Skip to content

Commit 2a18200

Browse files
lanlinlanlin
committed
init filter support
1. unit tests for domain resource roles 2. unit tests for resource roles 3. init filter support $filter = []; // the filter for policy to load $adapter = new AdapterFiltered(‘table_name’, $filter); $god = new God(‘path_to_model.conf’, $adapter);
1 parent 7214a67 commit 2a18200

9 files changed

+194
-74
lines changed

‎src/Model/Model.php

Lines changed: 38 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -26,22 +26,6 @@ class Model extends Policy
2626

2727
// ------------------------------------------------------------------------------
2828

29-
/**
30-
* @param Model $model
31-
* @param Config $cfg
32-
* @param string $sec
33-
* @param string $key
34-
* @return bool
35-
*/
36-
private function loadAssertion(Model $model, Config $cfg, string $sec, string $key) : bool
37-
{
38-
$value = $cfg->getString(Consts::SECTION_MAP[$sec] .Consts::CONFIG_SPLIT. $key);
39-
40-
return $model->addDef($sec, $key, $value);
41-
}
42-
43-
// ------------------------------------------------------------------------------
44-
4529
/**
4630
* addDef adds an assertion to the model.
4731
*
@@ -87,28 +71,6 @@ public function addDef(string $sec, string $key, string $value) : bool
8771

8872
// ------------------------------------------------------------------------------
8973

90-
/**
91-
* @param \God\Model\Model $model
92-
* @param \God\Config\Config $cfg
93-
* @param string $sec
94-
*/
95-
private function loadSection(Model $model, Config $cfg, string $sec) : void
96-
{
97-
$i = 1;
98-
99-
while (true)
100-
{
101-
$key = $i === 1 ? $sec : $sec.$i; // key, key1, key2...
102-
$temp = $this->loadAssertion($model, $cfg, $sec, $key);
103-
104-
if (!$temp) { break; }
105-
106-
$i++;
107-
}
108-
}
109-
110-
// ------------------------------------------------------------------------------
111-
11274
/**
11375
* loadModel loads the model from model CONF file.
11476
*
@@ -163,4 +125,42 @@ public function printModel() : void
163125

164126
// ------------------------------------------------------------------------------
165127

128+
/**
129+
* @param Model $model
130+
* @param Config $cfg
131+
* @param string $sec
132+
* @param string $key
133+
* @return bool
134+
*/
135+
private function loadAssertion(Model $model, Config $cfg, string $sec, string $key) : bool
136+
{
137+
$value = $cfg->getString(Consts::SECTION_MAP[$sec] .Consts::CONFIG_SPLIT. $key);
138+
139+
return $model->addDef($sec, $key, $value);
140+
}
141+
142+
// ------------------------------------------------------------------------------
143+
144+
/**
145+
* @param \God\Model\Model $model
146+
* @param \God\Config\Config $cfg
147+
* @param string $sec
148+
*/
149+
private function loadSection(Model $model, Config $cfg, string $sec) : void
150+
{
151+
$i = 1;
152+
153+
while (true)
154+
{
155+
$key = $i === 1 ? $sec : $sec.$i; // key, key1, key2...
156+
$temp = $this->loadAssertion($model, $cfg, $sec, $key);
157+
158+
if (!$temp) { break; }
159+
160+
$i++;
161+
}
162+
}
163+
164+
// ------------------------------------------------------------------------------
165+
166166
}

‎src/Persist/Adapter/File/AdapterFiltered.php

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,34 @@ class AdapterFiltered extends Adapter implements AdapterFilteredInterface
2020
// ------------------------------------------------------------------------------
2121

2222
/**
23+
* is filtered
24+
*
2325
* @var bool
2426
*/
2527
private $filtered = false;
2628

2729
// ------------------------------------------------------------------------------
2830

