521)) ([02ec045](https://github.com/casbin/node-casbin/commit/02ec04525b95691ff5f9b76e6b42ade194e9745f))
+* fix duplicate CI runs on pull requests ([#513](https://github.com/casbin/node-casbin/issues/513)) ([67ab8ee](https://github.com/casbin/node-casbin/commit/67ab8ee43a8b695d11dd73558a0c0cf0348756a7))
+* fix escapeAssertion to preserve string literals ([#514](https://github.com/casbin/node-casbin/issues/514)) ([7801732](https://github.com/casbin/node-casbin/commit/7801732d5f050093a2d844917c7ad9862af78bd2))
+* Support multiple policy definitions (p, p2) ([#518](https://github.com/casbin/node-casbin/issues/518)) ([1b1f1bb](https://github.com/casbin/node-casbin/commit/1b1f1bb181ea6c5bb43c330802a435d93f2fa2f0))
+
 # [5.41.0](https://github.com/casbin/node-casbin/compare/v5.40.0...v5.41.0) (2025-11-11)
 
 

package/examples/abac_not_using_policy_model.conf

@@ -0,0 +1,11 @@
+[request_definition]
+r = sub, obj, act
+
+[policy_definition]
+p = sub, obj, act, eft
+
+[policy_effect]
+e = some(where (p.eft == allow)) && !some(where (p.eft == deny))
+
+[matchers]
+m = r.sub == r.obj.Owner

package/examples/abac_rule_effect_policy.csv

@@ -0,0 +1,4 @@
+p, alice, /data1, read, deny
+p, alice, /data1, write, allow
+p, bob, /data2, write, deny
+p, bob, /data2, read, allow

package/examples/multiple_policy_definitions_model.conf

@@ -0,0 +1,19 @@
+[request_definition]
+r = sub, obj, act
+r2 = sub, obj, act
+
+[policy_definition]
+p = sub, obj, act
+p2= sub_rule, obj, act, eft
+
+[role_definition]
+g = _, _
+
+[policy_effect]
+e = some(where (p.eft == allow))
+
+[matchers]
+#RABC
+m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act
+#ABAC
+m2 = eval(p2.sub_rule) && r2.obj == p2.obj && r2.act == p2.act

package/examples/multiple_policy_definitions_policy.csv

@@ -0,0 +1,5 @@
+p, data2_admin, data2, read
+p2, r2.sub.Age > 18 && r2.sub.Age < 60, /data1, read, allow
+p2, r2.sub.Age > 60 && r2.sub.Age < 100, /data1, read, deny
+
+g, alice, data2_admin

package/examples/rbac_with_multiple_policy_model.conf

@@ -0,0 +1,17 @@
+[request_definition]
+r = user, thing, action
+
+[policy_definition]
+p = role, thing, action
+p2 = role, action
+
+[policy_effect]
+e = some(where (p.eft == allow))
+
+[matchers]
+m = g(r.user, p.role) && r.thing == p.thing && r.action == p.action
+m2 = g(r.user, p2.role) && r.action == p.action
+
+[role_definition]
+g = _,_
+g2 = _,_

package/examples/rbac_with_multiple_policy_policy.csv

@@ -0,0 +1,9 @@
+p, user, /data, GET
+p, admin, /data, POST
+
+p2, user, view
+p2, admin, create
+
+g, admin, user
+g, alice, admin
+g2, alice, user

package/lib/cjs/coreEnforcer.js

@@ -396,7 +396,7 @@ class CoreEnforcer {
         const rTokens = (_h = (_g = this.model.model.get('r')) === null || _g === void 0 ? void 0 : _g.get(enforceContext.rType)) === null || _h === void 0 ? void 0 : _h.tokens;
         const rTokensLen = rTokens === null || rTokens === void 0 ? void 0 : rTokens.length;
         const effectStream = this.eft.newStream(effectExpr);
-        if (policyLen && policyLen !== 0) {
+        if (policyLen && policyLen !== 0 && expString.includes(`${enforceContext.pType}_`)) {
             for (let i = 0; i < policyLen; i++) {
                 const parameters = {};
                 if ((rTokens === null || rTokens === void 0 ? void 0 : rTokens.length) !== rvals.length) {

package/lib/cjs/util/util.js

@@ -17,10 +17,15 @@ exports.bracketCompatible = exports.customIn = exports.deepCopy = exports.genera
 // escapeAssertion escapes the dots in the assertion,
 // because the expression evaluation doesn't support such variable names.
 const persist_1 = require("../persist");
-const escapeAssertionReg = new RegExp(/(^|[^A-Za-z0-9_])([rp])[0-9]*\./g);
+const escapeAssertionReg = new RegExp(/([()\s|&,=!><+\-*/]|^)((r|p)[0-9]*)\./g);
 function escapeAssertion(s) {
-    s = s.replace(escapeAssertionReg, (match, p1, p2) => {
-        return p1 + p2 + match.substring(p1.length + p2.length).replace('.', '_');
+    s = s.replace(escapeAssertionReg, (match) => {
+        // Replace only the last dot with underscore (preserve the prefix character)
+        const lastDotIdx = match.lastIndexOf('.');
+        if (lastDotIdx > 0) {
+            return match.substring(0, lastDotIdx) + '_';
+        }
+        return match;
     });
     return s;
 }

package/lib/esm/coreEnforcer.js

@@ -393,7 +393,7 @@ export class CoreEnforcer {
         const rTokens = (_h = (_g = this.model.model.get('r')) === null || _g === void 0 ? void 0 : _g.get(enforceContext.rType)) === null || _h === void 0 ? void 0 : _h.tokens;
         const rTokensLen = rTokens === null || rTokens === void 0 ? void 0 : rTokens.length;
         const effectStream = this.eft.newStream(effectExpr);
-        if (policyLen && policyLen !== 0) {
+        if (policyLen && policyLen !== 0 && expString.includes(`${enforceContext.pType}_`)) {
             for (let i = 0; i < policyLen; i++) {
                 const parameters = {};
                 if ((rTokens === null || rTokens === void 0 ? void 0 : rTokens.length) !== rvals.length) {

package/lib/esm/util/util.js

@@ -14,10 +14,15 @@
 // escapeAssertion escapes the dots in the assertion,
 // because the expression evaluation doesn't support such variable names.
 import { mustGetDefaultFileSystem } from '../persist';
-const escapeAssertionReg = new RegExp(/(^|[^A-Za-z0-9_])([rp])[0-9]*\./g);
+const escapeAssertionReg = new RegExp(/([()\s|&,=!><+\-*/]|^)((r|p)[0-9]*)\./g);
 function escapeAssertion(s) {
-    s = s.replace(escapeAssertionReg, (match, p1, p2) => {
-        return p1 + p2 + match.substring(p1.length + p2.length).replace('.', '_');
+    s = s.replace(escapeAssertionReg, (match) => {
+        // Replace only the last dot with underscore (preserve the prefix character)
+        const lastDotIdx = match.lastIndexOf('.');
+        if (lastDotIdx > 0) {
+            return match.substring(0, lastDotIdx) + '_';
+        }
+        return match;
     });
     return s;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "casbin",
-  "version": "5.41.0",
+  "version": "5.43.0",
   "description": "An authorization library that supports access control models like ACL, RBAC, ABAC in Node.JS",
   "main": "lib/cjs/index.js",
   "typings": "lib/cjs/index.d.ts",