casbin 5.46.0 → 5.48.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/cjs/enforcer.js +24 -0
- package/lib/cjs/internalEnforcer.d.ts +8 -0
- package/lib/cjs/internalEnforcer.js +98 -4
- package/lib/cjs/managementEnforcer.d.ts +4 -3
- package/lib/cjs/managementEnforcer.js +13 -10
- package/lib/esm/enforcer.js +24 -0
- package/lib/esm/internalEnforcer.d.ts +8 -0
- package/lib/esm/internalEnforcer.js +98 -4
- package/lib/esm/managementEnforcer.d.ts +4 -3
- package/lib/esm/managementEnforcer.js +13 -10
- package/package.json +1 -1
package/lib/cjs/enforcer.js
CHANGED
|
@@ -174,6 +174,12 @@ class Enforcer extends managementEnforcer_1.ManagementEnforcer {
|
|
|
174
174
|
* @return succeeds or not.
|
|
175
175
|
*/
|
|
176
176
|
async deleteRoleForUser(user, role, domain) {
|
|
177
|
+
if (!user) {
|
|
178
|
+
throw new Error('user must not be empty');
|
|
179
|
+
}
|
|
180
|
+
if (!role) {
|
|
181
|
+
throw new Error('role must not be empty');
|
|
182
|
+
}
|
|
177
183
|
if (domain === undefined) {
|
|
178
184
|
return this.removeGroupingPolicy(user, role);
|
|
179
185
|
}
|
|
@@ -190,6 +196,9 @@ class Enforcer extends managementEnforcer_1.ManagementEnforcer {
|
|
|
190
196
|
* @return succeeds or not.
|
|
191
197
|
*/
|
|
192
198
|
async deleteRolesForUser(user, domain) {
|
|
199
|
+
if (!user) {
|
|
200
|
+
throw new Error('user must not be empty');
|
|
201
|
+
}
|
|
193
202
|
if (domain === undefined) {
|
|
194
203
|
const subIndex = this.getFieldIndex('p', "sub" /* Subject */);
|
|
195
204
|
return this.removeFilteredGroupingPolicy(subIndex, user);
|
|
@@ -206,6 +215,9 @@ class Enforcer extends managementEnforcer_1.ManagementEnforcer {
|
|
|
206
215
|
* @return succeeds or not.
|
|
207
216
|
*/
|
|
208
217
|
async deleteUser(user) {
|
|
218
|
+
if (!user) {
|
|
219
|
+
throw new Error('user must not be empty');
|
|
220
|
+
}
|
|
209
221
|
const subIndex = this.getFieldIndex('p', "sub" /* Subject */);
|
|
210
222
|
const res1 = await this.removeFilteredGroupingPolicy(subIndex, user);
|
|
211
223
|
const res2 = await this.removeFilteredPolicy(subIndex, user);
|
|
@@ -219,6 +231,9 @@ class Enforcer extends managementEnforcer_1.ManagementEnforcer {
|
|
|
219
231
|
* @return succeeds or not.
|
|
220
232
|
*/
|
|
221
233
|
async deleteRole(role) {
|
|
234
|
+
if (!role) {
|
|
235
|
+
throw new Error('role must not be empty');
|
|
236
|
+
}
|
|
222
237
|
const subIndex = this.getFieldIndex('p', "sub" /* Subject */);
|
|
223
238
|
const res1 = await this.removeFilteredGroupingPolicy(subIndex, role);
|
|
224
239
|
const res2 = await this.removeFilteredPolicy(subIndex, role);
|
|
@@ -232,6 +247,9 @@ class Enforcer extends managementEnforcer_1.ManagementEnforcer {
|
|
|
232
247
|
* @return succeeds or not.
|
|
233
248
|
*/
|
|
234
249
|
async deletePermission(...permission) {
|
|
250
|
+
if (permission.length === 0) {
|
|
251
|
+
throw new Error('permission must not be empty');
|
|
252
|
+
}
|
|
235
253
|
return this.removeFilteredPolicy(1, ...permission);
|
|
236
254
|
}
|
|
237
255
|
/**
|
|
@@ -255,6 +273,9 @@ class Enforcer extends managementEnforcer_1.ManagementEnforcer {
|
|
|
255
273
|
* @return succeeds or not.
|
|
256
274
|
*/
|
|
257
275
|
async deletePermissionForUser(user, ...permission) {
|
|
276
|
+
if (!user) {
|
|
277
|
+
throw new Error('user must not be empty');
|
|
278
|
+
}
|
|
258
279
|
permission.unshift(user);
|
|
259
280
|
return this.removePolicy(...permission);
|
|
260
281
|
}
|
|
@@ -266,6 +287,9 @@ class Enforcer extends managementEnforcer_1.ManagementEnforcer {
|
|
|
266
287
|
* @return succeeds or not.
