mirror of
https://github.com/shishantbiswas/bknd.git
synced 2026-03-16 04:27:21 +00:00
refactor: restructure permission handling and enhance Guard functionality
- Introduced a new `createGuard` function to streamline the creation of Guard instances with permissions and roles. - Updated tests in `authorize.spec.ts` to reflect changes in permission checks, ensuring they now return undefined for denied permissions. - Added new `Permission` and `Policy` classes to improve type safety and flexibility in permission management. - Refactored middleware and controller files to utilize the updated permission structure, including context handling for permissions. - Created a new `SystemController.spec.ts` file to test the integration of the new permission system within the SystemController. - Removed legacy permission handling from core security files, consolidating permission logic within the new structure.
This commit is contained in:
dswbx
20
app/__test__/auth/authorize/SystemController.spec.ts
Normal file
20
app/__test__/auth/authorize/SystemController.spec.ts
Normal file
@@ -0,0 +1,20 @@
|
||||
import { describe, it, expect } from "bun:test";
|
||||
import { SystemController } from "modules/server/SystemController";
|
||||
import { createApp } from "core/test/utils";
|
||||
import type { CreateAppConfig } from "App";
|
||||
import { getPermissionRoutes } from "auth/middlewares/permission.middleware";
|
||||
|
||||
async function makeApp(config: Partial<CreateAppConfig> = {}) {
|
||||
const app = createApp(config);
|
||||
await app.build();
|
||||
return app;
|
||||
}
|
||||
|
||||
describe("SystemController", () => {
|
||||
it("...", async () => {
|
||||
const app = await makeApp();
|
||||
const controller = new SystemController(app);
|
||||
const hono = controller.getController();
|
||||
console.log(getPermissionRoutes(hono));
|
||||
});
|
||||
});
|
||||
@@ -1,13 +1,36 @@
|
||||
import { describe, expect, test } from "bun:test";
|
||||
import { Guard } from "auth/authorize/Guard";
|
||||
import { Permission } from "core/security/Permission";
|
||||
import { Guard, type GuardConfig } from "auth/authorize/Guard";
|
||||
import { Permission } from "auth/authorize/Permission";
|
||||
import { Role } from "auth/authorize/Role";
|
||||
import { objectTransform } from "bknd/utils";
|
||||
|
||||
function createGuard(
|
||||
permissionNames: string[],
|
||||
roles?: Record<
|
||||
string,
|
||||
{
|
||||
permissions?: string[];
|
||||
is_default?: boolean;
|
||||
implicit_allow?: boolean;
|
||||
}
|
||||
>,
|
||||
config?: GuardConfig,
|
||||
) {
|
||||
const _roles = roles
|
||||
? objectTransform(roles, ({ permissions = [], is_default, implicit_allow }, name) => {
|
||||
return Role.create({ name, permissions, is_default, implicit_allow });
|
||||
})
|
||||
: {};
|
||||
const _permissions = permissionNames.map((name) => new Permission(name));
|
||||
return new Guard(_permissions, Object.values(_roles), config);
|
||||
}
|
||||
|
||||
describe("authorize", () => {
|
||||
const read = new Permission("read");
|
||||
const write = new Permission("write");
|
||||
|
||||
test("basic", async () => {
|
||||
const guard = Guard.create(
|
||||
const guard = createGuard(
|
||||
["read", "write"],
|
||||
{
|
||||
admin: {
|
||||
@@ -20,14 +43,14 @@ describe("authorize", () => {
|
||||
role: "admin",
|
||||
};
|
||||
|
||||
expect(guard.granted(read, user)).toBe(true);
|
||||
expect(guard.granted(write, user)).toBe(true);
|
||||
expect(guard.granted(read, user)).toBeUndefined();
|
||||
expect(guard.granted(write, user)).toBeUndefined();
|
||||
|
||||
expect(() => guard.granted(new Permission("something"))).toThrow();
|
||||
expect(() => guard.granted(new Permission("something"), {})).toThrow();
|
||||
});
|
||||
