forked from euroteltr/rbac
-
Notifications
You must be signed in to change notification settings - Fork 0
/
role.go
142 lines (126 loc) · 3.67 KB
/
role.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
package rbac
import (
"fmt"
"sync"
)
// Role defines a role
type Role struct {
ID string `json:"id"`
Description string `json:"description"`
sync.Map `json:"-"` // key: permissionID, values sync.Map[action]=true/false
parents sync.Map
}
type grantsMap map[string][]Action
// RoleGrants is used during JSON Marshalling
type RoleGrants struct {
ID string `json:"id"`
Description string `json:"description"`
Grants grantsMap `json:"grants"`
Parents []string `json:"parents"`
}
func (r *Role) grant(p *Permission, actions ...Action) {
var acts interface{}
var ok bool
if acts, ok = r.Load(p.ID); !ok {
acts = &sync.Map{}
r.Store(p.ID, acts)
}
for _, a := range actions {
acts.(*sync.Map).Store(a, true)
}
}
func (r *Role) revoke(p *Permission, actions ...Action) {
if acts, ok := r.Load(p.ID); ok {
for _, a := range actions {
acts.(*sync.Map).Store(a, false)
}
// Remove permission from role if all actions are false
hasTrue := false
acts.(*sync.Map).Range(func(_, v interface{}) bool {
if v.(bool) == true {
hasTrue = true
return false
}
return true
})
if !hasTrue {
log.Debugf("Deleting permission %s from role %s as no valid action found", p.ID, r.ID)
r.Delete(p.ID)
}
}
}
func (r *Role) isGranted(p *Permission, actions ...Action) (res bool) {
return r.isGrantedStr(p.ID, actions...)
}
func (r *Role) isGrantedStr(pID string, actions ...Action) bool {
if acts, ok := r.Load(pID); ok {
for _, a := range actions {
resI, ok := acts.(*sync.Map).Load(a)
if !ok || resI.(bool) == false {
log.Debugf("action %s is not granted to perm %s, found %v, %v", a, pID, ok, resI.(bool))
return false
}
}
return true
}
log.Debugf("permission %s is not granted to role %s", pID, r.ID)
return false
}
func (r *Role) getGrants() grantsMap {
var res = make(map[string][]Action)
r.Range(func(permID, v interface{}) bool {
if _, ok := res[permID.(string)]; !ok {
res[permID.(string)] = []Action{}
}
v.(*sync.Map).Range(func(a, _ interface{}) bool {
res[permID.(string)] = append(res[permID.(string)], a.(Action))
return true
})
return true
})
return res
}
// HasParent checks if a role is in parent roles
func (r *Role) HasParent(parentID string) bool {
_, ok := r.parents.Load(parentID)
return ok
}
// AddParent Adds parent role
func (r *Role) AddParent(parentRole *Role) error {
if _, ok := r.parents.Load(parentRole.ID); ok {
log.Errorf("parent role with ID %s is already defined for role %s", parentRole.ID, r.ID)
return fmt.Errorf("parent role with ID %s is already defined for role %s", parentRole.ID, r.ID)
}
if parentRole.HasParent(r.ID) {
log.Errorf("circular reference is found for parentrole:%s while adding to role:%s", parentRole.ID, r.ID)
return fmt.Errorf("circular reference is found for parentrole:%s while adding to role:%s", parentRole.ID, r.ID)
}
r.parents.Store(parentRole.ID, parentRole)
return nil
}
// RemoveParent removes parent role
func (r *Role) RemoveParent(parentRole *Role) error {
if _, ok := r.parents.Load(parentRole.ID); !ok {
log.Errorf("parent role with ID %s is not defined for role %s", parentRole.ID, r.ID)
return fmt.Errorf("parent role with ID %s is not defined for role %s", parentRole.ID, r.ID)
}
r.parents.Delete(parentRole.ID)
return nil
}
// Parents returns list of parent roles
func (r *Role) Parents() []*Role {
res := []*Role{}
r.parents.Range(func(_, v interface{}) bool {
res = append(res, v.(*Role))
return true
})
return res
}
// ParentIDs return a list of parent role IDs
func (r *Role) ParentIDs() []string {
res := []string{}
for _, r := range r.Parents() {
res = append(res, r.ID)
}
return res
}