commit 2975e4bd8ddaba00bb51a16bc0ccded4983863c1 · nel.pet/core

+30

rbac/rbac.go

···

       90
        
       	return err

     

       91
        
       }

     

       92
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       93
        
       func (e *Enforcer) GetKnotsForUser(did string) ([]string, error) {

     

       94
        
       	keepFunc := isNotSpindle

     

       95
        
       	stripFunc := unSpindle

     
···

       106
        
       	return e.addOwner(domain, owner)

     

       107
        
       }

     

       108
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       109
        
       func (e *Enforcer) AddKnotMember(domain, member string) error {

     

       110
        
       	return e.addMember(domain, member)

     

       111
        
       }

     

       112
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       113
        
       func (e *Enforcer) AddSpindleOwner(domain, owner string) error {

     

       114
        
       	return e.addOwner(intoSpindle(domain), owner)

     

       115
        
       }

     

       116
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       117
        
       func (e *Enforcer) AddSpindleMember(domain, member string) error {

     

       118
        
       	return e.addMember(intoSpindle(domain), member)

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       119
        
       }

     

       120
        
       

     

       121
        
       func repoPolicies(member, domain, repo string) [][]string {

     
···

       194
        
       

     

       195
        
       	slices.Sort(membersWithoutRoles)

     

       196
        
       	return slices.Compact(membersWithoutRoles), nil

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       197
        
       }

     

       198
        
       

     

       199
        
       func (e *Enforcer) GetUserByRoleInRepo(role, domain, repo string) ([]string, error) {

···

       90
        
       	return err

     

       91
        
       }

     

       92
        
       

     

       93
       +
       func (e *Enforcer) RemoveSpindle(spindle string) error {

     

       94
       +
       	spindle = intoSpindle(spindle)

     

       95
       +
       	_, err := e.E.DeleteDomains(spindle)

     

       96
       +
       	return err

     

       97
       +
       }

     

       98
       +
       

     

       99
        
       func (e *Enforcer) GetKnotsForUser(did string) ([]string, error) {

     

       100
        
       	keepFunc := isNotSpindle

     

       101
        
       	stripFunc := unSpindle

     
···

       112
        
       	return e.addOwner(domain, owner)

     

       113
        
       }

     

       114
        
       

     

       115
       +
       func (e *Enforcer) RemoveKnotOwner(domain, owner string) error {

     

       116
       +
       	return e.removeOwner(domain, owner)

     

       117
       +
       }

     

       118
       +
       

     

       119
        
       func (e *Enforcer) AddKnotMember(domain, member string) error {

     

       120
        
       	return e.addMember(domain, member)

     

       121
        
       }

     

       122
        
       

     

       123
       +
       func (e *Enforcer) RemoveKnotMember(domain, member string) error {

     

       124
       +
       	return e.removeMember(domain, member)

     

       125
       +
       }

     

       126
       +
       

     

       127
        
       func (e *Enforcer) AddSpindleOwner(domain, owner string) error {

     

       128
        
       	return e.addOwner(intoSpindle(domain), owner)

     

       129
        
       }

     

       130
        
       

     

       131
       +
       func (e *Enforcer) RemoveSpindleOwner(domain, owner string) error {

     

       132
       +
       	return e.removeOwner(intoSpindle(domain), owner)

     

       133
       +
       }

     

       134
       +
       

     

       135
        
       func (e *Enforcer) AddSpindleMember(domain, member string) error {

     

       136
        
       	return e.addMember(intoSpindle(domain), member)

     

       137
       +
       }

     

       138
       +
       

     

       139
       +
       func (e *Enforcer) RemoveSpindleMember(domain, member string) error {

     

       140
       +
       	return e.removeMember(intoSpindle(domain), member)

     

       141
        
       }

     

       142
        
       

     

       143
        
       func repoPolicies(member, domain, repo string) [][]string {

     
···

       216
        
       

     

       217
        
       	slices.Sort(membersWithoutRoles)

     

