/
default_effector.go
112 lines (100 loc) · 2.82 KB
/
default_effector.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
// Copyright 2018 The casbin Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package effector
import "errors"
// DefaultEffector is default effector for Casbin.
type DefaultEffector struct {
}
// NewDefaultEffector is the constructor for DefaultEffector.
func NewDefaultEffector() *DefaultEffector {
e := DefaultEffector{}
return &e
}
// MergeEffects merges all matching results collected by the enforcer into a single decision.
func (e *DefaultEffector) MergeEffects(expr string, effects []Effect, matches []float64, policyIndex int, policyLength int) (Effect, int, error) {
result := Indeterminate
explainIndex := -1
// short-circuit some effects in the middle
if expr != "priority(p_eft) || deny" && expr != "subjectPriority(p_eft) || deny" {
if policyIndex < policyLength-1 {
// choose not to short-circuit
return result, explainIndex, nil
}
}
// merge all effects at last
if expr == "some(where (p_eft == allow))" {
result = Indeterminate
for i, eft := range effects {
if matches[i] == 0 {
continue
}
if eft == Allow {
result = Allow
explainIndex = i
break
}
}
} else if expr == "!some(where (p_eft == deny))" {
// if no deny rules are matched, then allow
result = Allow
for i, eft := range effects {
if matches[i] == 0 {
continue
}
if eft == Deny {
result = Deny
explainIndex = i
break
}
}
} else if expr == "some(where (p_eft == allow)) && !some(where (p_eft == deny))" {
result = Indeterminate
for i, eft := range effects {
if matches[i] == 0 {
continue
}
if eft == Allow {
// set hit rule to first matched allow rule, maybe overridden by the deny part
if result == Indeterminate {
explainIndex = i
}
result = Allow
} else if eft == Deny {
result = Deny
// set hit rule to the (first) matched deny rule
explainIndex = i
break
}
}
} else if expr == "priority(p_eft) || deny" || expr == "subjectPriority(p_eft) || deny" {
result = Indeterminate
for i, eft := range effects {
if matches[i] == 0 {
continue
}
if eft != Indeterminate {
if eft == Allow {
result = Allow
} else {
result = Deny
}
explainIndex = i
break
}
}
} else {
return Deny, -1, errors.New("unsupported effect")
}
return result, explainIndex, nil
}