Skip to content

Commit 5a71c46

Browse files
divy9881divy9881
committed
fix: enforcer for domain rbac and expression evaluation.
1 parent 0f54035 commit 5a71c46

10 files changed

+64
-41
lines changed

‎casbin/casbin.vcxproj

+3-3
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,7 @@
196196
<ClCompile Include="persist\default_watcher_ex.cpp" />
197197
<ClCompile Include="persist\file_adapter\batch_file_adapter.cpp" />
198198
<ClCompile Include="persist\file_adapter\file_adapter.cpp" />
199-
<ClCompile Include="persist\file_adapter\filtered_adapter.cpp" />
199+
<ClCompile Include="persist\file_adapter\filtered_file_adapter.cpp" />
200200
<ClCompile Include="rbac\default_role_manager.cpp" />
201201
<ClCompile Include="rbac_api.cpp" />
202202
<ClCompile Include="rbac_api_with_domains.cpp" />
@@ -267,14 +267,14 @@
267267
<ClInclude Include="model\scope_config.h" />
268268
<ClInclude Include="persist.h" />
269269
<ClInclude Include="persist\adapter.h" />
270-
<ClInclude Include="persist\adapter_filtered.h" />
271270
<ClInclude Include="persist\batch_adapter.h" />
272271
<ClInclude Include="persist\default_watcher.h" />
273272
<ClInclude Include="persist\default_watcher_ex.h" />
274273
<ClInclude Include="persist\file-adapter\batch_file_adapter.h" />
275274
<ClInclude Include="persist\file-adapter\file_adapter.h" />
276-
<ClInclude Include="persist\file-adapter\filtered_adapter.h" />
277275
<ClInclude Include="persist\file-adapter\pch.h" />
276+
<ClInclude Include="persist\file_adapter\filtered_file_adapter.h" />
277+
<ClInclude Include="persist\filtered_adapter.h" />
278278
<ClInclude Include="persist\pch.h" />
279279
<ClInclude Include="persist\watcher.h" />
280280
<ClInclude Include="persist\watcher_ex.h" />

‎casbin/casbin.vcxproj.filters

+9-9
Original file line numberDiff line numberDiff line change
@@ -222,9 +222,6 @@
222222
<ClCompile Include="persist\file_adapter\file_adapter.cpp">
223223
<Filter>Source Files\persist\file_adapter</Filter>
224224
</ClCompile>
225-
<ClCompile Include="persist\file_adapter\filtered_adapter.cpp">
226-
<Filter>Source Files\persist\file_adapter</Filter>
227-
</ClCompile>
228225
<ClCompile Include="persist\adapter.cpp">
229226
<Filter>Source Files\persist</Filter>
230227
</ClCompile>
@@ -255,6 +252,9 @@
255252
<ClCompile Include="ip_parser\parser\parseIPv4.cpp">
256253
<Filter>Source Files\ip_parser\parser</Filter>
257254
</ClCompile>
255+
<ClCompile Include="persist\file_adapter\filtered_file_adapter.cpp">
256+
<Filter>Source Files\persist\file_adapter</Filter>
257+
</ClCompile>
258258
</ItemGroup>
259259
<ItemGroup>
260260
<ClInclude Include="config\config_interface.h">
@@ -272,9 +272,6 @@
272272
<ClInclude Include="persist\adapter.h">
273273
<Filter>Header Files\persist</Filter>
274274
</ClInclude>
275-
<ClInclude Include="persist\adapter_filtered.h">
276-
<Filter>Header Files\persist</Filter>
277-
</ClInclude>
278275
<ClInclude Include="persist\watcher.h">
279276
<Filter>Header Files\persist</Filter>
280277
</ClInclude>
@@ -416,9 +413,6 @@
416413
<ClInclude Include="duktape\pch.h">
417414
<Filter>Header Files\duktape</Filter>
418415
</ClInclude>
419-
<ClInclude Include="persist\file-adapter\filtered_adapter.h">
420-
<Filter>Header Files\persist\file_adapter</Filter>
421-
</ClInclude>
422416
<ClInclude Include="effect\default_effector.h">
423417
<Filter>Header Files\effect</Filter>
424418
</ClInclude>
@@ -467,5 +461,11 @@
467461
<ClInclude Include="model\scope_config.h">
468462
<Filter>Header Files\model</Filter>
469463
</ClInclude>
464+
<ClInclude Include="persist\filtered_adapter.h">
465+
<Filter>Header Files\persist</Filter>
466+
</ClInclude>
467+
<ClInclude Include="persist\file_adapter\filtered_file_adapter.h">
468+
<Filter>Header Files\persist\file_adapter</Filter>
469+
</ClInclude>
470470
</ItemGroup>
471471
</Project>

‎casbin/config/config.cpp

+3-2
Original file line numberDiff line numberDiff line change
@@ -156,9 +156,10 @@ void Config :: Set(string key, string value) {
156156
if (keys.size() >= 2) {
157157
section = keys[0];
158158
option = keys[1];
159-
} else {
160-
option = keys[0];
161159
}
160+
else
161+
option = keys[0];
162+
162163
AddConfig(section, option, value);
163164
mtx_lock.unlock();
164165
}

