snapshot of https://github.com/casbin/casbin.git (master, 2026-09-15; blobs > 131072B omitted)
This commit is contained in:
upstream-mirror
201
abac_test.go
Normal file
201
abac_test.go
Normal file
@@ -0,0 +1,201 @@
|
||||
// Licensed to the Apache Software Foundation (ASF) under one
|
||||
// or more contributor license agreements. See the NOTICE file
|
||||
// distributed with this work for additional information
|
||||
// regarding copyright ownership. The ASF licenses this file
|
||||
// to you under the Apache License, Version 2.0 (the
|
||||
// "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing,
|
||||
// software distributed under the License is distributed on an
|
||||
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
// KIND, either express or implied. See the License for the
|
||||
// specific language governing permissions and limitations
|
||||
// under the License.
|
||||
|
||||
package casbin
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"github.com/casbin/casbin/v3/util"
|
||||
)
|
||||
|
||||
type testResource struct {
|
||||
Name string
|
||||
Owner string
|
||||
}
|
||||
|
||||
func newTestResource(name string, owner string) testResource {
|
||||
r := testResource{}
|
||||
r.Name = name
|
||||
r.Owner = owner
|
||||
return r
|
||||
}
|
||||
|
||||
func TestABACModel(t *testing.T) {
|
||||
e, _ := NewEnforcer("examples/abac_model.conf")
|
||||
|
||||
data1 := newTestResource("data1", "alice")
|
||||
data2 := newTestResource("data2", "bob")
|
||||
|
||||
testEnforce(t, e, "alice", data1, "read", true)
|
||||
testEnforce(t, e, "alice", data1, "write", true)
|
||||
testEnforce(t, e, "alice", data2, "read", false)
|
||||
testEnforce(t, e, "alice", data2, "write", false)
|
||||
testEnforce(t, e, "bob", data1, "read", false)
|
||||
testEnforce(t, e, "bob", data1, "write", false)
|
||||
testEnforce(t, e, "bob", data2, "read", true)
|
||||
testEnforce(t, e, "bob", data2, "write", true)
|
||||
}
|
||||
|
||||
func TestABACMapRequest(t *testing.T) {
|
||||
e, _ := NewEnforcer("examples/abac_model.conf")
|
||||
|
||||
data1 := map[string]interface{}{
|
||||
"Name": "data1",
|
||||
"Owner": "alice",
|
||||
}
|
||||
data2 := map[string]interface{}{
|
||||
"Name": "data2",
|
||||
"Owner": "bob",
|
||||
}
|
||||
|
||||
testEnforce(t, e, "alice", data1, "read", true)
|
||||
testEnforce(t, e, "alice", data1, "write", true)
|
||||
testEnforce(t, e, "alice", data2, "read", false)
|
||||
testEnforce(t, e, "alice", data2, "write", false)
|
||||
testEnforce(t, e, "bob", data1, "read", false)
|
||||
testEnforce(t, e, "bob", data1, "write", false)
|
||||
testEnforce(t, e, "bob", data2, "read", true)
|
||||
testEnforce(t, e, "bob", data2, "write", true)
|
||||
}
|
||||
|
||||
func TestABACTypes(t *testing.T) {
|
||||
e, _ := NewEnforcer("examples/abac_model.conf")
|
||||
matcher := `"moderator" IN r.sub.Roles && r.sub.Enabled == true && r.sub.Age >= 21 && r.sub.Name != "foo"`
|
||||
e.GetModel()["m"]["m"].Value = util.RemoveComments(util.EscapeAssertion(matcher))
|
||||
|
||||
structRequest := struct {
|
||||
Roles []interface{}
|
||||
Enabled bool
|
||||
Age int
|
||||
Name string
|
||||
}{
|
||||
Roles: []interface{}{"user", "moderator"},
|
||||
Enabled: true,
|
||||
Age: 30,
|
||||
Name: "alice",
|
||||
}
|
||||
testEnforce(t, e, structRequest, "", "", true)
|
||||
|
||||
mapRequest := map[string]interface{}{
|
||||
"Roles": []interface{}{"user", "moderator"},
|
||||
"Enabled": true,
|
||||
"Age": 30,
|
||||
"Name": "alice",
|
||||
}
|
||||
testEnforce(t, e, mapRequest, nil, "", true)
|
||||
|
||||
e.EnableAcceptJsonRequest(true)
|
||||
jsonRequest, _ := json.Marshal(mapRequest)
|
||||
testEnforce(t, e, string(jsonRequest), "", "", true)
|
||||
}
|
||||
|
||||
func TestABACJsonRequest(t *testing.T) {
|
||||
e, _ := NewEnforcer("examples/abac_model.conf")
|
||||
e.EnableAcceptJsonRequest(true)
|
||||
|
||||