|
|
267
288
|
*/
|
|
268
289
|
async deletePermissionsForUser(user) {
|
|
290
|
+
if (!user) {
|
|
291
|
+
throw new Error('user must not be empty');
|
|
292
|
+
}
|
|
269
293
|
const subIndex = this.getFieldIndex('p', "sub" /* Subject */);
|
|
270
294
|
return this.removeFilteredPolicy(subIndex, user);
|
|
271
295
|
}
|
|
@@ -35,4 +35,12 @@ export declare class InternalEnforcer extends CoreEnforcer {
|
|
|
35
35
|
* set index of field
|
|
36
36
|
*/
|
|
37
37
|
setFieldIndex(ptype: string, field: string, index: number): void;
|
|
38
|
+
protected addPolicyWithoutNotify(sec: string, ptype: string, rule: string[]): Promise<boolean>;
|
|
39
|
+
protected addPoliciesWithoutNotify(sec: string, ptype: string, rules: string[][]): Promise<boolean>;
|
|
40
|
+
protected addPoliciesWithoutNotifyEx(sec: string, ptype: string, rules: string[][]): Promise<boolean>;
|
|
41
|
+
protected updatePolicyWithoutNotify(sec: string, ptype: string, oldRule: string[], newRule: string[]): Promise<boolean>;
|
|
42
|
+
protected removePolicyWithoutNotify(sec: string, ptype: string, rule: string[]): Promise<boolean>;
|
|
43
|
+
protected removePoliciesWithoutNotify(sec: string, ptype: string, rules: string[][]): Promise<boolean>;
|
|
44
|
+
protected removeFilteredPolicyWithoutNotify(sec: string, ptype: string, fieldIndex: number, fieldValues: string[]): Promise<boolean>;
|
|
45
|
+
protected updatePoliciesWithoutNotify(sec: string, ptype: string, oldRules: string[][], newRules: string[][]): Promise<boolean>;
|
|
38
46
|
}
|
|
@@ -27,6 +27,7 @@ class InternalEnforcer extends coreEnforcer_1.CoreEnforcer {
|
|
|
27
27
|
if (this.model.hasPolicy(sec, ptype, rule)) {
|
|
28
28
|
return false;
|
|
29
29
|
}
|
|
30
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
30
31
|
if (this.adapter && this.autoSave) {
|
|
31
32
|
try {
|
|
32
33
|
await this.adapter.addPolicy(sec, ptype, rule);
|
|
@@ -62,7 +63,8 @@ class InternalEnforcer extends coreEnforcer_1.CoreEnforcer {
|
|
|
62
63
|
return false;
|
|
63
64
|
}
|
|
64
65
|
}
|
|
65
|
-
|
|
66
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
67
|
+
if (this.adapter && this.autoSave) {
|
|
66
68
|
if ('addPolicies' in this.adapter) {
|
|
67
69
|
try {
|
|
68
70
|
await this.adapter.addPolicies(sec, ptype, rules);
|
|
@@ -106,7 +108,8 @@ class InternalEnforcer extends coreEnforcer_1.CoreEnforcer {
|
|
|
106
108
|
if (newRules.length === 0) {
|
|
107
109
|
return false;
|
|
108
110
|
}
|
|
109
|
-
|
|
111
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
112
|
+
if (this.adapter && this.autoSave) {
|
|
110
113
|
if ('addPolicies' in this.adapter) {
|
|
111
114
|
try {
|
|
112
115
|
await this.adapter.addPolicies(sec, ptype, newRules);
|
|
@@ -145,7 +148,8 @@ class InternalEnforcer extends coreEnforcer_1.CoreEnforcer {
|
|
|
145
148
|
if (!this.model.hasPolicy(sec, ptype, oldRule)) {
|
|
146
149
|
return false;
|
|
147
150
|
}
|
|
148
|
-
|
|
151
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
152
|
+
if (this.adapter && this.autoSave) {
|
|
149
153
|
if ('updatePolicy' in this.adapter) {
|
|
150
154
|
try {
|
|
151
155
|
await this.adapter.updatePolicy(sec, ptype, oldRule, newRule);
|
|
@@ -183,6 +187,7 @@ class InternalEnforcer extends coreEnforcer_1.CoreEnforcer {
|
|
|
183
187
|
if (!this.model.hasPolicy(sec, ptype, rule)) {
|
|
184
188
|
return false;
|
|
185
189
|
}
|
|
190
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
186
191
|
if (this.adapter && this.autoSave) {
|
|
187
192
|
try {
|
|
188
193
|
await this.adapter.removePolicy(sec, ptype, rule);
|
|
@@ -217,7 +222,8 @@ class InternalEnforcer extends coreEnforcer_1.CoreEnforcer {
|
|
|
217
222
|
return false;
|
|
218
223
|
}
|
|
219
224
|
}
|
|
220
|
-
|
|
225
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
226
|
+
if (this.adapter && this.autoSave) {
|
|
221
227
|
if ('removePolicies' in this.adapter) {
|
|
222
228
|
try {
|
|
223
229
|
await this.adapter.removePolicies(sec, ptype, rules);
|
|
@@ -253,6 +259,7 @@ class InternalEnforcer extends coreEnforcer_1.CoreEnforcer {
|
|
|
253
259
|
* removeFilteredPolicyInternal removes rules based on field filters from the current policy.