‎casbin/enforcer.cpp

+16-11
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818

1919
#include "pch.h"
2020

21-
// #include <iostream>
21+
#include <algorithm>
2222

2323
#include "./enforcer.h"
2424
#include "./persist/watcher_ex.h"
@@ -39,6 +39,7 @@ bool Enforcer :: enforce(string matcher, Scope scope) {
3939
// }()
4040

4141
this->func_map.scope = scope;
42+
this->func_map.LoadFunctionMap();
4243

4344
if(!this->enabled)
4445
return true;
@@ -52,16 +53,19 @@ bool Enforcer :: enforce(string matcher, Scope scope) {
5253
else
5354
exp_string = matcher;
5455

56+
5557
unordered_map <string, RoleManager*> rm_map;
5658
bool ok = this->model->m.find("g") != this->model->m.end();
59+
5760
if(ok) {
5861
for(unordered_map <string, Assertion*> :: iterator it = this->model->m["g"].assertion_map.begin() ; it != this->model->m["g"].assertion_map.end() ; it++){
5962
RoleManager* rm = it->second->rm;
63+
int char_count = int(count(it->second->value.begin(), it->second->value.end(), '_'));
6064
int index = int(exp_string.find((it->first)+"("));
6165
if(index != string::npos)
62-
exp_string.insert(index+(it->first+"(").length()-1, (it->first)+"_rm");
63-
PushPointer(this->func_map.scope, (void *)rm, (it->first)+"_rm");
64-
this->func_map.AddFunction(it->first, GFunction);
66+
exp_string.insert(index+(it->first+"(").length(), "rm, ");
67+
PushPointer(this->func_map.scope, (void *)rm, "rm");
68+
this->func_map.AddFunction(it->first, GFunction, char_count + 1);
6569
}
6670
}
6771

@@ -94,7 +98,7 @@ bool Enforcer :: enforce(string matcher, Scope scope) {
9498
PushStringPropToObject(this->func_map.scope, "p", p_vals[j], token);
9599
}
96100

97-
this->func_map.Eval(exp_string);
101+
this->func_map.Evaluate(exp_string);
98102

99103
//TODO
100104
// log.LogPrint("Result: ", result)
@@ -134,15 +138,17 @@ bool Enforcer :: enforce(string matcher, Scope scope) {
134138
break;
135139
}
136140
} else {
137-
this->func_map.Eval(exp_string);
141+
bool isValid = this->func_map.Evaluate(exp_string);
142+
if(!isValid)
143+
return false;
138144
bool result = this->func_map.GetBooleanResult();
145+
139146
//TODO
140147
// log.LogPrint("Result: ", result)
141-
142148
if(result)
143-
policy_effects[0] = Effect::Allow;
149+
policy_effects.push_back(Effect::Allow);
144150
else
145-
policy_effects[0] = Effect::Indeterminate;
151+
policy_effects.push_back(Effect::Indeterminate);
146152
}
147153

148154
//TODO
@@ -200,7 +206,7 @@ Enforcer* Enforcer :: NewEnforcer(Model* m, Adapter* adapter) {
200206

201207
e->Initialize();
202208

203-
if (e->adapter != NULL) {
209+
if (e->adapter->file_path != "") {
204210
e->LoadPolicy();
205211
}
206212
return e;
@@ -346,7 +352,6 @@ void Enforcer :: ClearPolicy() {
346352
void Enforcer :: LoadPolicy() {
347353
this->model->ClearPolicy();
348354
this->adapter->LoadPolicy(this->model);
349-
350355
this->model->PrintPolicy();
351356

352357
if(this->auto_build_role_links) {

‎casbin/enforcer.h

+4-3
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
#include "./rbac/role_manager.h"
2121
#include "./model/function.h"
2222
#include "./enforcer_interface.h"
23-
#include "./persist/adapter_filtered.h"
23+
#include "./persist/filtered_adapter.h"
2424

2525
// Enforcer is the main interface for authorization enforcement and policy management.
2626
class Enforcer : public IEnforcer{
@@ -33,7 +33,6 @@ class Enforcer : public IEnforcer{
3333

3434
Adapter* adapter;
3535
Watcher* watcher;
36-
RoleManager* rm;
3736

3837
bool enabled;
3938
bool auto_save;
@@ -45,6 +44,8 @@ class Enforcer : public IEnforcer{
4544

4645
public:
4746

47+
RoleManager* rm;
48+
4849
/**
4950
* Enforcer is the default constructor.
5051
*/
@@ -190,7 +191,7 @@ class Enforcer : public IEnforcer{
190191
bool RemoveNamedGroupingPolicy(string ptype, vector<string> params);
191192
bool RemoveNamedGroupingPolicies(string p_type, vector<vector<string>> rules);
192193
bool RemoveFilteredNamedGroupingPolicy(string ptype, int field_index, vector<string> field_values);
193-
void AddFunction(string name, Function);
194+
void AddFunction(string name, Function function, Index nargs);
194195

195196
/*RBAC API member functions.*/
196197
vector<string> GetRolesForUser(string name);

