202 lines
6.5 KiB
Go
202 lines
6.5 KiB
Go
// Licensed to the Apache Software Foundation (ASF) under one
|
|
// or more contributor license agreements. See the NOTICE file
|
|
// distributed with this work for additional information
|
|
// regarding copyright ownership. The ASF licenses this file
|
|
// to you under the Apache License, Version 2.0 (the
|
|
// "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package casbin
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"testing"
|
|
|
|
"github.com/casbin/casbin/v3/util"
|
|
)
|
|
|
|
type testResource struct {
|
|
Name string
|
|
Owner string
|
|
}
|
|
|
|
func newTestResource(name string, owner string) testResource {
|
|
r := testResource{}
|
|
r.Name = name
|
|
r.Owner = owner
|
|
return r
|
|
}
|
|
|
|
func TestABACModel(t *testing.T) {
|
|
e, _ := NewEnforcer("examples/abac_model.conf")
|
|
|
|
data1 := newTestResource("data1", "alice")
|
|
data2 := newTestResource("data2", "bob")
|
|
|
|
testEnforce(t, e, "alice", data1, "read", true)
|
|
testEnforce(t, e, "alice", data1, "write", true)
|
|
testEnforce(t, e, "alice", data2, "read", false)
|
|
testEnforce(t, e, "alice", data2, "write", false)
|
|
testEnforce(t, e, "bob", data1, "read", false)
|
|
testEnforce(t, e, "bob", data1, "write", false)
|
|
testEnforce(t, e, "bob", data2, "read", true)
|
|
testEnforce(t, e, "bob", data2, "write", true)
|
|
}
|
|
|
|
func TestABACMapRequest(t *testing.T) {
|
|
e, _ := NewEnforcer("examples/abac_model.conf")
|
|
|
|
data1 := map[string]interface{}{
|
|
"Name": "data1",
|
|
"Owner": "alice",
|
|
}
|
|
data2 := map[string]interface{}{
|
|
"Name": "data2",
|
|
"Owner": "bob",
|
|
}
|
|
|
|
testEnforce(t, e, "alice", data1, "read", true)
|
|
testEnforce(t, e, "alice", data1, "write", true)
|
|
testEnforce(t, e, "alice", data2, "read", false)
|
|
testEnforce(t, e, "alice", data2, "write", false)
|
|
testEnforce(t, e, "bob", data1, "read", false)
|
|
testEnforce(t, e, "bob", data1, "write", false)
|
|
testEnforce(t, e, "bob", data2, "read", true)
|
|
testEnforce(t, e, "bob", data2, "write", true)
|
|
}
|
|
|
|
func TestABACTypes(t *testing.T) {
|
|
e, _ := NewEnforcer("examples/abac_model.conf")
|
|
matcher := `"moderator" IN r.sub.Roles && r.sub.Enabled == true && r.sub.Age >= 21 && r.sub.Name != "foo"`
|
|
e.GetModel()["m"]["m"].Value = util.RemoveComments(util.EscapeAssertion(matcher))
|
|
|
|
structRequest := struct {
|
|
Roles []interface{}
|
|
Enabled bool
|
|
Age int
|
|
Name string
|
|
}{
|
|
Roles: []interface{}{"user", "moderator"},
|
|
Enabled: true,
|
|
Age: 30,
|
|
Name: "alice",
|
|
}
|
|
testEnforce(t, e, structRequest, "", "", true)
|
|
|
|
mapRequest := map[string]interface{}{
|
|
"Roles": []interface{}{"user", "moderator"},
|
|
"Enabled": true,
|
|
"Age": 30,
|
|
"Name": "alice",
|
|
}
|
|
testEnforce(t, e, mapRequest, nil, "", true)
|
|
|
|
e.EnableAcceptJsonRequest(true)
|
|
jsonRequest, _ := json.Marshal(mapRequest)
|
|
testEnforce(t, e, string(jsonRequest), "", "", true)
|
|
}
|
|
|
|
func TestABACJsonRequest(t *testing.T) {
|
|
e, _ := NewEnforcer("examples/abac_model.conf")
|
|
e.EnableAcceptJsonRequest(true)
|
|
|
|
data1Json := `{ "Name": "data1", "Owner": "alice"}`
|
|
data2Json := `{ "Name": "data2", "Owner": "bob"}`
|
|
|
|
testEnforce(t, e, "alice", data1Json, "read", true)
|
|
testEnforce(t, e, "alice", data1Json, "write", true)
|
|