       218
        
       	return slices.Compact(membersWithoutRoles), nil

     

       219
       +
       }

     

       220
       +
       

     

       221
       +
       func (e *Enforcer) GetKnotUsersByRole(role, domain string) ([]string, error) {

     

       222
       +
       	return e.GetUserByRole(role, domain)

     

       223
       +
       }

     

       224
       +
       

     

       225
       +
       func (e *Enforcer) GetSpindleUsersByRole(role, domain string) ([]string, error) {

     

       226
       +
       	return e.GetUserByRole(role, intoSpindle(domain))

     

       227
        
       }

     

       228
        
       

     

       229
        
       func (e *Enforcer) GetUserByRoleInRepo(role, domain, repo string) ([]string, error) {

+148 -2

rbac/rbac_test.go

···

       214
        
       	assert.Contains(t, knots2, "example.com")

     

       215
        
       }

     

       216
        
       

     

       217
       -
       func TestGetUserByRole(t *testing.T) {

     

       218
        
       	e := setup(t)

     

       219
        
       	_ = e.AddKnot("example.com")

     

       220
        
       	_ = e.AddKnotMember("example.com", "did:plc:foo")

     

       221
        
       	_ = e.AddKnotOwner("example.com", "did:plc:bar")

     

       222
        
       

     

       223
       -
       	members, _ := e.GetUserByRole("server:member", "example.com")

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       224
        
       	assert.Contains(t, members, "did:plc:foo")

     

       225
        
       	assert.Contains(t, members, "did:plc:bar") // due to inheritance

     

       226
        
       }

     
···

       301
        
       	assert.NoError(t, err)

     

       302
        
       	assert.True(t, ok)

     

       303
        
       }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       214
        
       	assert.Contains(t, knots2, "example.com")

     

       215
        
       }

     

       216
        
       

     

       217
       +
       func TestGetKnotUsersByRole(t *testing.T) {

     

       218
        
       	e := setup(t)

     

       219
        
       	_ = e.AddKnot("example.com")

     

       220
        
       	_ = e.AddKnotMember("example.com", "did:plc:foo")

     

       221
        
       	_ = e.AddKnotOwner("example.com", "did:plc:bar")

     

       222
        
       

     

       223
       +
       	members, _ := e.GetKnotUsersByRole("server:member", "example.com")

     

       224
       +
       	assert.Contains(t, members, "did:plc:foo")

     

       225
       +
       	assert.Contains(t, members, "did:plc:bar") // due to inheritance

     

       226
       +
       }

     

       227
       +
       

     

       228
       +
       func TestGetSpindleUsersByRole(t *testing.T) {

     

       229
       +
       	e := setup(t)

     

       230
       +
       	_ = e.AddSpindle("example.com")

     

       231
       +
       	_ = e.AddSpindleMember("example.com", "did:plc:foo")

     

       232
       +
       	_ = e.AddSpindleOwner("example.com", "did:plc:bar")

     

       233
       +
       

     

       234
       +
       	members, _ := e.GetSpindleUsersByRole("server:member", "example.com")

     

       235
        
       	assert.Contains(t, members, "did:plc:foo")

     

       236
        
       	assert.Contains(t, members, "did:plc:bar") // due to inheritance

     

       237
        
       }

     
···

       312
        
       	assert.NoError(t, err)

     

       313
        
       	assert.True(t, ok)

     

       314
        
       }

     

       315
       +
       

     

       316
       +
       func TestRemoveKnotOwner(t *testing.T) {

     

       317
       +
       	e := setup(t)

     

       318
       +
       

     

       319
       +
       	err := e.AddKnot("k.com")

     

       320
       +
       	assert.NoError(t, err)

     

       321
       +
       

     

       322
       +
       	err = e.AddKnotOwner("k.com", "did:plc:foo")

     

       323
       +
       	assert.NoError(t, err)

     

       324
       +
       

     

       325
       +
       	knots, err := e.GetKnotsForUser("did:plc:foo")

     