‎casbin/enforcer_interface.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ class IEnforcer {
119119
virtual bool RemoveNamedGroupingPolicy(string ptype, vector<string> params) = 0;
120120
virtual bool RemoveNamedGroupingPolicies(string p_type, vector<vector<string>> rules) = 0;
121121
virtual bool RemoveFilteredNamedGroupingPolicy(string ptype, int fieldIndex, vector<string> fieldValues) = 0;
122-
virtual void AddFunction(string name, Function) = 0;
122+
virtual void AddFunction(string name, Function function, Index nargs) = 0;
123123

124124
/* Internal API member functions */
125125
virtual bool addPolicy(string sec, string ptype, vector<string> rule) = 0;

‎casbin/internal_api.cpp

+23-7
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
#include "./persist/batch_adapter.h"
2323
#include "./util/util.h"
2424
#include "./persist/watcher_ex.h"
25+
#include "./exception/unsupported_operation_exception.h"
2526

2627
// addPolicy adds a rule to the current policy.
2728
bool Enforcer :: addPolicy(string sec, string p_type, vector<string> rule) {
@@ -34,8 +35,13 @@ bool Enforcer :: addPolicy(string sec, string p_type, vector<string> rule) {
3435
this->BuildIncrementalRoleLinks(policy_add, p_type, rules);
3536
}
3637

37-
if (this->adapter != NULL && this->auto_save)
38-
this->adapter->AddPolicy(sec, p_type, rule);
38+
if (this->adapter != NULL && this->auto_save) {
39+
try {
40+
this->adapter->AddPolicy(sec, p_type, rule);
41+
}
42+
catch(UnsupportedOperationException e) {
43+
}
44+
}
3945

4046
if (this->watcher != NULL && this->auto_notify_watcher) {
4147
if (IsInstanceOf<WatcherEx>(this->watcher)) {
@@ -79,9 +85,14 @@ bool Enforcer :: removePolicy(string sec, string p_type, vector<string> rule) {
7985
vector<vector<string>> rules{rule};
8086
this->BuildIncrementalRoleLinks(policy_add, p_type, rules);
8187
}
82-
83-
if(this->adapter != NULL && this->auto_save)
84-
this->adapter->RemovePolicy(sec, p_type, rule);
88+
89+
if (this->adapter != NULL && this->auto_save) {
90+
try {
91+
this->adapter->RemovePolicy(sec, p_type, rule);
92+
}
93+
catch (UnsupportedOperationException e) {
94+
}
95+
}
8596

8697
if(this->watcher !=NULL && this->auto_notify_watcher){
8798
if (IsInstanceOf<WatcherEx>(this->watcher)) {
@@ -127,8 +138,13 @@ bool Enforcer :: removeFilteredPolicy(string sec, string p_type, int field_index
127138
if (sec == "g")
128139
this->BuildIncrementalRoleLinks(policy_remove, p_type, effects);
129140

130-
if(this->adapter != NULL && this->auto_save)
131-
this->adapter->RemoveFilteredPolicy(sec, p_type, field_index, field_values);
141+
if (this->adapter != NULL && this->auto_save) {
142+
try {
143+
this->adapter->RemoveFilteredPolicy(sec, p_type, field_index, field_values); \
144+
}
145+
catch (UnsupportedOperationException e) {
146+
}
147+
}
132148

133149
if (this->watcher !=NULL && this->auto_notify_watcher) {
134150
if (IsInstanceOf<WatcherEx>(this->watcher)) {

‎casbin/management_api.cpp

+2-2
Original file line numberDiff line numberDiff line change
@@ -304,6 +304,6 @@ bool Enforcer :: RemoveFilteredNamedGroupingPolicy(string p_type, int field_inde
304304
}
305305

306306
// AddFunction adds a customized function.
307-
void Enforcer :: AddFunction(string name, Function function) {
308-
this->func_map.AddFunction(name, function);
307+
void Enforcer :: AddFunction(string name, Function function, Index nargs) {
308+
this->func_map.AddFunction(name, function, nargs);
309309
}

‎casbin/persist.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
#define CASBIN_CPP_PERSIST
1919

2020
#include "./persist/adapter.h"
21-
#include "./persist/adapter_filtered.h"
21+
#include "./persist/filtered_adapter.h"
2222
#include "./persist/batch_adapter.h"
2323
#include "./persist/default_watcher.h"
2424
#include "./persist/default_watcher_ex.h"
@@ -27,6 +27,6 @@
2727

2828
#include "./persist/file_adapter/batch_file_adapter.h"
2929
#include "./persist/file_adapter/file_adapter.h"
30-
#include "./persist/file_adapter/filtered_adapter.h"
30+
#include "./persist/file_adapter/filtered_file_adapter.h"
3131

3232
#endif

‎examples/basic_with_root_model.conf

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ p = sub, obj, act
88
e = some(where (p.eft == allow))
99

1010
[matchers]
11-
m = r.sub == p.sub && r.obj == p.obj && r.act == p.act || r.sub == "root"
11+
m = r.sub == "root" || r.sub == p.sub && r.obj == p.obj && r.act == p.act

0 commit comments

Comments
 (0)