31+
/**
32+
* filter conditions
33+
*
34+
* @var mixed
35+
*/
36+
private $filter = null;
37+
38+
// ------------------------------------------------------------------------------
39+
2940
/**
3041
* AdapterFiltered constructor.
3142
*
3243
* @param string $filePath
44+
* @param mixed $filter
3345
*/
34-
public function __construct(string $filePath)
46+
public function __construct(string $filePath, $filter = null)
3547
{
3648
parent::__construct($filePath);
49+
50+
$this->filter = $filter;
3751
}
3852

3953
// ------------------------------------------------------------------------------
@@ -59,7 +73,9 @@ public function loadPolicy(Model $model) : void
5973
{
6074
$this->filtered = false;
6175

62-
parent::loadPolicy($model);
76+
empty($this->filter) ?
77+
parent::loadPolicy($model) :
78+
$this->loadFilteredPolicy($model, $this->filter);
6379
}
6480

6581
// ------------------------------------------------------------------------------

‎src/Persist/Adapter/MongoDB/AdapterFiltered.php

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,20 +19,34 @@ class AdapterFiltered extends Adapter implements AdapterFilteredInterface
1919
// ------------------------------------------------------------------------------
2020

2121
/**
22+
* is filtered
23+
*
2224
* @var bool
2325
*/
2426
private $filtered = false;
2527

2628
// ------------------------------------------------------------------------------
2729

30+
/**
31+
* filter conditions
32+
*
33+
* @var mixed
34+
*/
35+
private $filter = null;
36+
37+
// ------------------------------------------------------------------------------
38+
2839
/**
2940
* AdapterFiltered constructor.
3041
*
3142
* @param \MongoDB\Collection $collection
43+
* @param mixed $filter
3244
*/
33-
public function __construct(\MongoDB\Collection $collection)
45+
public function __construct(\MongoDB\Collection $collection, $filter = null)
3446
{
3547
parent::__construct($collection);
48+
49+
$this->filter = $filter;
3650
}
3751

3852
// ------------------------------------------------------------------------------
@@ -58,7 +72,9 @@ public function loadPolicy(Model $model) : void
5872
{
5973
$this->filtered = false;
6074

61-
parent::loadPolicy($model);
75+
empty($this->filter) ?
76+
parent::loadPolicy($model) :
77+
$this->loadFilteredPolicy($model, $this->filter);
6278
}
6379

6480
// ------------------------------------------------------------------------------

‎src/Rbac/DefaultRoleManager.php

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -45,37 +45,6 @@ public function __construct(int $maxHierarchyLevel)
4545

4646
// ------------------------------------------------------------------------------
4747

48-
/**
49-
* @param string $name
50-
* @return bool
51-
*/
52-
private function hasRole(string $name) : bool
53-
{
54-
return isset($this->allRoles[$name]);
55-
}
56-
57-
// ------------------------------------------------------------------------------
58-
59-
/**
60-
* @param string $name
61-
* @return \God\Rbac\DefaultRole
62-
*/
63-
private function createRole(string $name) : DefaultRole
64-
{
65-
if ($this->hasRole($name))
66-
{
67-
return $this->allRoles[$name];
68-
}
69-
70-
$role = new DefaultRole($name);
71-
72-
$this->allRoles[$name] = $role;
73-
74-
return $role;
75-
}
76-
77-
// ------------------------------------------------------------------------------
78-
7948
/**
8049
* clear clears all stored data and resets the role manager to the initial state.
8150
*/
@@ -279,4 +248,35 @@ public function printRoles() : void
279248

280249
// ------------------------------------------------------------------------------
281250

251+
/**
252+
* @param string $name
253+
* @return bool
254+
*/
255+
private function hasRole(string $name) : bool
256+
{
257+
return isset($this->allRoles[$name]);
258+
}
259+
260+
// ------------------------------------------------------------------------------
261+
262+
/**
263+
* @param string $name
264+
* @return \God\Rbac\DefaultRole
265+
*/
266+
private function createRole(string $name) : DefaultRole
267+
{
268+
if ($this->hasRole($name))
269+
{
270+
return $this->allRoles[$name];
271+
}
272+
273+
$role = new DefaultRole($name);
274+
275+
$this->allRoles[$name] = $role;
276+
277+
return $role;
278+
}
279+
280+
// ------------------------------------------------------------------------------
281+
282282
}