       326
       +
       	assert.NoError(t, err)

     

       327
       +
       	assert.ElementsMatch(t, []string{

     

       328
       +
       		"k.com",

     

       329
       +
       	}, knots)

     

       330
       +
       

     

       331
       +
       	err = e.RemoveKnotOwner("k.com", "did:plc:foo")

     

       332
       +
       	assert.NoError(t, err)

     

       333
       +
       

     

       334
       +
       	knots, err = e.GetKnotsForUser("did:plc:foo")

     

       335
       +
       	assert.NoError(t, err)

     

       336
       +
       	assert.Empty(t, knots)

     

       337
       +
       }

     

       338
       +
       

     

       339
       +
       func TestRemoveKnotMember(t *testing.T) {

     

       340
       +
       	e := setup(t)

     

       341
       +
       

     

       342
       +
       	err := e.AddKnot("k.com")

     

       343
       +
       	assert.NoError(t, err)

     

       344
       +
       

     

       345
       +
       	err = e.AddKnotOwner("k.com", "did:plc:foo")

     

       346
       +
       	assert.NoError(t, err)

     

       347
       +
       

     

       348
       +
       	err = e.AddKnotMember("k.com", "did:plc:bar")

     

       349
       +
       	assert.NoError(t, err)

     

       350
       +
       

     

       351
       +
       	knots, err := e.GetKnotsForUser("did:plc:bar")

     

       352
       +
       	assert.NoError(t, err)

     

       353
       +
       	assert.ElementsMatch(t, []string{

     

       354
       +
       		"k.com",

     

       355
       +
       	}, knots)

     

       356
       +
       

     

       357
       +
       	err = e.RemoveKnotMember("k.com", "did:plc:bar")

     

       358
       +
       	assert.NoError(t, err)

     

       359
       +
       

     

       360
       +
       	knots, err = e.GetKnotsForUser("did:plc:bar")

     

       361
       +
       	assert.NoError(t, err)

     

       362
       +
       	assert.Empty(t, knots)

     

       363
       +
       }

     

       364
       +
       

     

       365
       +
       func TestRemoveSpindleOwner(t *testing.T) {

     

       366
       +
       	e := setup(t)

     

       367
       +
       

     

       368
       +
       	err := e.AddSpindle("s.com")

     

       369
       +
       	assert.NoError(t, err)

     

       370
       +
       

     

       371
       +
       	err = e.AddSpindleOwner("s.com", "did:plc:foo")

     

       372
       +
       	assert.NoError(t, err)

     

       373
       +
       

     

       374
       +
       	spindles, err := e.GetSpindlesForUser("did:plc:foo")

     

       375
       +
       	assert.NoError(t, err)

     

       376
       +
       	assert.ElementsMatch(t, []string{

     

       377
       +
       		"s.com",

     

       378
       +
       	}, spindles)

     

       379
       +
       

     

       380
       +
       	err = e.RemoveSpindleOwner("s.com", "did:plc:foo")

     

       381
       +
       	assert.NoError(t, err)

     

       382
       +
       

     

       383
       +
       	spindles, err = e.GetSpindlesForUser("did:plc:foo")

     

       384
       +
       	assert.NoError(t, err)

     

       385
       +
       	assert.Empty(t, spindles)

     

       386
       +
       }

     

       387
       +
       

     

       388
       +
       func TestRemoveSpindleMember(t *testing.T) {

     

       389
       +
       	e := setup(t)

     

       390
       +
       

     

       391
       +
       	err := e.AddSpindle("s.com")

     

       392
       +
       	assert.NoError(t, err)

     

       393
       +
       

     

       394
       +
       	err = e.AddSpindleOwner("s.com", "did:plc:foo")

     

       395
       +
       	assert.NoError(t, err)

     

       396
       +
       

     

       397
       +
       	err = e.AddSpindleMember("s.com", "did:plc:bar")

     

       398
       +
       	assert.NoError(t, err)

     

       399
       +
       

     

