feat: add priority_policy_explicit support

examples/priority_model_explicit.conf

@@ -0,0 +1,14 @@
+[request_definition]
+r = sub, obj, act
+
+[policy_definition]
+p = priority, sub, obj, act, eft
+
+[role_definition]
+g = _, _
+
+[policy_effect]
+e = priority(p.eft) || deny
+
+[matchers]
+m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act

examples/priority_policy_explicit.csv

@@ -0,0 +1,12 @@
+p, 10, data1_deny_group, data1, read, deny
+p, 10, data1_deny_group, data1, write, deny
+p, 10, data2_allow_group, data2, read, allow
+p, 10, data2_allow_group, data2, write, allow
+
+
+p, 1, alice, data1, write, allow
+p, 1, alice, data1, read, allow
+p, 1, bob, data2, read, deny
+
+g, bob, data2_allow_group
+g, alice, data1_deny_group

src/coreEnforcer.ts

@@ -18,7 +18,16 @@ import { DefaultEffector, Effect, Effector } from './effect';
 import { FunctionMap, Model, newModel, PolicyOp } from './model';
 import { Adapter, FilteredAdapter, Watcher, BatchAdapter, UpdatableAdapter } from './persist';
 import { DefaultRoleManager, RoleManager } from './rbac';
-import { escapeAssertion, generateGFunction, getEvalValue, hasEval, replaceEval, generatorRunSync, generatorRunAsync } from './util';
+import {
+  escapeAssertion,
+  generateGFunction,
+  getEvalValue,
+  hasEval,
+  replaceEval,
+  generatorRunSync,
+  generatorRunAsync,
+  policySortByPriority,
+} from './util';
 import { getLogger, logPrint } from './log';
 import { MatchingFunc } from './rbac';
 
@@ -160,6 +169,16 @@ export class CoreEnforcer {
     this.model.clearPolicy();
     await this.adapter.loadPolicy(this.model);
 
+    const policy = this.model.model.get('p')?.get('p')?.policy;
+    const tokens = this.model.model.get('p')?.get('p')?.tokens;
+
+    if (policy && tokens) {
+      const priorityIndex = tokens.indexOf('p_priority');
+      if (priorityIndex !== -1) {
+        policySortByPriority(priorityIndex, policy);
+      }
+    }
+
     this.initRmMap();
 
     if (this.autoBuildRoleLinks) {
@@ -182,6 +201,16 @@ export class CoreEnforcer {
       throw new Error('filtered policies are not supported by this adapter');
     }
 
+    const policy = this.model.model.get('p')?.get('p')?.policy;
+    const tokens = this.model.model.get('p')?.get('p')?.tokens;
+
+    if (policy && tokens) {
+      const priorityIndex = tokens.indexOf('p_priority');
+      if (priorityIndex !== -1) {
+        policySortByPriority(priorityIndex, policy);
+      }
+    }
+
     this.initRmMap();
 
     if (this.autoBuildRoleLinks) {

src/internalEnforcer.ts

@@ -45,6 +45,7 @@ export class InternalEnforcer extends CoreEnforcer {
     }
 
     const ok = this.model.addPolicy(sec, ptype, rule);
+
     if (sec === 'g' && ok) {
       await this.buildIncrementalRoleLinks(PolicyOp.PolicyAdd, ptype, [rule]);
     }

src/model/model.ts

@@ -220,7 +220,19 @@ export class Model {
       if (!ast) {
         return false;
       }
-      ast.policy.push(rule);
+
+      const policy = ast.policy;
+      const tokens = ast.tokens;
+
+      if (tokens.find((str) => str === 'p_priority')) {
+        const targetPriorityIndex = tokens.indexOf('p_priority');
+        const rulePriority = rule[targetPriorityIndex];
+        const targetInsertIndex = policy.findIndex((oneRule) => oneRule[targetPriorityIndex] >= rulePriority);
+        // If targetInsertIndex returns -1, next line will still work as expected.
+        policy.splice(targetInsertIndex, 0, rule);
+      } else {
+        policy.push(rule);
+      }
       return true;
     }
 
@@ -240,7 +252,22 @@ export class Model {
       }
     }
 
-    ast.policy = ast.policy.concat(rules);
+    let priorityFlag = false;
+
+    if (rules.length > 0) {
+      const tmpRule = rules[0];
+      if (tmpRule.find((value) => value === 'p_priority')) {
+        priorityFlag = true;
+      }
+    }
+
+    if (priorityFlag) {
+      rules.forEach((rule) => {
+        this.addPolicy(sec, ptype, rule);
+      });
+    } else {
+      ast.policy = ast.policy.concat(rules);
+    }
 
     return [true, rules];
   }

src/util/util.ts

@@ -159,6 +159,12 @@ async function generatorRunAsync(iterator: Generator<any>): Promise<any> {
   }
 }
 
+function policySortByPriority(priorityIndex: number, policy: Array<Array<string>>): void {
+  policy.sort((a, b) => {
+    return parseInt(a[priorityIndex], 10) - parseInt(b[priorityIndex], 10);
+  });
+}
+
 export {
   escapeAssertion,
   removeComments,
@@ -175,4 +181,5 @@ export {
   getEvalValue,
   generatorRunSync,
   generatorRunAsync,
+  policySortByPriority,
 };

test/model.test.ts

@@ -287,6 +287,34 @@ test('TestPriorityModel', async () => {
   await testEnforce(e, 'bob', 'data2', 'write', false);
 });
 
+test('TestExplicitPriorityModel', async () => {
+  const e = await newEnforcer('examples/priority_model_explicit.conf', 'examples/priority_policy_explicit.csv');
+
+  await testEnforce(e, 'alice', 'data1', 'write', true);
+  await testEnforce(e, 'alice', 'data1', 'read', true);
+  await testEnforce(e, 'bob', 'data2', 'read', false);
+  await testEnforce(e, 'bob', 'data2', 'write', true);
+  await testEnforce(e, 'data1_deny_group', 'data1', 'read', false);
+  await testEnforce(e, 'data1_deny_group', 'data1', 'write', false);
+  await testEnforce(e, 'data2_allow_group', 'data2', 'read', true);
+  await testEnforce(e, 'data2_allow_group', 'data2', 'write', true);
+});
+
+test('TestExplicitPriorityModelAdd', async () => {
+  const e = await newEnforcer('examples/priority_model_explicit.conf', 'examples/priority_policy_explicit.csv');
+
+  await e.addPolicy('1', 'bob', 'data2', 'write', 'deny');
+
+  await testEnforce(e, 'alice', 'data1', 'write', true);
+  await testEnforce(e, 'alice', 'data1', 'read', true);
+  await testEnforce(e, 'bob', 'data2', 'read', false);
+  await testEnforce(e, 'bob', 'data2', 'write', false);
+  await testEnforce(e, 'data1_deny_group', 'data1', 'read', false);
+  await testEnforce(e, 'data1_deny_group', 'data1', 'write', false);
+  await testEnforce(e, 'data2_allow_group', 'data2', 'read', true);
+  await testEnforce(e, 'data2_allow_group', 'data2', 'write', true);
+});
+
 test('TestPriorityModelIndeterminate', async () => {
   const e = await newEnforcer('examples/priority_model.conf', 'examples/priority_indeterminate_policy.csv');