diff --git a/examples/abac_not_using_policy_model.conf b/examples/abac_not_using_policy_model.conf new file mode 100644 index 00000000..3dfaae41 --- /dev/null +++ b/examples/abac_not_using_policy_model.conf @@ -0,0 +1,11 @@ +[request_definition] +r = sub, obj, act + +[policy_definition] +p = sub, obj, act, eft + +[policy_effect] +e = some(where (p.eft == allow)) && !some(where (p.eft == deny)) + +[matchers] +m = r.sub == r.obj.Owner diff --git a/examples/abac_rule_effect_policy.csv b/examples/abac_rule_effect_policy.csv new file mode 100644 index 00000000..aa473940 --- /dev/null +++ b/examples/abac_rule_effect_policy.csv @@ -0,0 +1,4 @@ +p, alice, /data1, read, deny +p, alice, /data1, write, allow +p, bob, /data2, write, deny +p, bob, /data2, read, allow diff --git a/src/main/java/org/casbin/jcasbin/main/CoreEnforcer.java b/src/main/java/org/casbin/jcasbin/main/CoreEnforcer.java index ad4867d8..c3595c39 100644 --- a/src/main/java/org/casbin/jcasbin/main/CoreEnforcer.java +++ b/src/main/java/org/casbin/jcasbin/main/CoreEnforcer.java @@ -571,7 +571,7 @@ private EnforceResult enforce(String matcher, Object... rvals) { final int policyLen = policy.size(); int explainIndex = -1; - if (policyLen != 0) { + if (policyLen != 0 && expString.contains(pType+"_")) { policyEffects = new Effect[policyLen]; matcherResults = new float[policyLen]; diff --git a/src/test/java/org/casbin/jcasbin/main/ModelUnitTest.java b/src/test/java/org/casbin/jcasbin/main/ModelUnitTest.java index 7ebfb40a..e5ae8db7 100644 --- a/src/test/java/org/casbin/jcasbin/main/ModelUnitTest.java +++ b/src/test/java/org/casbin/jcasbin/main/ModelUnitTest.java @@ -524,6 +524,64 @@ public void testABACTypes(){ } } + @Test + public void testABACJsonRequest(){ + Enforcer e1 = new Enforcer("examples/abac_model.conf"); + e1.enableAcceptJsonRequest(true); + + Map data1Json = new HashMap(); + data1Json.put("Name", "data1"); + data1Json.put("Owner", "alice"); + Map data2Json = new HashMap(); + data2Json.put("Name", "data2"); + data2Json.put("Owner", "bob"); + + testEnforce(e1, "alice", data1Json, "read", true); + testEnforce(e1, "alice", data1Json, "write", true); + testEnforce(e1, "alice", data2Json, "read", false); + testEnforce(e1, "alice", data2Json, "write", false); + testEnforce(e1, "bob", data1Json, "read", false); + testEnforce(e1, "bob", data1Json, "write", false); + testEnforce(e1, "bob", data2Json, "read", true); + testEnforce(e1, "bob", data2Json, "write", true); + + + Enforcer e2 = new Enforcer("examples/abac_not_using_policy_model.conf", "examples/abac_rule_effect_policy.csv"); + e2.enableAcceptJsonRequest(true); + + testEnforce(e2, "alice", data1Json, "read", true); + testEnforce(e2, "alice", data1Json, "write", true); + testEnforce(e2, "alice", data2Json, "read", false); + testEnforce(e2, "alice", data2Json, "write", false); + + + Enforcer e3 = new Enforcer("examples/abac_rule_model.conf", "examples/abac_rule_policy.csv"); + e3.enableAcceptJsonRequest(true); + + Map sub1Json = new HashMap(); + sub1Json.put("Name", "alice"); + sub1Json.put("Age", 16); + Map sub2Json = new HashMap(); + sub2Json.put("Name", "alice"); + sub2Json.put("Age", 20); + Map sub3Json = new HashMap(); + sub3Json.put("Name", "alice"); + sub3Json.put("Age", 65); + + testEnforce(e3, sub1Json, "/data1", "read", false); + testEnforce(e3, sub1Json, "/data2", "read", false); + testEnforce(e3, sub1Json, "/data1", "write", false); + testEnforce(e3, sub1Json, "/data2", "write", true); + testEnforce(e3, sub2Json, "/data1", "read", true); + testEnforce(e3, sub2Json, "/data2", "read", false); + testEnforce(e3, sub2Json, "/data1", "write", false); + testEnforce(e3, sub2Json, "/data2", "write", true); + testEnforce(e3, sub3Json, "/data1", "read", true); + testEnforce(e3, sub3Json, "/data2", "read", false); + testEnforce(e3, sub3Json, "/data1", "write", false); + testEnforce(e3, sub3Json, "/data2", "write", false); + } + @Test public void testKeyMatchModel() { Enforcer e = new Enforcer("examples/keymatch_model.conf", "examples/keymatch_policy.csv"); @@ -615,6 +673,19 @@ public void testPriorityModelIndeterminate() { testEnforce(e, "alice", "data1", "read", false); } + @Test + public void testABACNotUsingPolicy(){ + Enforcer e = new Enforcer("examples/abac_not_using_policy_model.conf", "examples/abac_rule_effect_policy.csv"); + + TestResource data1 = new TestResource("data1", "alice"); + TestResource data2 = new TestResource("data2", "bob"); + + testEnforce(e, "alice", data1, "read", true); + testEnforce(e, "alice", data1, "write", true); + testEnforce(e, "alice", data2, "read", false); + testEnforce(e, "alice", data2, "write", false); + } + @Test public void testSubjectPriorityWithDomain() { Enforcer e = new Enforcer("examples/subject_priority_model_with_domain.conf", "examples/subject_priority_policy_with_domain.csv");