|
|
254
260
|
*/
|
|
255
261
|
async removeFilteredPolicyInternal(sec, ptype, fieldIndex, fieldValues, useWatcher) {
|
|
262
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
256
263
|
if (this.adapter && this.autoSave) {
|
|
257
264
|
try {
|
|
258
265
|
await this.adapter.removeFilteredPolicy(sec, ptype, fieldIndex, ...fieldValues);
|
|
@@ -294,5 +301,92 @@ class InternalEnforcer extends coreEnforcer_1.CoreEnforcer {
|
|
|
294
301
|
const assertion = (_a = this.model.model.get('p')) === null || _a === void 0 ? void 0 : _a.get(ptype);
|
|
295
302
|
assertion === null || assertion === void 0 ? void 0 : assertion.fieldIndexMap.set(field, index);
|
|
296
303
|
}
|
|
304
|
+
async addPolicyWithoutNotify(sec, ptype, rule) {
|
|
305
|
+
if (this.model.hasPolicy(sec, ptype, rule)) {
|
|
306
|
+
return false;
|
|
307
|
+
}
|
|
308
|
+
const ok = this.model.addPolicy(sec, ptype, rule);
|
|
309
|
+
if (sec === 'g' && ok) {
|
|
310
|
+
await this.buildIncrementalRoleLinks(model_1.PolicyOp.PolicyAdd, ptype, [rule]);
|
|
311
|
+
}
|
|
312
|
+
return ok;
|
|
313
|
+
}
|
|
314
|
+
async addPoliciesWithoutNotify(sec, ptype, rules) {
|
|
315
|
+
for (const rule of rules) {
|
|
316
|
+
if (this.model.hasPolicy(sec, ptype, rule)) {
|
|
317
|
+
return false;
|
|
318
|
+
}
|
|
319
|
+
}
|
|
320
|
+
const [ok, effects] = await this.model.addPolicies(sec, ptype, rules);
|
|
321
|
+
if (sec === 'g' && ok && (effects === null || effects === void 0 ? void 0 : effects.length)) {
|
|
322
|
+
await this.buildIncrementalRoleLinks(model_1.PolicyOp.PolicyAdd, ptype, effects);
|
|
323
|
+
}
|
|
324
|
+
return ok;
|
|
325
|
+
}
|
|
326
|
+
async addPoliciesWithoutNotifyEx(sec, ptype, rules) {
|
|
327
|
+
const newRules = rules.filter((rule) => !this.model.hasPolicy(sec, ptype, rule));
|
|
328
|
+
if (newRules.length === 0) {
|
|
329
|
+
return false;
|
|
330
|
+
}
|
|
331
|
+
const [ok, effects] = await this.model.addPolicies(sec, ptype, newRules);
|
|
332
|
+
if (sec === 'g' && ok && (effects === null || effects === void 0 ? void 0 : effects.length)) {
|
|
333
|
+
await this.buildIncrementalRoleLinks(model_1.PolicyOp.PolicyAdd, ptype, effects);
|
|
334
|
+
}
|
|
335
|
+
return ok;
|
|
336
|
+
}
|
|
337
|
+
async updatePolicyWithoutNotify(sec, ptype, oldRule, newRule) {
|
|
338
|
+
if (!this.model.hasPolicy(sec, ptype, oldRule)) {
|
|
339
|
+
return false;
|
|
340
|
+
}
|
|
341
|
+
const ok = this.model.updatePolicy(sec, ptype, oldRule, newRule);
|
|
342
|
+
if (sec === 'g' && ok) {
|
|
343
|
+
await this.buildIncrementalRoleLinks(model_1.PolicyOp.PolicyRemove, ptype, [oldRule]);
|
|
344
|
+
await this.buildIncrementalRoleLinks(model_1.PolicyOp.PolicyAdd, ptype, [newRule]);
|
|
345
|
+
}
|
|
346
|
+
return ok;
|
|
347
|
+
}
|
|
348
|
+
async removePolicyWithoutNotify(sec, ptype, rule) {
|
|
349
|
+
if (!this.model.hasPolicy(sec, ptype, rule)) {
|
|
350
|
+
return false;
|
|
351
|
+
}
|
|
352
|
+
const ok = await this.model.removePolicy(sec, ptype, rule);
|
|
353
|
+
if (sec === 'g' && ok) {
|
|
354
|
+
await this.buildIncrementalRoleLinks(model_1.PolicyOp.PolicyRemove, ptype, [rule]);
|
|
355
|
+
}
|
|
356
|
+
return ok;
|
|
357
|
+
}
|
|
358
|
+
async removePoliciesWithoutNotify(sec, ptype, rules) {
|
|
359
|
+
for (const rule of rules) {
|
|
360
|
+
if (!this.model.hasPolicy(sec, ptype, rule)) {
|
|
361
|
+
return false;
|
|
362
|
+
}
|
|
363
|
+
}
|
|
364
|
+
const [ok, effects] = this.model.removePolicies(sec, ptype, rules);
|
|
365
|
+
if (sec === 'g' && ok && (effects === null || effects === void 0 ? void 0 : effects.length)) {
|
|
366
|
+
await this.buildIncrementalRoleLinks(model_1.PolicyOp.PolicyRemove, ptype, effects);
|
|
367
|
+
}
|
|
368
|
+
return ok;
|
|
369
|
+
}
|
|
370
|
+
async removeFilteredPolicyWithoutNotify(sec, ptype, fieldIndex, fieldValues) {
|
|
371
|
+
const [ok, effects] = this.model.removeFilteredPolicy(sec, ptype, fieldIndex, ...fieldValues);
|
|
372
|
+
if (sec === 'g' && ok && (effects === null || effects === void 0 ? void 0 : effects.length)) {
|
|
373
|
+
await this.buildIncrementalRoleLinks(model_1.PolicyOp.PolicyRemove, ptype, effects);
|
|
374
|
+
}
|
|
375
|
+
return ok;
|
|
376
|
+
}
|
|
377
|
+
async updatePoliciesWithoutNotify(sec, ptype, oldRules, newRules) {
|
|
378
|
+
// Mirror the Go updatePoliciesWithoutNotify; reuse the existing internal flow.
