rbac.go

/*
goRBAC provides a lightweight role-based access control implementation
in Golang.

For the purposes of this package:

	* an identity has one or more roles.
	* a role requests access to a permission.
	* a permission is given to a role.

Thus, RBAC has the following model:

	* many to many relationship between identities and roles.
	* many to many relationship between roles and permissions.
	* roles can have parent roles.
*/

//   	rbac := middleware.NewRbac()
//   	m.Map(rbac)
//
//  	m.Get("/article/edit", func(c *middleware.Context, rbac *middleware.Rbac) {
//  		ok := rbac.IsGranted("editor", "edit.article",
//  			func(role, permission string, rbac *middleware.Rbac) bool {
//  				return article.Owner == User.Id
//  			})
//  		if ok {
//  			fmt.Println("have permission....")
//  		} else {
//  			fmt.Println("not have permission....")
//  		}
//  		c.HTML(200, "index", c.Data)
//  	})
//
//
package middleware

import (
	"sync"
)

const (
	bufferSize = 256
)

// Assertion function supplies more fine-grained permission controls.
type AssertionFunc func(string, string, *Rbac) bool

// Export RBAC to a structure data
type Map map[string]RoleMap

// RBAC
type Rbac struct {
	mutex   sync.RWMutex
	roles   map[string]Role
	factory RoleFactoryFunc
}

// Return a RBAC structure with a specific factory function.
// Role structure will be generated by the function.
func NewWithFactory(factory RoleFactoryFunc) *Rbac {
	rbac := &Rbac{
		roles:   make(map[string]Role, bufferSize),
		factory: factory,
	}
	return rbac
}

// Return a RBAC structure.
// The default role structure will be used.
func NewRbac() *Rbac {
	return NewWithFactory(newBaseRole)
}

// Restore rbac from a map, use factory for your own data structure
func RestoreWithFactory(data Map, factory RoleFactoryFunc) *Rbac {
	rbac := NewWithFactory(factory)
	for role, value := range data {
		rbac.Add(role, value[PermissionKey], value[ParentKey])
	}
	return rbac
}

// Restore rbac from a map, a default role implamentation used
func Restore(data Map) *Rbac {
	return RestoreWithFactory(data, newBaseRole)
}

// Set a role with `name`. It has `permissions` and `parents`.
// If the role is not existing, a new one will be created.
// This function will cover role's orignal permissions and parents.
func (rbac *Rbac) Set(name string, permissions []string, parents []string) {
	rbac.mutex.Lock()
	defer rbac.mutex.Unlock()
	role := rbac.getRole(name)
	role.Reset()
	for _, p := range permissions {
		role.AddPermission(p)
	}
	for _, pname := range parents {
		role.AddParent(pname)
	}
}

// Add a role with `name`. It has `permissions` and `parents`.
// If the role is not existing, a new one will be created.
// This function will add new permissions and parents to the role,
// and keep orignals.
func (rbac *Rbac) Add(name string, permissions []string, parents []string) {
	rbac.mutex.Lock()
	defer rbac.mutex.Unlock()
	role := rbac.getRole(name)
	for _, p := range permissions {
		role.AddPermission(p)
	}
	for _, pname := range parents {
		role.AddParent(pname)
	}
}

// Remove a role.
func (rbac *Rbac) Remove(name string) {
	rbac.mutex.Lock()
	defer rbac.mutex.Unlock()
	delete(rbac.roles, name)
}

// Internal getRole
func (rbac *Rbac) getRole(name string) Role {
	role, ok := rbac.roles[name]
	if !ok {
		role = rbac.factory(rbac, name)
		rbac.roles[name] = role
	}
	return role
}

// Return a role or nil if not exists.
func (rbac *Rbac) Get(name string) Role {
	rbac.mutex.RLock()
	defer rbac.mutex.RUnlock()
	role, ok := rbac.roles[name]
	if !ok {
		return nil
	}
	return role
}

// Test if the `name` has `permission` in the `assert` condition.
func (rbac *Rbac) IsGranted(name, permission string,
	assert AssertionFunc) bool {
	rbac.mutex.RLock()
	defer rbac.mutex.RUnlock()
	if assert != nil && !assert(name, permission, rbac) {
		return false
	}
	if role, ok := rbac.roles[name]; ok {
		return role.HasPermission(permission)
	}
	return false
}

// Dump RBAC
func (rbac *Rbac) Dump() Map {
	m := make(Map)
	for _, role := range rbac.roles {
		roleMap := RoleToMap(role)
		m[role.Name()] = roleMap
	}
	return m
}