fix: match wildcard domains in getImplicitPermissionsForUser

Author: hsluoyz

examples/rbac_with_domain_pattern_in_policy_model.conf

@@ -0,0 +1,14 @@
+[request_definition]
+r = sub, obj, act, dom
+
+[policy_definition]
+p = sub, obj, act, dom, eft
+
+[role_definition]
+g = _, _, _
+
+[policy_effect]
+e = some(where (p.eft == allow)) && !some(where (p.eft == deny))
+
+[matchers]
+m = g(r.sub, p.sub, r.dom) && (p.dom == "*" || r.dom == p.dom) && r.obj == p.obj && r.act == p.act

examples/rbac_with_domain_pattern_in_policy_policy.csv

@@ -0,0 +1,16 @@
+p, abstract_roles1, devis, read, *, allow
+p, abstract_roles1, devis, create, *, allow
+p, abstract_roles2, devis, read, *, allow
+p, abstract_roles2, organization, read, *, allow
+p, abstract_roles2, organization, write, *, allow
+p, roles1, devis, delete, tenant1, allow
+
+g, roles1, abstract_roles1, tenant1
+g, roles1, abstract_roles1, tenant2
+g, roles2, abstract_roles2, tenant1
+g, roles2, abstract_roles2, tenant2
+g, super_user, abstract_roles2, *
+
+g, michael, roles1, tenant1
+g, thomas, roles2, tenant2
+g, theo, super_user, *

src/enforcer.ts

@@ -356,22 +356,55 @@ export class Enforcer extends ManagementEnforcer {
    * But getImplicitRolesForUser("alice") will get: ["role:admin", "role:user"].
    */
   public async getImplicitRolesForUser(name: string, ...domain: string[]): Promise<string[]> {
-    const res = new Set<string>();
+    const res: string[] = [];
+
+    // Each role definition is a hierarchy of its own, so every role manager is walked
+    // separately and the results are concatenated. Following a "g" link and then a "g2"
+    // link off the role it led to would mix two unrelated hierarchies.
+    for (const ptype of this.rmMap.keys()) {
+      res.push(...(await this.getNamedImplicitRolesForUser(ptype, name, ...domain)));
+    }
+
+    return res;
+  }
+
+  /**
+   * getNamedImplicitRolesForUser gets implicit roles that a user has, using only the
+   * given role definition. Compared to getImplicitRolesForUser(), which walks every
+   * role manager, this one is restricted to "g", "g2", ...
+   *
+   * @param ptype the role definition type, can be "g", "g2", "g3", ..
+   * @param name the user.
+   * @param domain the domain, optional.
+   */
+  public async getNamedImplicitRolesForUser(ptype: string, name: string, ...domain: string[]): Promise<string[]> {
+    const rm = this.rmMap.get(ptype);
+    if (!rm) {
+      throw new Error(`role manager ${ptype} is not initialized`);
+    }
+
+    if (rm.getImplicitRoles) {
+      return rm.getImplicitRoles(name, ...domain);
+    }
+
+    // Fallback for role managers that only expose one hop. It cannot honour a hierarchy
+    // level limit, since that limit belongs to the role manager.
+    const res: string[] = [];
+    const visited = new Set<string>([name]);
     const q = [name];
     let n: string | undefined;
     while ((n = q.shift()) !== undefined) {
-      for (const rm of this.rmMap.values()) {
-        const role = await rm.getRoles(n, ...domain);
-        role.forEach((r) => {
-          if (!res.has(r)) {
-            res.add(r);
-            q.push(r);
-          }
-        });
-      }
+      const roles = await rm.getRoles(n, ...domain);
+      roles.forEach((r) => {
+        if (!visited.has(r)) {
+          visited.add(r);
+          res.push(r);
+          q.push(r);
+        }
+      });
     }
 
-    return Array.from(res);
+    return res;
   }
 
   /**
@@ -386,16 +419,78 @@ export class Enforcer extends ManagementEnforcer {
    * But getImplicitPermissionsForUser("alice") will get: [["admin", "data1", "read"], ["alice", "data2", "read"]].
    */
   public async getImplicitPermissionsForUser(user: string, ...domain: string[]): Promise<string[][]> {
-    const roles = await this.getImplicitRolesForUser(user, ...domain);
-    roles.unshift(user);
-    const res: string[][] = [];
+    return this.getNamedImplicitPermissionsForUser('p', 'g', user, ...domain);
+  }
 
