llvy.ltd/casdoor
1
0
Fork 0
mirror of https://github.com/casdoor/casdoor.git synced 2025-07-03 12:30:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: update permission rule when role updated (#1477)

Browse Source
This commit is contained in:
June
2023-01-17 09:27:02 +07:00
committed by GitHub
parent d0741e3705
commit eddd8acbf4
4 changed files with 107 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
object/model.go
View File

@ -152,3 +152,7 @@ func modelChangeTrigger(oldName string, newName string) error {
return session.Commit()
}
func HasRoleDefinition(m model.Model) bool {
return m["g"] != nil
}

22
object/permission.go
View File

@ -149,19 +149,25 @@ func GetPermission(id string) *Permission {
func checkPermissionValid(permission *Permission) {
enforcer := getEnforcer(permission)
enforcer.EnableAutoSave(false)
policies, groupingPolicies := getPolicies(permission)
policies := getPolicies(permission)
_, err := enforcer.AddPolicies(policies)
if err != nil {
panic(err)
}
if !HasRoleDefinition(enforcer.GetModel()) {
permission.Roles = []string{}
return
}
groupingPolicies := getGroupingPolicies(permission)
if len(groupingPolicies) > 0 {
_, err := enforcer.AddGroupingPolicies(groupingPolicies)
if err != nil {
panic(err)
}
}
_, err := enforcer.AddPolicies(policies)
if err != nil {
panic(err)
}
}
func UpdatePermission(id string, permission *Permission) bool {
@ -178,6 +184,7 @@ func UpdatePermission(id string, permission *Permission) bool {
}
if affected != 0 {
removeGroupingPolicies(oldPermission)
removePolicies(oldPermission)
if oldPermission.Adapter != "" && oldPermission.Adapter != permission.Adapter {
isEmpty, _ := adapter.Engine.IsTableEmpty(oldPermission.Adapter)
@ -188,6 +195,7 @@ func UpdatePermission(id string, permission *Permission) bool {
}
}
}
addGroupingPolicies(permission)
addPolicies(permission)
}
@ -201,6 +209,7 @@ func AddPermission(permission *Permission) bool {
}
if affected != 0 {
addGroupingPolicies(permission)
addPolicies(permission)
}
@ -214,6 +223,7 @@ func DeletePermission(permission *Permission) bool {
}
if affected != 0 {
removeGroupingPolicies(permission)
removePolicies(permission)
if permission.Adapter != "" && permission.Adapter != "permission_rule" {
isEmpty, _ := adapter.Engine.IsTableEmpty(permission.Adapter)