|
|
379
|
+
// Because updatePoliciesInternal isn't implemented yet, fall back to per-item updates.
|
|
380
|
+
if (oldRules.length !== newRules.length) {
|
|
381
|
+
throw new Error('the length of oldRules should be equal to the length of newRules');
|
|
382
|
+
}
|
|
383
|
+
for (let i = 0; i < oldRules.length; i++) {
|
|
384
|
+
const ok = await this.updatePolicyWithoutNotify(sec, ptype, oldRules[i], newRules[i]);
|
|
385
|
+
if (!ok) {
|
|
386
|
+
return false;
|
|
387
|
+
}
|
|
388
|
+
}
|
|
389
|
+
return true;
|
|
390
|
+
}
|
|
297
391
|
}
|
|
298
392
|
exports.InternalEnforcer = InternalEnforcer;
|
|
@@ -429,9 +429,10 @@ export declare class ManagementEnforcer extends InternalEnforcer {
|
|
|
429
429
|
*/
|
|
430
430
|
addFunction(name: string, func: MatchingFunction): Promise<void>;
|
|
431
431
|
selfAddPolicy(sec: string, ptype: string, rule: string[]): Promise<boolean>;
|
|
432
|
+
selfAddPolicies(sec: string, ptype: string, rules: string[][]): Promise<boolean>;
|
|
432
433
|
selfRemovePolicy(sec: string, ptype: string, rule: string[]): Promise<boolean>;
|
|
433
|
-
|
|
434
|
+
selfRemovePolicies(sec: string, ptype: string, rules: string[][]): Promise<boolean>;
|
|
435
|
+
selfRemoveFilteredPolicy(sec: string, ptype: string, fieldIndex: number, ...fieldValues: string[]): Promise<boolean>;
|
|
434
436
|
selfUpdatePolicy(sec: string, ptype: string, oldRule: string[], newRule: string[]): Promise<boolean>;
|
|
435
|
-
|
|
436
|
-
selfRemovePolicies(sec: string, ptype: string, rule: string[][]): Promise<boolean>;
|
|
437
|
+
selfUpdatePolicies(sec: string, ptype: string, oldRules: string[][], newRules: string[][]): Promise<boolean>;
|
|
437
438
|
}
|
|
@@ -542,22 +542,25 @@ class ManagementEnforcer extends internalEnforcer_1.InternalEnforcer {
|
|
|
542
542
|
this.fm.addFunction(name, func);
|
|
543
543
|
}
|
|
544
544
|
async selfAddPolicy(sec, ptype, rule) {
|
|
545
|
-
return this.
|
|
545
|
+
return this.addPolicyWithoutNotify(sec, ptype, rule);
|
|
546
|
+
}
|
|
547
|
+
async selfAddPolicies(sec, ptype, rules) {
|
|
548
|
+
return this.addPoliciesWithoutNotify(sec, ptype, rules);
|
|
546
549
|
}
|
|
547
550
|
async selfRemovePolicy(sec, ptype, rule) {
|
|
548
|
-
return this.
|
|
551
|
+
return this.removePolicyWithoutNotify(sec, ptype, rule);
|
|
549
552
|
}
|
|
550
|
-
async
|
|
551
|
-
return this.
|
|
553
|
+
async selfRemovePolicies(sec, ptype, rules) {
|
|
554
|
+
return this.removePoliciesWithoutNotify(sec, ptype, rules);
|
|
552
555
|
}
|
|
553
|
-
async
|
|
554
|
-
return this.
|
|
556
|
+
async selfRemoveFilteredPolicy(sec, ptype, fieldIndex, ...fieldValues) {
|
|
557
|
+
return this.removeFilteredPolicyWithoutNotify(sec, ptype, fieldIndex, fieldValues);
|
|
555
558
|
}
|
|
556
|
-
async
|
|
557
|
-
return this.
