fastac

ExampleFunctions shows how to use a custom util.MatchingFunc

package main

import (
	"github.com/abichinger/fastac"
	"github.com/abichinger/fastac/model"
	"github.com/abichinger/fastac/model/fm"
)

// the model uses a custom MatchingFunc named customPathMatch
var example_functions_model = `
[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = r.sub == p.sub && customPathMatch(r.obj, p.obj) && r.act == p.act`

var example_functions_policy = [][]string{
	{"p", "alice", "*", "GET"},
	{"p", "alice", "/user/alice", "PATCH"},
}

// ExampleFunctions shows how to use a custom util.MatchingFunc
func main() {

	//customPathMatch needs to be registered before loading the model
	fm.SetFunction("customPathMatch", func(arguments ...interface{}) (interface{}, error) {
		rObj := arguments[0].(string)
		rSub := arguments[1].(string)

		if rSub == "*" {
			return true, nil
		}
		return rObj == rSub, nil
	})

	//create enforcer and add rules
	m := model.NewModel()
	_ = m.LoadModelFromText(example_functions_model)
	e, _ := fastac.NewEnforcer(m, nil)
	_ = e.AddRules(example_functions_policy)

	//perform some requests
	printReq(e, "alice", "/user/alice/entry/1", "GET")
	printReq(e, "bob", "/user/alice/entry/1", "GET")
	printReq(e, "alice", "/user/alice", "PATCH")
	printReq(e, "bob", "/user/alice", "PATCH")

}

Output:

alice, /user/alice/entry/1, GET => allow
bob, /user/alice/entry/1, GET => deny
alice, /user/alice, PATCH => allow
bob, /user/alice, PATCH => deny

ExampleManagePolicy demonstrates the usage of functions to modify the policy

package main

import (
	"fmt"
	"sort"

	"github.com/abichinger/fastac"
	"github.com/abichinger/fastac/util"
)

var example_rules_policy = [][]string{
	{"p", "alice", "data1", "read"},
	{"p", "alice", "data1", "write"},
	{"p", "bob", "data2", "read"},
	{"p", "bob", "data2", "write"},
	{"p", "alice", "data3", "read"},
	{"p", "bob", "data3", "read"},
	{"p", "manager", "data3", "write"},
	{"g", "bob", "manager"},
}

// ExampleManagePolicy demonstrates the usage of functions to modify the policy
func main() {

	//create enforcer with rbac model and empty policy
	e, _ := fastac.NewEnforcer("examples/rbac_model.conf", nil)

	//add multiple rules at once
	_ = e.AddRules(example_rules_policy)

	//remove all rules of user bob
	bobRules, _ := e.Filter(fastac.SetMatcher(`p.sub == "bob"`))
	bobGroupingRules, _ := e.Filter(fastac.SetMatcher(`g.user == "bob"`))
	_ = e.RemoveRules(append(bobRules, bobGroupingRules...))

	//make alice a manager
	alice_manager := []string{"g", "alice", "manager"}
	added, _ := e.AddRule(alice_manager)
	if added {
		fmt.Println("rule added successfully")
	}

	//get a list of all rules
	var allRules [][]string
	e.GetModel().RangeRules(func(rule []string) bool {
		allRules = append(allRules, rule)
		return true
	})

	//sort and print rules
	allRulesStr := util.Join2D(allRules, ", ")
	sort.Strings(allRulesStr)
	for _, rule := range allRulesStr {
		fmt.Println(rule)
	}

}

Output:

rule added successfully
g, alice, manager
p, alice, data1, read
p, alice, data1, write
p, alice, data3, read
p, manager, data3, write

ExampleMatchers shows the usage of util.MatchingFunc and util.IMatcher

package main

import (
	"fmt"
	"strings"

	"github.com/abichinger/fastac"
	"github.com/abichinger/fastac/model"
	"github.com/abichinger/fastac/rbac"
	"github.com/abichinger/fastac/util"
)