-    for (const n of roles) {
-      const p = await this.getPermissionsForUser(n, ...domain);
-      res.push(...p);
+  /**
+   * getNamedImplicitPermissionsForUser gets implicit permissions for a user or role
+   * by the named policy and the named role definition.
+   *
+   * When a domain is given, a policy rule is kept if its domain field matches that
+   * domain according to the role manager, so a rule written for a wildcard domain
+   * (e.g. "p, admin, data, read, *") is reported for every concrete domain once a
+   * domain matching function has been registered with addNamedDomainMatchingFunc().
+   * The returned rule then carries the requested domain instead of the pattern.
+   *
+   * @param ptype the policy type, can be "p", "p2", "p3", ..
+   * @param gtype the role definition type, can be "g", "g2", "g3", ..
+   * @param user the user.
+   * @param domain the domain, optional.
+   */
+  public async getNamedImplicitPermissionsForUser(ptype: string, gtype: string, user: string, ...domain: string[]): Promise<string[][]> {
+    if (domain.length > 1) {
+      throw new Error('error: domain should be 1 parameter');
     }
 
-    return res;
+    const rm = this.rmMap.get(gtype);
+    if (!rm) {
+      throw new Error(`role manager ${gtype} is not initialized`);
+    }
+
+    const roles = await this.getNamedImplicitRolesForUser(gtype, user, ...domain);
+    const policyRoles = new Set<string>(roles);
+    policyRoles.add(user);
+
+    // The subject and the domain are not necessarily the first two tokens, so both
+    // have to be looked up in the model instead of being assumed to sit at a fixed index.
+    const subIndex = this.getFieldIndex(ptype, FieldIndex.Subject);
+    if (subIndex === -1) {
+      throw new Error(`${FieldIndex.Subject} index is not set, please use enforcer.setFieldIndex() to set index`);
+    }
+
+    const permission: string[][] = [];
+    const policy = await this.getNamedPolicy(ptype);
+
+    if (domain.length === 0) {
+      for (const rule of policy) {
+        if (policyRoles.has(rule[subIndex])) {
+          permission.push([...rule]);
+        }
+      }
+      return permission;
+    }
+
+    const domIndex = this.getFieldIndex(ptype, FieldIndex.Domain);
+    if (domIndex === -1) {
+      throw new Error(`${FieldIndex.Domain} index is not set, please use enforcer.setFieldIndex() to set index`);
+    }
+
+    const d = domain[0];
+    for (const rule of policy) {
+      // match() falls back to an exact comparison unless a domain matching function
+      // has been registered, so a "*" rule only spreads across domains on request.
+      const matched = rm.match ? rm.match(d, rule[domIndex]) : d === rule[domIndex];
+      if (!matched) {
+        continue;
+      }
+      if (policyRoles.has(rule[subIndex])) {
+        const newRule = [...rule];
+        newRule[domIndex] = d;
+        permission.push(newRule);
+      }
+    }
+
+    return permission;
   }
 
   /**

src/rbac/defaultRoleManager.ts

@@ -181,6 +181,24 @@ export class DefaultRoleManager implements RoleManager {
     this.domainMatchingFunc = fn;
   }
 
+  /**
+   * match determines whether the domain str is covered by the domain pattern used
+   * in a policy or grouping rule. Without a domain matching function registered,
+   * only an exact match counts, which keeps the default behaviour unchanged.
+   *
+   * @param str the concrete domain, e.g. "tenant1"
+   * @param pattern the domain written in the rule, e.g. "*"
+   */
+  public match(str: string, pattern: string): boolean {
+    if (str === pattern) {
+      return true;
+    }
+    if (this.hasDomainPattern) {
+      return this.domainMatchingFunc(str, pattern);
+    }
+    return false;
+  }
+
   /**
    * addDomainHierarchy sets a rolemanager to define role inheritance between domains
    * @param rm RoleManager to define domain hierarchy
@@ -319,6 +337,51 @@ export class DefaultRoleManager implements RoleManager {
     return allRoles.createRole(name, this.matchingFunc).getRoles();
   }
 
+  /**
+   * getImplicitRoles gets the roles that a subject inherits, directly or through other
+   * roles. Compared to getRoles(), which only walks one hop, this follows the whole
+   * hierarchy, up to maxHierarchyLevel hops.
+   * domain is a prefix to the roles.
+   */
+  public async getImplicitRoles(name: string, ...domain: string[]): Promise<string[]> {
+    if (domain.length === 0) {
+      domain = [DEFAULT_DOMAIN];
+    } else if (domain.length > 1) {
+      throw new Error('error: domain should be 1 parameter');
+    }
+
+    // The role graph only has to be resolved once for the whole traversal.
+    const allRoles = this.generateTempRoles(domain[0]);
+
+    const res: string[] = [];
+    // Seeded with the subject so that a cycle back to it does not report the subject as
+    // one of its own roles, and so that the traversal terminates.
+    const roleSet = new Set<string>([name]);
+    let current = [name];
+
+    for (let level = 0; level < this.maxHierarchyLevel && current.length > 0; level++) {
+      const next: string[] = [];
+      for (const n of current) {
+        if (!allRoles.hasRole(n, this.matchingFunc)) {
+          continue;
+        }
+        allRoles
+          .createRole(n, this.matchingFunc)
+          .getRoles()
+          .forEach((r) => {
+            if (!roleSet.has(r)) {
+              roleSet.add(r);
+              res.push(r);
+              next.push(r);
+            }
+          });
+      }
+      current = next;
+    }
+
+    return res;
+  }
+
   /**
    * getUsers gets the users that inherits a subject.
    * domain is an unreferenced parameter here, may be used in other implementations.