|
|
559
|
+
async selfUpdatePolicy(sec, ptype, oldRule, newRule) {
|
|
560
|
+
return this.updatePolicyWithoutNotify(sec, ptype, oldRule, newRule);
|
|
558
561
|
}
|
|
559
|
-
async
|
|
560
|
-
return this.
|
|
562
|
+
async selfUpdatePolicies(sec, ptype, oldRules, newRules) {
|
|
563
|
+
return this.updatePoliciesWithoutNotify(sec, ptype, oldRules, newRules);
|
|
561
564
|
}
|
|
562
565
|
}
|
|
563
566
|
exports.ManagementEnforcer = ManagementEnforcer;
|
package/lib/esm/enforcer.js
CHANGED
|
@@ -152,6 +152,12 @@ export class Enforcer extends ManagementEnforcer {
|
|
|
152
152
|
* @return succeeds or not.
|
|
153
153
|
*/
|
|
154
154
|
async deleteRoleForUser(user, role, domain) {
|
|
155
|
+
if (!user) {
|
|
156
|
+
throw new Error('user must not be empty');
|
|
157
|
+
}
|
|
158
|
+
if (!role) {
|
|
159
|
+
throw new Error('role must not be empty');
|
|
160
|
+
}
|
|
155
161
|
if (domain === undefined) {
|
|
156
162
|
return this.removeGroupingPolicy(user, role);
|
|
157
163
|
}
|
|
@@ -168,6 +174,9 @@ export class Enforcer extends ManagementEnforcer {
|
|
|
168
174
|
* @return succeeds or not.
|
|
169
175
|
*/
|
|
170
176
|
async deleteRolesForUser(user, domain) {
|
|
177
|
+
if (!user) {
|
|
178
|
+
throw new Error('user must not be empty');
|
|
179
|
+
}
|
|
171
180
|
if (domain === undefined) {
|
|
172
181
|
const subIndex = this.getFieldIndex('p', "sub" /* Subject */);
|
|
173
182
|
return this.removeFilteredGroupingPolicy(subIndex, user);
|
|
@@ -184,6 +193,9 @@ export class Enforcer extends ManagementEnforcer {
|
|
|
184
193
|
* @return succeeds or not.
|
|
185
194
|
*/
|
|
186
195
|
async deleteUser(user) {
|
|
196
|
+
if (!user) {
|
|
197
|
+
throw new Error('user must not be empty');
|
|
198
|
+
}
|
|
187
199
|
const subIndex = this.getFieldIndex('p', "sub" /* Subject */);
|
|
188
200
|
const res1 = await this.removeFilteredGroupingPolicy(subIndex, user);
|
|
189
201
|
const res2 = await this.removeFilteredPolicy(subIndex, user);
|
|
@@ -197,6 +209,9 @@ export class Enforcer extends ManagementEnforcer {
|
|
|
197
209
|
* @return succeeds or not.
|
|
198
210
|
*/
|
|
199
211
|
async deleteRole(role) {
|
|
212
|
+
if (!role) {
|
|
213
|
+
throw new Error('role must not be empty');
|
|
214
|
+
}
|
|
200
215
|
const subIndex = this.getFieldIndex('p', "sub" /* Subject */);
|
|
201
216
|
const res1 = await this.removeFilteredGroupingPolicy(subIndex, role);
|
|
202
217
|
const res2 = await this.removeFilteredPolicy(subIndex, role);
|
|
@@ -210,6 +225,9 @@ export class Enforcer extends ManagementEnforcer {
|
|
|
210
225
|
* @return succeeds or not.
|
|
211
226
|
*/
|
|
212
227
|
async deletePermission(...permission) {
|
|
228
|
+
if (permission.length === 0) {
|
|
229
|
+
throw new Error('permission must not be empty');
|
|
230
|
+
}
|
|
213
231
|
return this.removeFilteredPolicy(1, ...permission);
|
|
214
232
|
}
|
|
215
233
|
/**
|
|
@@ -233,6 +251,9 @@ export class Enforcer extends ManagementEnforcer {
|
|
|
233
251
|
* @return succeeds or not.
|
|
234
252
|
*/
|
|
235
253
|
async deletePermissionForUser(user, ...permission) {
|
|
254
|
+
if (!user) {
|
|
255
|
+
throw new Error('user must not be empty');
|
|
256
|
+
}
|
|
236
257
|
permission.unshift(user);
|
|
237
258
|
return this.removePolicy(...permission);
|
|
238
259
|
}
|
|
@@ -244,6 +265,9 @@ export class Enforcer extends ManagementEnforcer {
|
|
|
244
265
|
* @return succeeds or not.