testEnforce(t, e, "alice", data2Json, "read", false)
|
|
testEnforce(t, e, "alice", data2Json, "write", false)
|
|
testEnforce(t, e, "bob", data1Json, "read", false)
|
|
testEnforce(t, e, "bob", data1Json, "write", false)
|
|
testEnforce(t, e, "bob", data2Json, "read", true)
|
|
testEnforce(t, e, "bob", data2Json, "write", true)
|
|
|
|
e, _ = NewEnforcer("examples/abac_not_using_policy_model.conf", "examples/abac_rule_effect_policy.csv")
|
|
e.EnableAcceptJsonRequest(true)
|
|
|
|
testEnforce(t, e, "alice", data1Json, "read", true)
|
|
testEnforce(t, e, "alice", data1Json, "write", true)
|
|
testEnforce(t, e, "alice", data2Json, "read", false)
|
|
testEnforce(t, e, "alice", data2Json, "write", false)
|
|
|
|
e, _ = NewEnforcer("examples/abac_rule_model.conf", "examples/abac_rule_policy.csv")
|
|
e.EnableAcceptJsonRequest(true)
|
|
sub1Json := `{"Name": "alice", "Age": 16}`
|
|
sub2Json := `{"Name": "alice", "Age": 20}`
|
|
sub3Json := `{"Name": "alice", "Age": 65}`
|
|
|
|
testEnforce(t, e, sub1Json, "/data1", "read", false)
|
|
testEnforce(t, e, sub1Json, "/data2", "read", false)
|
|
testEnforce(t, e, sub1Json, "/data1", "write", false)
|
|
testEnforce(t, e, sub1Json, "/data2", "write", true)
|
|
testEnforce(t, e, sub2Json, "/data1", "read", true)
|
|
testEnforce(t, e, sub2Json, "/data2", "read", false)
|
|
testEnforce(t, e, sub2Json, "/data1", "write", false)
|
|
testEnforce(t, e, sub2Json, "/data2", "write", true)
|
|
testEnforce(t, e, sub3Json, "/data1", "read", true)
|
|
testEnforce(t, e, sub3Json, "/data2", "read", false)
|
|
testEnforce(t, e, sub3Json, "/data1", "write", false)
|
|
testEnforce(t, e, sub3Json, "/data2", "write", false)
|
|
}
|
|
|
|
type testSub struct {
|
|
Name string
|
|
Age int
|
|
}
|
|
|
|
func newTestSubject(name string, age int) testSub {
|
|
s := testSub{}
|
|
s.Name = name
|
|
s.Age = age
|
|
return s
|
|
}
|
|
|
|
func TestABACNotUsingPolicy(t *testing.T) {
|
|
e, _ := NewEnforcer("examples/abac_not_using_policy_model.conf", "examples/abac_rule_effect_policy.csv")
|
|
data1 := newTestResource("data1", "alice")
|
|
data2 := newTestResource("data2", "bob")
|
|
|
|
testEnforce(t, e, "alice", data1, "read", true)
|
|
testEnforce(t, e, "alice", data1, "write", true)
|
|
testEnforce(t, e, "alice", data2, "read", false)
|
|
testEnforce(t, e, "alice", data2, "write", false)
|
|
}
|
|
|
|
func TestABACPolicy(t *testing.T) {
|
|
e, _ := NewEnforcer("examples/abac_rule_model.conf", "examples/abac_rule_policy.csv")
|
|
m := e.GetModel()
|
|
for sec, ast := range m {
|
|
fmt.Println(sec)
|
|
for ptype, p := range ast {
|
|
fmt.Println(ptype, p)
|
|
}
|
|
}
|
|
sub1 := newTestSubject("alice", 16)
|
|
sub2 := newTestSubject("alice", 20)
|
|
sub3 := newTestSubject("alice", 65)
|
|
|
|
testEnforce(t, e, sub1, "/data1", "read", false)
|
|
testEnforce(t, e, sub1, "/data2", "read", false)
|
|
testEnforce(t, e, sub1, "/data1", "write", false)
|
|
testEnforce(t, e, sub1, "/data2", "write", true)
|
|
testEnforce(t, e, sub2, "/data1", "read", true)
|
|
testEnforce(t, e, sub2, "/data2", "read", false)
|
|
testEnforce(t, e, sub2, "/data1", "write", false)
|
|
testEnforce(t, e, sub2, "/data2", "write", true)
|
|
testEnforce(t, e, sub3, "/data1", "read", true)
|
|
testEnforce(t, e, sub3, "/data2", "read", false)
|
|
testEnforce(t, e, sub3, "/data1", "write", false)
|
|
testEnforce(t, e, sub3, "/data2", "write", false)
|
|
}
|