|
||||
test("with default", async () => {
|
||||
const guard = Guard.create(
|
||||
const guard = createGuard(
|
||||
["read", "write"],
|
||||
{
|
||||
admin: {
|
||||
@@ -41,26 +64,26 @@ describe("authorize", () => {
|
||||
{ enabled: true },
|
||||
);
|
||||
|
||||
expect(guard.granted(read)).toBe(true);
|
||||
expect(guard.granted(write)).toBe(false);
|
||||
expect(guard.granted(read, {})).toBeUndefined();
|
||||
expect(() => guard.granted(write, {})).toThrow();
|
||||
|
||||
const user = {
|
||||
role: "admin",
|
||||
};
|
||||
|
||||
expect(guard.granted(read, user)).toBe(true);
|
||||
expect(guard.granted(write, user)).toBe(true);
|
||||
expect(guard.granted(read, user)).toBeUndefined();
|
||||
expect(guard.granted(write, user)).toBeUndefined();
|
||||
});
|
||||
|
||||
test("guard implicit allow", async () => {
|
||||
const guard = Guard.create([], {}, { enabled: false });
|
||||
const guard = createGuard([], {}, { enabled: false });
|
||||
|
||||
expect(guard.granted(read)).toBe(true);
|
||||
expect(guard.granted(write)).toBe(true);
|
||||
expect(guard.granted(read, {})).toBeUndefined();
|
||||
expect(guard.granted(write, {})).toBeUndefined();
|
||||
});
|
||||
|
||||
test("role implicit allow", async () => {
|
||||
const guard = Guard.create(["read", "write"], {
|
||||
const guard = createGuard(["read", "write"], {
|
||||
admin: {
|
||||
implicit_allow: true,
|
||||
},
|
||||
@@ -70,12 +93,12 @@ describe("authorize", () => {
|
||||
role: "admin",
|
||||
};
|
||||
|
||||
expect(guard.granted(read, user)).toBe(true);
|
||||
expect(guard.granted(write, user)).toBe(true);
|
||||
expect(guard.granted(read, user)).toBeUndefined();
|
||||
expect(guard.granted(write, user)).toBeUndefined();
|
||||
});
|
||||
|
||||
test("guard with guest role implicit allow", async () => {
|
||||
const guard = Guard.create(["read", "write"], {
|
||||
const guard = createGuard(["read", "write"], {
|
||||
guest: {
|
||||
implicit_allow: true,
|
||||
is_default: true,
|
||||
@@ -83,7 +106,7 @@ describe("authorize", () => {
|
||||
});
|
||||
|
||||
expect(guard.getUserRole()?.name).toBe("guest");
|
||||
expect(guard.granted(read)).toBe(true);
|
||||
expect(guard.granted(write)).toBe(true);
|
||||
expect(guard.granted(read, {})).toBeUndefined();
|
||||
expect(guard.granted(write, {})).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
@@ -1,6 +1,13 @@
|
||||
import { describe, it, expect } from "bun:test";
|
||||
import { s } from "bknd/utils";
|
||||
import { Permission, Policy } from "core/security/Permission";
|
||||
import { Permission } from "auth/authorize/Permission";
|
||||
import { Policy } from "auth/authorize/Policy";
|
||||
import { Hono } from "hono";
|
||||
import { permission } from "auth/middlewares/permission.middleware";
|
||||
import { auth } from "auth/middlewares/auth.middleware";
|
||||
import { Guard, type GuardConfig } from "auth/authorize/Guard";
|
||||
import { Role, RolePermission } from "auth/authorize/Role";
|
||||
import { Exception } from "bknd";
|
||||
|
||||
describe("Permission", () => {
|
||||
it("works with minimal schema", () => {
|
||||
@@ -91,3 +98,331 @@ describe("Policy", () => {
|
||||
expect(p.meetsFilter({ a: "test2" })).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe("Guard", () => {
|
||||
it("collects filters", () => {
|
||||
const p = new Permission(
|
||||
"test",
|
||||
{
|
||||
filterable: true,
|
||||
},
|
||||
s.object({
|
||||
a: s.number(),
|
||||
}),
|
||||
);
|
||||
const r = new Role("test", [
|
||||
new RolePermission(p, [
|
||||
new Policy({
|
||||
filter: { a: { $eq: 1 } },
|
||||
effect: "filter",
|
||||
}),
|
||||
]),
|
||||
]);
|
||||
const guard = new Guard([p], [r], {
|
||||
enabled: true,
|
||||
});
|
||||
expect(
|
||||
guard.getPolicyFilter(