|
|
245
266
|
*/
|
|
246
267
|
async deletePermissionsForUser(user) {
|
|
268
|
+
if (!user) {
|
|
269
|
+
throw new Error('user must not be empty');
|
|
270
|
+
}
|
|
247
271
|
const subIndex = this.getFieldIndex('p', "sub" /* Subject */);
|
|
248
272
|
return this.removeFilteredPolicy(subIndex, user);
|
|
249
273
|
}
|
|
@@ -35,4 +35,12 @@ export declare class InternalEnforcer extends CoreEnforcer {
|
|
|
35
35
|
* set index of field
|
|
36
36
|
*/
|
|
37
37
|
setFieldIndex(ptype: string, field: string, index: number): void;
|
|
38
|
+
protected addPolicyWithoutNotify(sec: string, ptype: string, rule: string[]): Promise<boolean>;
|
|
39
|
+
protected addPoliciesWithoutNotify(sec: string, ptype: string, rules: string[][]): Promise<boolean>;
|
|
40
|
+
protected addPoliciesWithoutNotifyEx(sec: string, ptype: string, rules: string[][]): Promise<boolean>;
|
|
41
|
+
protected updatePolicyWithoutNotify(sec: string, ptype: string, oldRule: string[], newRule: string[]): Promise<boolean>;
|
|
42
|
+
protected removePolicyWithoutNotify(sec: string, ptype: string, rule: string[]): Promise<boolean>;
|
|
43
|
+
protected removePoliciesWithoutNotify(sec: string, ptype: string, rules: string[][]): Promise<boolean>;
|
|
44
|
+
protected removeFilteredPolicyWithoutNotify(sec: string, ptype: string, fieldIndex: number, fieldValues: string[]): Promise<boolean>;
|
|
45
|
+
protected updatePoliciesWithoutNotify(sec: string, ptype: string, oldRules: string[][], newRules: string[][]): Promise<boolean>;
|
|
38
46
|
}
|
|
@@ -24,6 +24,7 @@ export class InternalEnforcer extends CoreEnforcer {
|
|
|
24
24
|
if (this.model.hasPolicy(sec, ptype, rule)) {
|
|
25
25
|
return false;
|
|
26
26
|
}
|
|
27
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
27
28
|
if (this.adapter && this.autoSave) {
|
|
28
29
|
try {
|
|
29
30
|
await this.adapter.addPolicy(sec, ptype, rule);
|
|
@@ -59,7 +60,8 @@ export class InternalEnforcer extends CoreEnforcer {
|
|
|
59
60
|
return false;
|
|
60
61
|
}
|
|
61
62
|
}
|
|
62
|
-
|
|
63
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
64
|
+
if (this.adapter && this.autoSave) {
|
|
63
65
|
if ('addPolicies' in this.adapter) {
|
|
64
66
|
try {
|
|
65
67
|
await this.adapter.addPolicies(sec, ptype, rules);
|
|
@@ -103,7 +105,8 @@ export class InternalEnforcer extends CoreEnforcer {
|
|
|
103
105
|
if (newRules.length === 0) {
|
|
104
106
|
return false;
|
|
105
107
|
}
|
|
106
|
-
|
|
108
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
109
|
+
if (this.adapter && this.autoSave) {
|
|
107
110
|
if ('addPolicies' in this.adapter) {
|
|
108
111
|
try {
|
|
109
112
|
await this.adapter.addPolicies(sec, ptype, newRules);
|
|
@@ -142,7 +145,8 @@ export class InternalEnforcer extends CoreEnforcer {
|
|
|
142
145
|
if (!this.model.hasPolicy(sec, ptype, oldRule)) {
|
|
143
146
|
return false;
|
|
144
147
|
}
|
|
145
|
-
|
|
148
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
149
|
+
if (this.adapter && this.autoSave) {
|
|
146
150
|
if ('updatePolicy' in this.adapter) {
|
|
147
151
|
try {
|
|
148
152
|
await this.adapter.updatePolicy(sec, ptype, oldRule, newRule);
|
|
@@ -180,6 +184,7 @@ export class InternalEnforcer extends CoreEnforcer {
|
|
|
180
184
|
if (!this.model.hasPolicy(sec, ptype, rule)) {
|
|
181
185
|
return false;
|
|
182
186
|
}
|
|
187
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
183
188
|
if (this.adapter && this.autoSave) {
|
|
184
189
|
try {
|
|
185
190
|
await this.adapter.removePolicy(sec, ptype, rule);
|
|
@@ -214,7 +219,8 @@ export class InternalEnforcer extends CoreEnforcer {
|
|
|
214
219
|
return false;
|
|
215
220
|
}
|
|
216
221
|
}
|
|
217
|
-
|
|
222
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
223
|
+
if (this.adapter && this.autoSave) {
|
|
218
224
|
if ('removePolicies' in this.adapter) {
|
|
219
225
|
try {
|
|
220
226
|
await this.adapter.removePolicies(sec, ptype, rules);
|
|
@@ -250,6 +256,7 @@ export class InternalEnforcer extends CoreEnforcer {
|
|
|
250
256
|
* removeFilteredPolicyInternal removes rules based on field filters from the current policy.
|
|
251
257
|
*/
|
|
252
258
|
async removeFilteredPolicyInternal(sec, ptype, fieldIndex, fieldValues, useWatcher) {
|
|
259
|
+
// Persist when an adapter is configured and autoSave is enabled.