data1Json := `{ "Name": "data1", "Owner": "alice"}`
|
||||
data2Json := `{ "Name": "data2", "Owner": "bob"}`
|
||||
|
||||
testEnforce(t, e, "alice", data1Json, "read", true)
|
||||
testEnforce(t, e, "alice", data1Json, "write", true)
|
||||
testEnforce(t, e, "alice", data2Json, "read", false)
|
||||
testEnforce(t, e, "alice", data2Json, "write", false)
|
||||
testEnforce(t, e, "bob", data1Json, "read", false)
|
||||
testEnforce(t, e, "bob", data1Json, "write", false)
|
||||
testEnforce(t, e, "bob", data2Json, "read", true)
|
||||
testEnforce(t, e, "bob", data2Json, "write", true)
|
||||
|
||||
e, _ = NewEnforcer("examples/abac_not_using_policy_model.conf", "examples/abac_rule_effect_policy.csv")
|
||||
e.EnableAcceptJsonRequest(true)
|
||||
|
||||
testEnforce(t, e, "alice", data1Json, "read", true)
|
||||
testEnforce(t, e, "alice", data1Json, "write", true)
|
||||
testEnforce(t, e, "alice", data2Json, "read", false)
|
||||
testEnforce(t, e, "alice", data2Json, "write", false)
|
||||
|
||||
e, _ = NewEnforcer("examples/abac_rule_model.conf", "examples/abac_rule_policy.csv")
|
||||
e.EnableAcceptJsonRequest(true)
|
||||
sub1Json := `{"Name": "alice", "Age": 16}`
|
||||
sub2Json := `{"Name": "alice", "Age": 20}`
|
||||
sub3Json := `{"Name": "alice", "Age": 65}`
|
||||
|
||||
testEnforce(t, e, sub1Json, "/data1", "read", false)
|
||||
testEnforce(t, e, sub1Json, "/data2", "read", false)
|
||||
testEnforce(t, e, sub1Json, "/data1", "write", false)
|
||||
testEnforce(t, e, sub1Json, "/data2", "write", true)
|
||||
testEnforce(t, e, sub2Json, "/data1", "read", true)
|
||||
testEnforce(t, e, sub2Json, "/data2", "read", false)
|
||||
testEnforce(t, e, sub2Json, "/data1", "write", false)
|
||||
testEnforce(t, e, sub2Json, "/data2", "write", true)
|
||||
testEnforce(t, e, sub3Json, "/data1", "read", true)
|
||||
testEnforce(t, e, sub3Json, "/data2", "read", false)
|
||||
testEnforce(t, e, sub3Json, "/data1", "write", false)
|
||||
testEnforce(t, e, sub3Json, "/data2", "write", false)
|
||||
}
|
||||
|
||||
type testSub struct {
|
||||
Name string
|
||||
Age int
|
||||
}
|
||||
|
||||
func newTestSubject(name string, age int) testSub {
|
||||
s := testSub{}
|
||||
s.Name = name
|
||||
s.Age = age
|
||||
return s
|
||||
}
|
||||
|
||||
func TestABACNotUsingPolicy(t *testing.T) {
|
||||
e, _ := NewEnforcer("examples/abac_not_using_policy_model.conf", "examples/abac_rule_effect_policy.csv")
|
||||
data1 := newTestResource("data1", "alice")
|
||||
data2 := newTestResource("data2", "bob")
|
||||
|
||||
testEnforce(t, e, "alice", data1, "read", true)
|
||||
testEnforce(t, e, "alice", data1, "write", true)
|
||||
testEnforce(t, e, "alice", data2, "read", false)
|
||||
testEnforce(t, e, "alice", data2, "write", false)
|
||||
}
|
||||
|
||||
func TestABACPolicy(t *testing.T) {
|
||||
e, _ := NewEnforcer("examples/abac_rule_model.conf", "examples/abac_rule_policy.csv")
|
||||
m := e.GetModel()
|
||||
for sec, ast := range m {
|
||||
fmt.Println(sec)
|
||||
for ptype, p := range ast {
|
||||
fmt.Println(ptype, p)
|
||||
}
|
||||
}
|
||||
sub1 := newTestSubject("alice", 16)
|
||||
sub2 := newTestSubject("alice", 20)
|
||||
sub3 := newTestSubject("alice", 65)
|
||||
|
||||
testEnforce(t, e, sub1, "/data1", "read", false)
|
||||
testEnforce(t, e, sub1, "/data2", "read", false)
|
||||
testEnforce(t, e, sub1, "/data1", "write", false)
|
||||
testEnforce(t, e, sub1, "/data2", "write", true)
|
||||
testEnforce(t, e, sub2, "/data1", "read", true)
|
||||
testEnforce(t, e, sub2, "/data2", "read", false)
|
||||
testEnforce(t, e, sub2, "/data1", "write", false)
|
||||
testEnforce(t, e, sub2, "/data2", "write", true)
|
||||
testEnforce(t, e, sub3, "/data1", "read", true)
|
||||
testEnforce(t, e, sub3, "/data2", "read", false)
|
||||
testEnforce(t, e, sub3, "/data1", "write", false)
|
||||
testEnforce(t, e, sub3, "/data2", "write", false)
|
||||
}
|
||||
Reference in New Issue
Block a user