       400
       +
       	spindles, err := e.GetSpindlesForUser("did:plc:foo")

     

       401
       +
       	assert.NoError(t, err)

     

       402
       +
       	assert.ElementsMatch(t, []string{

     

       403
       +
       		"s.com",

     

       404
       +
       	}, spindles)

     

       405
       +
       

     

       406
       +
       	spindles, err = e.GetSpindlesForUser("did:plc:bar")

     

       407
       +
       	assert.NoError(t, err)

     

       408
       +
       	assert.ElementsMatch(t, []string{

     

       409
       +
       		"s.com",

     

       410
       +
       	}, spindles)

     

       411
       +
       

     

       412
       +
       	err = e.RemoveSpindleMember("s.com", "did:plc:bar")

     

       413
       +
       	assert.NoError(t, err)

     

       414
       +
       

     

       415
       +
       	spindles, err = e.GetSpindlesForUser("did:plc:bar")

     

       416
       +
       	assert.NoError(t, err)

     

       417
       +
       	assert.Empty(t, spindles)

     

       418
       +
       }

     

       419
       +
       

     

       420
       +
       func TestRemoveSpindle(t *testing.T) {

     

       421
       +
       	e := setup(t)

     

       422
       +
       

     

       423
       +
       	err := e.AddSpindle("s.com")

     

       424
       +
       	assert.NoError(t, err)

     

       425
       +
       

     

       426
       +
       	err = e.AddSpindleOwner("s.com", "did:plc:foo")

     

       427
       +
       	assert.NoError(t, err)

     

       428
       +
       

     

       429
       +
       	err = e.AddSpindleMember("s.com", "did:plc:bar")

     

       430
       +
       	assert.NoError(t, err)

     

       431
       +
       

     

       432
       +
       	users, err := e.GetSpindleUsersByRole("server:member", "s.com")

     

       433
       +
       	assert.NoError(t, err)

     

       434
       +
       	assert.ElementsMatch(t, []string{

     

       435
       +
       		"did:plc:foo",

     

       436
       +
       		"did:plc:bar",

     

       437
       +
       	}, users)

     

       438
       +
       

     

       439
       +
       	err = e.RemoveSpindle("s.com")

     

       440
       +
       	assert.NoError(t, err)

     

       441
       +
       

     

       442
       +
       	// TODO: see this issue https://github.com/casbin/casbin/issues/1492

     

       443
       +
       	// s, err := e.E.GetAllDomains()

     

       444
       +
       	// assert.Empty(t, s)

     

       445
       +
       

     

       446
       +
       	spindles, err := e.GetSpindleUsersByRole("server:member", "s.com")

     

       447
       +
       	assert.NoError(t, err)

     

       448
       +
       	assert.Empty(t, spindles)

     

       449
       +
       }

+10

rbac/util.go

···

       29
        
       	return err

     

       30
        
       }

     

       31
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       32
        
       func (e *Enforcer) addMember(domain, member string) error {

     

       33
        
       	_, err := e.E.AddGroupingPolicy(member, "server:member", domain)

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       34
        
       	return err

     

       35
        
       }

     

       36

···

       29
        
       	return err

     

       30
        
       }

     

       31
        
       

     

       32
       +
       func (e *Enforcer) removeOwner(domain, owner string) error {

     

       33
       +
       	_, err := e.E.RemoveGroupingPolicy(owner, "server:owner", domain)

     

       34
       +
       	return err

     

       35
       +
       }

     

       36
       +
       

     

       37
        
       func (e *Enforcer) addMember(domain, member string) error {

     

       38
        
       	_, err := e.E.AddGroupingPolicy(member, "server:member", domain)

     

       39
       +
       	return err

     

       40
       +
       }

     

       41
       +
       

     

       42
       +
       func (e *Enforcer) removeMember(domain, member string) error {

     

       43
       +
       	_, err := e.E.RemoveGroupingPolicy(member, "server:member", domain)

     

       44
        
       	return err

     

       45
        
       }

     

       46