|
|
253
260
|
if (this.adapter && this.autoSave) {
|
|
254
261
|
try {
|
|
255
262
|
await this.adapter.removeFilteredPolicy(sec, ptype, fieldIndex, ...fieldValues);
|
|
@@ -291,4 +298,91 @@ export class InternalEnforcer extends CoreEnforcer {
|
|
|
291
298
|
const assertion = (_a = this.model.model.get('p')) === null || _a === void 0 ? void 0 : _a.get(ptype);
|
|
292
299
|
assertion === null || assertion === void 0 ? void 0 : assertion.fieldIndexMap.set(field, index);
|
|
293
300
|
}
|
|
301
|
+
async addPolicyWithoutNotify(sec, ptype, rule) {
|
|
302
|
+
if (this.model.hasPolicy(sec, ptype, rule)) {
|
|
303
|
+
return false;
|
|
304
|
+
}
|
|
305
|
+
const ok = this.model.addPolicy(sec, ptype, rule);
|
|
306
|
+
if (sec === 'g' && ok) {
|
|
307
|
+
await this.buildIncrementalRoleLinks(PolicyOp.PolicyAdd, ptype, [rule]);
|
|
308
|
+
}
|
|
309
|
+
return ok;
|
|
310
|
+
}
|
|
311
|
+
async addPoliciesWithoutNotify(sec, ptype, rules) {
|
|
312
|
+
for (const rule of rules) {
|
|
313
|
+
if (this.model.hasPolicy(sec, ptype, rule)) {
|
|
314
|
+
return false;
|
|
315
|
+
}
|
|
316
|
+
}
|
|
317
|
+
const [ok, effects] = await this.model.addPolicies(sec, ptype, rules);
|
|
318
|
+
if (sec === 'g' && ok && (effects === null || effects === void 0 ? void 0 : effects.length)) {
|
|
319
|
+
await this.buildIncrementalRoleLinks(PolicyOp.PolicyAdd, ptype, effects);
|
|
320
|
+
}
|
|
321
|
+
return ok;
|
|
322
|
+
}
|
|
323
|
+
async addPoliciesWithoutNotifyEx(sec, ptype, rules) {
|
|
324
|
+
const newRules = rules.filter((rule) => !this.model.hasPolicy(sec, ptype, rule));
|
|
325
|
+
if (newRules.length === 0) {
|
|
326
|
+
return false;
|
|
327
|
+
}
|
|
328
|
+
const [ok, effects] = await this.model.addPolicies(sec, ptype, newRules);
|
|
329
|
+
if (sec === 'g' && ok && (effects === null || effects === void 0 ? void 0 : effects.length)) {
|
|
330
|
+
await this.buildIncrementalRoleLinks(PolicyOp.PolicyAdd, ptype, effects);
|
|
331
|
+
}
|
|
332
|
+
return ok;
|
|
333
|
+
}
|
|
334
|
+
async updatePolicyWithoutNotify(sec, ptype, oldRule, newRule) {
|
|
335
|
+
if (!this.model.hasPolicy(sec, ptype, oldRule)) {
|
|
336
|
+
return false;
|
|
337
|
+
}
|
|
338
|
+
const ok = this.model.updatePolicy(sec, ptype, oldRule, newRule);
|
|
339
|
+
if (sec === 'g' && ok) {
|
|
340
|
+
await this.buildIncrementalRoleLinks(PolicyOp.PolicyRemove, ptype, [oldRule]);
|
|
341
|
+
await this.buildIncrementalRoleLinks(PolicyOp.PolicyAdd, ptype, [newRule]);
|
|
342
|
+
}
|
|
343
|
+
return ok;
|
|
344
|
+
}
|
|
345
|
+
async removePolicyWithoutNotify(sec, ptype, rule) {
|
|
346
|
+
if (!this.model.hasPolicy(sec, ptype, rule)) {
|
|
347
|
+
return false;
|
|
348
|
+
}
|
|
349
|
+
const ok = await this.model.removePolicy(sec, ptype, rule);
|
|
350
|
+
if (sec === 'g' && ok) {
|
|
351
|
+
await this.buildIncrementalRoleLinks(PolicyOp.PolicyRemove, ptype, [rule]);
|
|
352
|
+
}
|
|
353
|
+
return ok;
|
|
354
|
+
}
|
|
355
|
+
async removePoliciesWithoutNotify(sec, ptype, rules) {
|
|
356
|
+
for (const rule of rules) {
|
|
357
|
+
if (!this.model.hasPolicy(sec, ptype, rule)) {
|
|
358
|
+
return false;
|
|
359
|
+
}
|
|
360
|
+
}
|
|
361
|
+
const [ok, effects] = this.model.removePolicies(sec, ptype, rules);
|
|
362
|
+
if (sec === 'g' && ok && (effects === null || effects === void 0 ? void 0 : effects.length)) {
|
|
363
|
+
await this.buildIncrementalRoleLinks(PolicyOp.PolicyRemove, ptype, effects);
|
|
364
|
+
}
|
|
365
|
+
return ok;
|
|
366
|
+
}
|
|
367
|
+
async removeFilteredPolicyWithoutNotify(sec, ptype, fieldIndex, fieldValues) {
|
|
368
|
+
const [ok, effects] = this.model.removeFilteredPolicy(sec, ptype, fieldIndex, ...fieldValues);
|
|
369
|
+
if (sec === 'g' && ok && (effects === null || effects === void 0 ? void 0 : effects.length)) {
|
|
370
|
+
await this.buildIncrementalRoleLinks(PolicyOp.PolicyRemove, ptype, effects);
|
|
371
|
+
}
|
|
372
|
+
return ok;
|
|
373
|
+
}
|
|
374
|
+
async updatePoliciesWithoutNotify(sec, ptype, oldRules, newRules) {
|
|
375
|
+
// Mirror the Go updatePoliciesWithoutNotify; reuse the existing internal flow.