src/rbac/roleManager.ts

@@ -31,11 +31,21 @@ export interface RoleManager {
   // GetRoles gets the roles that a user inherits.
   // domain is a prefix to the roles (can be used for other purposes).
   getRoles(name: string, ...domain: string[]): Promise<string[]>;
+  // GetImplicitRoles gets the roles that a user inherits, directly or through other roles,
+  // respecting the hierarchy level limit of the implementation.
+  // domain is a prefix to the roles (can be used for other purposes).
+  // Optional: when not implemented, callers fall back to walking getRoles() themselves,
+  // which cannot honour a hierarchy level limit.
+  getImplicitRoles?(name: string, ...domain: string[]): Promise<string[]>;
   // GetUsers gets the users that inherits a role.
   // domain is a prefix to the users (can be used for other purposes).
   getUsers(name: string, ...domain: string[]): Promise<string[]>;
   // PrintRoles prints all the roles to log.
   printRoles(): Promise<void>;
+  // Match determines whether the domain str is covered by the domain pattern
+  // written in a policy or grouping rule, e.g. "tenant1" against "*".
+  // Optional: when not implemented, callers fall back to an exact comparison.
+  match?(str: string, pattern: string): boolean;
   // GetDomains gets domains that a user has
   getDomains(name: string): Promise<string[]>;
   // GetAllDomains gets all domains

test/rbac/defaultRoleManager.test.ts

@@ -12,3 +12,47 @@ test('TestAllMatchingFunc', async () => {
   // 			*:/book/:id
   expect(await rm.hasLink('/book/1', 'book_group', 'domain1')).toBe(true);
 });
+
+test('TestGetImplicitRoles', async () => {
+  const rm = new DefaultRoleManager(10);
+  await rm.addLink('alice', 'admin');
+  await rm.addLink('admin', 'data1_admin');
+  await rm.addLink('admin', 'data2_admin');
+
+  expect(await rm.getRoles('alice')).toEqual(['admin']);
+  expect(await rm.getImplicitRoles('alice')).toEqual(['admin', 'data1_admin', 'data2_admin']);
+  expect(await rm.getImplicitRoles('bob')).toEqual([]);
+
+  // A cycle terminates and never reports the subject as one of its own roles.
+  await rm.addLink('data2_admin', 'alice');
+  expect(await rm.getImplicitRoles('alice')).toEqual(['admin', 'data1_admin', 'data2_admin']);
+});
+
+test('TestGetImplicitRolesRespectsMaxHierarchyLevel', async () => {
+  // role0 -> role1 -> ... -> role5
+  const chain = async (rm: DefaultRoleManager): Promise<void> => {
+    for (let i = 0; i < 5; i++) {
+      await rm.addLink(`role${i}`, `role${i + 1}`);
+    }
+  };
+
+  const rm = new DefaultRoleManager(10);
+  await chain(rm);
+  expect(await rm.getImplicitRoles('role0')).toEqual(['role1', 'role2', 'role3', 'role4', 'role5']);
+
+  // Only maxHierarchyLevel hops are followed, so the tail of the chain is cut off.
+  const shallow = new DefaultRoleManager(2);
+  await chain(shallow);
+  expect(await shallow.getImplicitRoles('role0')).toEqual(['role1', 'role2']);
+});
+
+test('TestGetImplicitRolesWithDomain', async () => {
+  const rm = new DefaultRoleManager(10);
+  await rm.addLink('alice', 'admin', 'domain1');
+  await rm.addLink('admin', 'data1_admin', 'domain1');
+  await rm.addLink('alice', 'guest', 'domain2');
+
+  expect(await rm.getImplicitRoles('alice', 'domain1')).toEqual(['admin', 'data1_admin']);
+  expect(await rm.getImplicitRoles('alice', 'domain2')).toEqual(['guest']);
+  expect(await rm.getImplicitRoles('alice', 'domain3')).toEqual([]);
+});