‎tests/Examples/rbac_with_domain_resource_roles_model.conf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
[request_definition]
2+
r = sub, dom, obj, act
3+
4+
[policy_definition]
5+
p = sub, dom, obj, act
6+
7+
[role_definition]
8+
g = _, _, _
9+
g2 = _, _
10+
11+
[policy_effect]
12+
e = some(where (p.eft == allow))
13+
14+
[matchers]
15+
m = g(r.sub, p.sub, r.dom) && g2(r.obj, p.obj) && r.act == p.act

‎tests/Examples/rbac_with_domain_resource_roles_policy.csv

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
p, alice, domain1, data1, read
2+
p, bob, domain1, data2, write
3+
p, data_group_admin, domain1, data_group, write
4+
g, alice, data_group_admin, domain1
5+
g2, data1, data_group
6+
g2, data2, data_group

‎tests/Examples/rbac_with_resource_roles_policy.csv

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,5 @@ p, bob, data2, write
33
p, data_group_admin, data_group, write
44
g, alice, data_group_admin
55
g2, data1, data_group
6-
g2, data2, data_group
6+
g2, data2, data_group
7+
g2, data3, data_group

‎tests/RbacAPIWithDomainResourceRolesUnitTest.php

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<?php namespace GodTests;
2+
3+
use God\God;
4+
use PHPUnit\Framework\TestCase;
5+
6+
/**
7+
* ------------------------------------------------------------------------------------
8+
* God Test RBAC
9+
* ------------------------------------------------------------------------------------
10+
*
11+
* @author lanlin
12+
* @change 2018/06/28
13+
*/
14+
class RbacAPIWithDomainResourceRolesUnitTest extends TestCase
15+
{
16+
17+
// ------------------------------------------------------------------------------
18+
19+
public function testDomainResourceRoles()
20+
{
21+
$e = new God(
22+
TestUtil::$path.'rbac_with_domain_resource_roles_model.conf',
23+
TestUtil::$path.'rbac_with_domain_resource_roles_policy.csv'
24+
);
25+
26+
TestUtil::testDomainEnforce($e, 'alice', 'domain1', 'data1', 'read', true);
27+
TestUtil::testDomainEnforce($e, 'alice', 'domain1', 'data1', 'write', true);
28+
TestUtil::testDomainEnforce($e, 'alice', 'domain1', 'data2', 'read', false);
29+
TestUtil::testDomainEnforce($e, 'alice', 'domain1', 'data2', 'write', true);
30+
}
31+
32+
// ------------------------------------------------------------------------------
33+
34+
}

‎tests/RbacAPIWithResourceRolesUnitTest.php

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
<?php namespace GodTests;
2+
3+
use God\God;
4+
use PHPUnit\Framework\TestCase;
5+
6+
/**
7+
* ------------------------------------------------------------------------------------
8+
* God Test RBAC
9+
* ------------------------------------------------------------------------------------
10+
*
11+
* @author lanlin
12+
* @change 2018/06/28
13+
*/
14+
class RbacAPIWithResourceRolesUnitTest extends TestCase
15+
{
16+
17+
// ------------------------------------------------------------------------------
18+
19+
public function testResourceRoles()
20+
{
21+
$e = new God(TestUtil::$path.'rbac_with_resource_roles_model.conf', TestUtil::$path.'rbac_with_resource_roles_policy.csv');
22+
23+
TestUtil::testEnforce($e, 'alice', 'data1', 'read', true);
24+
TestUtil::testEnforce($e, 'alice', 'data1', 'write', true);
25+
TestUtil::testEnforce($e, 'alice', 'data2', 'read', false);
26+
TestUtil::testEnforce($e, 'alice', 'data2', 'write', true);
27+
TestUtil::testEnforce($e, 'alice', 'data3', 'write', true);
28+
}
29+
30+
// ------------------------------------------------------------------------------
31+
32+
}

0 commit comments

Comments
 (0)