|
|
376
|
+
// Because updatePoliciesInternal isn't implemented yet, fall back to per-item updates.
|
|
377
|
+
if (oldRules.length !== newRules.length) {
|
|
378
|
+
throw new Error('the length of oldRules should be equal to the length of newRules');
|
|
379
|
+
}
|
|
380
|
+
for (let i = 0; i < oldRules.length; i++) {
|
|
381
|
+
const ok = await this.updatePolicyWithoutNotify(sec, ptype, oldRules[i], newRules[i]);
|
|
382
|
+
if (!ok) {
|
|
383
|
+
return false;
|
|
384
|
+
}
|
|
385
|
+
}
|
|
386
|
+
return true;
|
|
387
|
+
}
|
|
294
388
|
}
|
|
@@ -429,9 +429,10 @@ export declare class ManagementEnforcer extends InternalEnforcer {
|
|
|
429
429
|
*/
|
|
430
430
|
addFunction(name: string, func: MatchingFunction): Promise<void>;
|
|
431
431
|
selfAddPolicy(sec: string, ptype: string, rule: string[]): Promise<boolean>;
|
|
432
|
+
selfAddPolicies(sec: string, ptype: string, rules: string[][]): Promise<boolean>;
|
|
432
433
|
selfRemovePolicy(sec: string, ptype: string, rule: string[]): Promise<boolean>;
|
|
433
|
-
|
|
434
|
+
selfRemovePolicies(sec: string, ptype: string, rules: string[][]): Promise<boolean>;
|
|
435
|
+
selfRemoveFilteredPolicy(sec: string, ptype: string, fieldIndex: number, ...fieldValues: string[]): Promise<boolean>;
|
|
434
436
|
selfUpdatePolicy(sec: string, ptype: string, oldRule: string[], newRule: string[]): Promise<boolean>;
|
|
435
|
-
|
|
436
|
-
selfRemovePolicies(sec: string, ptype: string, rule: string[][]): Promise<boolean>;
|
|
437
|
+
selfUpdatePolicies(sec: string, ptype: string, oldRules: string[][], newRules: string[][]): Promise<boolean>;
|
|
437
438
|
}
|
|
@@ -539,21 +539,24 @@ export class ManagementEnforcer extends InternalEnforcer {
|
|
|
539
539
|
this.fm.addFunction(name, func);
|
|
540
540
|
}
|
|
541
541
|
async selfAddPolicy(sec, ptype, rule) {
|
|
542
|
-
return this.
|
|
542
|
+
return this.addPolicyWithoutNotify(sec, ptype, rule);
|
|
543
|
+
}
|
|
544
|
+
async selfAddPolicies(sec, ptype, rules) {
|
|
545
|
+
return this.addPoliciesWithoutNotify(sec, ptype, rules);
|
|
543
546
|
}
|
|
544
547
|
async selfRemovePolicy(sec, ptype, rule) {
|
|
545
|
-
return this.
|
|
548
|
+
return this.removePolicyWithoutNotify(sec, ptype, rule);
|
|
546
549
|
}
|
|
547
|
-
async
|
|
548
|
-
return this.
|
|
550
|
+
async selfRemovePolicies(sec, ptype, rules) {
|
|
551
|
+
return this.removePoliciesWithoutNotify(sec, ptype, rules);
|
|
549
552
|
}
|
|
550
|
-
async
|
|
551
|
-
return this.
|
|
553
|
+
async selfRemoveFilteredPolicy(sec, ptype, fieldIndex, ...fieldValues) {
|
|
554
|
+
return this.removeFilteredPolicyWithoutNotify(sec, ptype, fieldIndex, fieldValues);
|
|
552
555
|
}
|
|
553
|
-
async
|
|
554
|
-
return this.
|
|
556
|
+
async selfUpdatePolicy(sec, ptype, oldRule, newRule) {
|
|
557
|
+
return this.updatePolicyWithoutNotify(sec, ptype, oldRule, newRule);
|
|
555
558
|
}
|
|
556
|
-
async
|
|
557
|
-
return this.
|
|
559
|
+
async selfUpdatePolicies(sec, ptype, oldRules, newRules) {
|
|
560
|
+
return this.updatePoliciesWithoutNotify(sec, ptype, oldRules, newRules);
|
|
558
561
|
}
|
|
559
562
|
}
|
package/package.json
CHANGED