|
||||
p,
|
||||
{
|
||||
role: r.name,
|
||||
},
|
||||
{ a: 1 },
|
||||
),
|
||||
).toEqual({ a: { $eq: 1 } });
|
||||
expect(
|
||||
guard.getPolicyFilter(
|
||||
p,
|
||||
{
|
||||
role: r.name,
|
||||
},
|
||||
{ a: 2 },
|
||||
),
|
||||
).toBeUndefined();
|
||||
// if no user context given, filter cannot be applied
|
||||
expect(guard.getPolicyFilter(p, {}, { a: 1 })).toBeUndefined();
|
||||
});
|
||||
|
||||
it("collects filters for default role", () => {
|
||||
const p = new Permission(
|
||||
"test",
|
||||
{
|
||||
filterable: true,
|
||||
},
|
||||
s.object({
|
||||
a: s.number(),
|
||||
}),
|
||||
);
|
||||
const r = new Role(
|
||||
"test",
|
||||
[
|
||||
new RolePermission(p, [
|
||||
new Policy({
|
||||
filter: { a: { $eq: 1 } },
|
||||
effect: "filter",
|
||||
}),
|
||||
]),
|
||||
],
|
||||
true,
|
||||
);
|
||||
const guard = new Guard([p], [r], {
|
||||
enabled: true,
|
||||
});
|
||||
|
||||
expect(
|
||||
guard.getPolicyFilter(
|
||||
p,
|
||||
{
|
||||
role: r.name,
|
||||
},
|
||||
{ a: 1 },
|
||||
),
|
||||
).toEqual({ a: { $eq: 1 } });
|
||||
expect(
|
||||
guard.getPolicyFilter(
|
||||
p,
|
||||
{
|
||||
role: r.name,
|
||||
},
|
||||
{ a: 2 },
|
||||
),
|
||||
).toBeUndefined();
|
||||
// if no user context given, the default role is applied
|
||||
// hence it can be found
|
||||
expect(guard.getPolicyFilter(p, {}, { a: 1 })).toEqual({ a: { $eq: 1 } });
|
||||
});
|
||||
});
|
||||
|
||||
describe("permission middleware", () => {
|
||||
const makeApp = (
|
||||
permissions: Permission<any, any, any, any>[],
|
||||
roles: Role[] = [],
|
||||
config: Partial<GuardConfig> = {},
|
||||
) => {
|
||||
const app = {
|
||||
module: {
|
||||
auth: {
|
||||
enabled: true,
|
||||
},
|
||||
},
|
||||
modules: {
|
||||
ctx: () => ({
|
||||
guard: new Guard(permissions, roles, {
|
||||
enabled: true,
|
||||
...config,
|
||||
}),
|
||||
}),
|
||||
},
|
||||
};
|
||||
return new Hono()
|
||||
.use(async (c, next) => {
|
||||
// @ts-expect-error
|
||||
c.set("app", app);
|
||||
await next();
|
||||
})
|
||||
.use(auth())
|
||||
.onError((err, c) => {
|
||||
if (err instanceof Exception) {
|
||||
return c.json(err.toJSON(), err.code as any);
|
||||
}
|
||||
return c.json({ error: err.message }, "code" in err ? (err.code as any) : 500);
|
||||
});
|
||||
};
|
||||
|
||||
it("allows if guard is disabled", async () => {
|
||||
const p = new Permission("test");
|
||||
const hono = makeApp([p], [], { enabled: false }).get("/test", permission(p, {}), async (c) =>
|
||||
c.text("test"),
|
||||
);
|
||||
|
||||
const res = await hono.request("/test");
|
||||
expect(res.status).toBe(200);
|
||||
expect(await res.text()).toBe("test");
|
||||
});
|
||||
|
||||
it("denies if guard is enabled", async () => {
|
||||
const p = new Permission("test");
|
||||
const hono = makeApp([p]).get("/test", permission(p, {}), async (c) => c.text("test"));
|
||||
|
||||
const res = await hono.request("/test");
|
||||
expect(res.status).toBe(403);
|
||||
});
|
||||
|
||||
it("allows if user has (plain) role", async () => {
|
||||
const p = new Permission("test");
|
||||
const r = Role.create({ name: "test", permissions: [p.name] });
|
||||
const hono = makeApp([p], [r])
|
||||
.use(async (c, next) => {
|
||||
// @ts-expect-error
|
||||
c.set("auth", { registered: true, user: { id: 0, role: r.name } });
|
||||
await next();
|
||||
})
|
||||
.get("/test", permission(p, {}), async (c) => c.text("test"));
|
||||
|
||||
const res = await hono.request("/test");
|
||||
expect(res.status).toBe(200);
|
||||
});
|
||||
|
||||
it("allows if user has role with policy", async () => {
|
||||
const p = new Permission("test");
|
||||
const r = new Role("test", [
|
||||
new RolePermission(p, [
|
||||
new Policy({
|