109
object/permission_enforcer.go
View File

@ -50,26 +50,36 @@ func getEnforcer(permission *Permission) *casbin.Enforcer {
panic(err)
}
policyFilter := xormadapter.Filter{}
if !HasRoleDefinition(m) {
policyFilter.Ptype = []string{"p"}
err = adapter.LoadFilteredPolicy(m, policyFilter)
if err != nil {
panic(err)
}
}
enforcer, err := casbin.NewEnforcer(m, adapter)
if err != nil {
panic(err)
}
// load Policy with a specific Permission
err = enforcer.LoadFilteredPolicy(xormadapter.Filter{
V5: []string{permission.GetId()},
})
policyFilter.V5 = []string{permission.GetId()}
err = enforcer.LoadFilteredPolicy(policyFilter)
if err != nil {
panic(err)
}
return enforcer
}
func getPolicies(permission *Permission) ([][]string, [][]string) {
func getPolicies(permission *Permission) [][]string {
var policies [][]string
var groupingPolicies [][]string
permissionId := permission.GetId()
domainExist := len(permission.Domains) > 0
for _, user := range permission.Users {
for _, resource := range permission.Resources {
for _, action := range permission.Actions {
@ -83,26 +93,8 @@ func getPolicies(permission *Permission) ([][]string, [][]string) {
}
}
}
for _, role := range permission.Roles {
roleObj := GetRole(role)
for _, subUser := range roleObj.Users {
if domainExist {
for _, domain := range permission.Domains {
groupingPolicies = append(groupingPolicies, []string{subUser, domain, role, "", "", permissionId})
}
} else {
groupingPolicies = append(groupingPolicies, []string{subUser, role, "", "", "", permissionId})
}
}
for _, subRole := range roleObj.Roles {
if domainExist {
for _, domain := range permission.Domains {
groupingPolicies = append(groupingPolicies, []string{subRole, domain, role, "", "", permissionId})
}
} else {
groupingPolicies = append(groupingPolicies, []string{subRole, role, "", "", "", permissionId})
}
}
for _, resource := range permission.Resources {
for _, action := range permission.Actions {
if domainExist {
@ -115,19 +107,49 @@ func getPolicies(permission *Permission) ([][]string, [][]string) {
}
}
}
return policies, groupingPolicies
return policies
}
func getGroupingPolicies(permission *Permission) [][]string {
var groupingPolicies [][]string
domainExist := len(permission.Domains) > 0
permissionId := permission.GetId()
for _, role := range permission.Roles {
roleObj := GetRole(role)
if roleObj == nil {
continue
}
for _, subUser := range roleObj.Users {
if domainExist {
for _, domain := range permission.Domains {
groupingPolicies = append(groupingPolicies, []string{subUser, domain, role, "", "", permissionId})
}
} else {
groupingPolicies = append(groupingPolicies, []string{subUser, role, "", "", "", permissionId})
}
}
for _, subRole := range roleObj.Roles {
if domainExist {
for _, domain := range permission.Domains {
groupingPolicies = append(groupingPolicies, []string{subRole, domain, role, "", "", permissionId})
}
} else {
groupingPolicies = append(groupingPolicies, []string{subRole, role, "", "", "", permissionId})
}
}
}
return groupingPolicies
}
func addPolicies(permission *Permission) {
enforcer := getEnforcer(permission)
policies, groupingPolicies := getPolicies(permission)
if len(groupingPolicies) > 0 {
_, err := enforcer.AddGroupingPolicies(groupingPolicies)
if err != nil {
panic(err)
}
}
policies := getPolicies(permission)
_, err := enforcer.AddPolicies(policies)
if err != nil {
@ -135,9 +157,21 @@ func addPolicies(permission *Permission) {
}
}
func removePolicies(permission *Permission) {
func addGroupingPolicies(permission *Permission) {
enforcer := getEnforcer(permission)
policies, groupingPolicies := getPolicies(permission)
groupingPolicies := getGroupingPolicies(permission)
if len(groupingPolicies) > 0 {
_, err := enforcer.AddGroupingPolicies(groupingPolicies)
if err != nil {
panic(err)
}
}
}
func removeGroupingPolicies(permission *Permission) {
enforcer := getEnforcer(permission)
groupingPolicies := getGroupingPolicies(permission)
if len(groupingPolicies) > 0 {
_, err := enforcer.RemoveGroupingPolicies(groupingPolicies)
@ -145,6 +179,11 @@ func removePolicies(permission *Permission) {
panic(err)
}
}
}
func removePolicies(permission *Permission) {
enforcer := getEnforcer(permission)
policies := getPolicies(permission)
_, err := enforcer.RemovePolicies(policies)
if err != nil {

13
object/role.go
View File

@ -95,6 +95,12 @@ func UpdateRole(id string, role *Role) bool {
return false
}
permissions := GetPermissionsByRole(id)
for _, permission := range permissions {
removeGroupingPolicies(permission)
removePolicies(permission)
}
if name != role.Name {
err := roleChangeTrigger(name, role.Name)
if err != nil {
@ -107,6 +113,13 @@ func UpdateRole(id string, role *Role) bool {
panic(err)
}
newRoleID := role.GetId()
permissions = GetPermissionsByRole(newRoleID)
for _, permission := range permissions {
addGroupingPolicies(permission)
addPolicies(permission)
}
return affected != 0
}