// the model uses the built-in MatchingFunc pathMatch
var example_matcher_model = `
[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[role_definition]
g = _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub) && pathMatch(r.obj, p.obj) && r.act == p.act`

var example_matcher_policy = [][]string{
	{"p", "role:user", "/user/:uid/entry/:eid", "GET"},
	{"p", "user:alice", "/user/alice/*", "POST"},
	{"p", "role:admin", "/user/:uid/entry/:eid", "DELETE"},
	{"g", "reg:user:.*", "role:user"},
	{"g", "user:alice", "role:admin"},
}

func printReq(e *fastac.Enforcer, params ...interface{}) {
	b, _ := e.Enforce(params...)
	var rule []string
	for _, param := range params {
		rule = append(rule, param.(string))
	}
	if b {
		fmt.Printf("%s => allow\n", strings.Join(rule, ", "))
	} else {
		fmt.Printf("%s => deny\n", strings.Join(rule, ", "))
	}
}

// ExampleMatchers shows the usage of util.MatchingFunc and util.IMatcher
func main() {

	//create enforcer and add rules
	m := model.NewModel()
	_ = m.LoadModelFromText(example_matcher_model)
	e, _ := fastac.NewEnforcer(m, nil)
	_ = e.AddRules(example_matcher_policy)

	//get the default rolemanager
	rm, _ := e.GetModel().GetRoleManager("g")

	// set a role matcher.
	// create a PrefixMatcher. PrefixMatcher implements the interface util.IMatcher
	// each regex pattern needs to be marked with the prefix "reg:"
	roleMatcher := util.NewPrefixMatcher("reg:", util.RegexMatch)
	rm.(rbac.IDefaultRoleManager).SetMatcher(roleMatcher)

	printReq(e, "user:alice", "/user/joe/entry/1", "GET") //allow, because user:alice has role:user
	printReq(e, "user:alice", "/user/alice/entry/2", "POST")
	printReq(e, "user:alice", "/user/bob/entry/3", "POST")
	printReq(e, "user:alice", "/user/bob/entry/3", "DELETE")
	printReq(e, "user:bob", "/user/alice/entry/2", "DELETE")

}

Output:

user:alice, /user/joe/entry/1, GET => allow
user:alice, /user/alice/entry/2, POST => allow
user:alice, /user/bob/entry/3, POST => deny
user:alice, /user/bob/entry/3, DELETE => allow
user:bob, /user/alice/entry/2, DELETE => deny

ExampleStorageAdapter shows how to store/load policy rules to/from a storage adapter

package main

import (
	"fmt"
	"os"
	"sort"
	"strings"

	"github.com/abichinger/fastac"
	gormadapter "github.com/abichinger/gorm-adapter"
	"gorm.io/driver/sqlite"
	"gorm.io/gorm"
)

var example_rules_1 = [][]string{
	{"p", "alice", "data1", "read"},
	{"p", "alice", "data1", "write"},
	{"p", "bob", "data1", "read"},
}

func createDB(name string) *gorm.DB {
	_ = os.Mkdir(".tmp", 0755)
	db, _ := gorm.Open(sqlite.Open(".tmp/"+name+".db"), &gorm.Config{})
	return db
}

func removeDB(name string) {
	os.Remove(".tmp/" + name + ".db")
}

// ExampleStorageAdapter shows how to store/load policy rules to/from a storage adapter
func main() {

	//init adapter
	db := createDB("example")
	defer removeDB("example")
	a, err := gormadapter.NewAdapter(db)
	if err != nil {
		panic(err)
	}

	//create enforcer and store rules using the autosave feature
	e, _ := fastac.NewEnforcer("examples/basic_model.conf", a, fastac.OptionAutosave(true))
	err = e.AddRules(example_rules_1)
	if err != nil {
		panic(err)
	}

	//second enforcer to demonstrate LoadPolicy
	e2, _ := fastac.NewEnforcer("examples/basic_model.conf", a)
	err = e2.LoadPolicy()
	if err != nil {
		panic(err)
	}

	loadedRules := []string{}
	e2.GetModel().RangeRules(func(rule []string) bool {
		loadedRules = append(loadedRules, strings.Join(rule, ", "))
		return true
	})

	sort.Strings(loadedRules)
	for _, rule := range loadedRules {
		fmt.Println(rule)
	}
}

Output:

p, alice, data1, read
p, alice, data1, write
p, bob, data1, read