||||
condition: {
|
||||
a: { $gte: 1 },
|
||||
},
|
||||
}),
|
||||
]),
|
||||
]);
|
||||
const hono = makeApp([p], [r], {
|
||||
context: {
|
||||
a: 1,
|
||||
},
|
||||
})
|
||||
.use(async (c, next) => {
|
||||
// @ts-expect-error
|
||||
c.set("auth", { registered: true, user: { id: 0, role: r.name } });
|
||||
await next();
|
||||
})
|
||||
.get("/test", permission(p, {}), async (c) => c.text("test"));
|
||||
|
||||
const res = await hono.request("/test");
|
||||
expect(res.status).toBe(200);
|
||||
});
|
||||
|
||||
it("denies if user with role doesn't meet condition", async () => {
|
||||
const p = new Permission("test");
|
||||
const r = new Role("test", [
|
||||
new RolePermission(p, [
|
||||
new Policy({
|
||||
condition: {
|
||||
a: { $lt: 1 },
|
||||
},
|
||||
}),
|
||||
]),
|
||||
]);
|
||||
const hono = makeApp([p], [r], {
|
||||
context: {
|
||||
a: 1,
|
||||
},
|
||||
})
|
||||
.use(async (c, next) => {
|
||||
// @ts-expect-error
|
||||
c.set("auth", { registered: true, user: { id: 0, role: r.name } });
|
||||
await next();
|
||||
})
|
||||
.get("/test", permission(p, {}), async (c) => c.text("test"));
|
||||
|
||||
const res = await hono.request("/test");
|
||||
expect(res.status).toBe(403);
|
||||
});
|
||||
|
||||
it("allows if user with role doesn't meet condition (from middleware)", async () => {
|
||||
const p = new Permission(
|
||||
"test",
|
||||
{},
|
||||
s.object({
|
||||
a: s.number(),
|
||||
}),
|
||||
);
|
||||
const r = new Role("test", [
|
||||
new RolePermission(p, [
|
||||
new Policy({
|
||||
condition: {
|
||||
a: { $eq: 1 },
|
||||
},
|
||||
}),
|
||||
]),
|
||||
]);
|
||||
const hono = makeApp([p], [r])
|
||||
.use(async (c, next) => {
|
||||
// @ts-expect-error
|
||||
c.set("auth", { registered: true, user: { id: 0, role: r.name } });
|
||||
await next();
|
||||
})
|
||||
.get(
|
||||
"/test",
|
||||
permission(p, {
|
||||
context: (c) => ({
|
||||
a: 1,
|
||||
}),
|
||||
}),
|
||||
async (c) => c.text("test"),
|
||||
);
|
||||
|
||||
const res = await hono.request("/test");
|
||||
expect(res.status).toBe(200);
|
||||
});
|
||||
|
||||
it("throws if permission context is invalid", async () => {
|
||||
const p = new Permission(
|
||||
"test",
|
||||
{},
|
||||
s.object({
|
||||
a: s.number({ minimum: 2 }),
|
||||
}),
|
||||
);
|
||||
const r = new Role("test", [
|
||||
new RolePermission(p, [
|
||||
new Policy({
|
||||
condition: {
|
||||
a: { $eq: 1 },
|
||||
},
|
||||
}),
|
||||
]),
|
||||
]);
|
||||
const hono = makeApp([p], [r])
|
||||
.use(async (c, next) => {
|
||||
// @ts-expect-error
|
||||
c.set("auth", { registered: true, user: { id: 0, role: r.name } });
|
||||
await next();
|
||||
})
|
||||
.get(
|
||||
"/test",
|
||||
permission(p, {
|
||||
context: (c) => ({
|
||||
a: 1,
|
||||
}),
|
||||
}),
|
||||
async (c) => c.text("test"),
|
||||
);
|
||||
|
||||
const res = await hono.request("/test");
|
||||
// expecting 500 because bknd should have handled it correctly
|
||||
expect(res.status).toBe(500);
|
||||
});
|
||||
});
|
||||
|
||||
describe("Role", () => {
|
||||
it("serializes and deserializes", () => {
|
||||
const p = new Permission(
|
||||
"test",
|
||||
{
|
||||
filterable: true,
|
||||
},
|
||||
s.object({
|
||||
a: s.number({ minimum: 2 }),
|
||||
}),
|
||||
);
|
||||
const r = new Role(
|
||||
"test",
|
||||
[
|
||||
new RolePermission(p, [
|
||||
new Policy({
|
||||
condition: {
|
||||
a: { $eq: 1 },
|
||||
},
|
||||
effect: "deny",
|
||||
filter: {
|
||||
b: { $lt: 1 },
|
||||
},
|
||||
}),
|
||||
]),
|
||||
],
|
||||
true,
|
||||
);
|
||||
const json = JSON.parse(JSON.stringify(r.toJSON()));
|
||||
const r2 = Role.create(json);
|
||||
expect(r2.toJSON()).toEqual(r.toJSON());
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user