rbac.go

/*
goRBAC provides a lightweight role-based access control implementation
in Golang.

For the purposes of this package:

	* an identity has one or more roles.
	* a role requests access to a permission.
	* a permission is given to a role.

Thus, RBAC has the following model:

	* many to many relationship between identities and roles.
	* many to many relationship between roles and permissions.
	* roles can have parent roles.
*/
package gorbac

import (
	"strconv"
	"sync"
)

const (
	bufferSize = 16
)

// Assertion function supplies more fine-grained permission controls.
type AssertionFunc func(string, string, *Rbac) bool

// Export RBAC to a structure data
type Map map[string]RoleMap

// RBAC
type Rbac struct {
	mutex   sync.RWMutex
	roles   map[string]Role
	factory RoleFactoryFunc
}

// Return a RBAC structure with a specific factory function.
// Role structure will be generated by the function.
func NewWithFactory(factory RoleFactoryFunc) *Rbac {
	rbac := &Rbac{
		roles:   make(map[string]Role, bufferSize),
		factory: factory,
	}
	return rbac
}

// Return a RBAC structure.
// The default role structure will be used.
func New() *Rbac {
	return NewWithFactory(newBaseRole)
}

// Restore rbac from a map, use factory for your own data structure
func RestoreWithFactory(data Map, factory RoleFactoryFunc) *Rbac {
	rbac := NewWithFactory(factory)
	for role, value := range data {
		rbac.Add(value[RankKey].(int), role, value[PermissionKey].([]string), value[ParentKey].([]string), value[DescriptionKey].(string))
	}
	return rbac
}

// Restore rbac from a map, a default role implamentation used
func Restore(data Map) *Rbac {
	return RestoreWithFactory(data, newBaseRole)
}

// Set a role with `name`. It has `permissions` and `parents`.
// If the role is not existing, a new one will be created.
// This function will cover role's orignal permissions and parents.
func (rbac *Rbac) Set(rank int, name string, permissions, parents []string, description string) {
	rbac.mutex.Lock()
	defer rbac.mutex.Unlock()
	role := rbac.getRole(name)
	role.Reset()
	role.AddRank(rank)
	role.AddDescription(description)
	for _, p := range permissions {
		role.AddPermission(p)
	}
	for _, pname := range parents {
		role.AddParent(pname)
	}
}

// Add a role with `name`. It has `permissions` and `parents`.
// If the role is not existing, a new one will be created.
// This function will add new permissions and parents to the role,
// and keep orignals.
func (rbac *Rbac) Add(rank int, name string, permissions, parents []string, description string) {
	rbac.mutex.Lock()
	defer rbac.mutex.Unlock()
	role := rbac.getRole(name)
	role.AddRank(rank)
	role.AddDescription(description)
	for _, p := range permissions {
		role.AddPermission(p)
	}
	for _, pname := range parents {
		role.AddParent(pname)
	}
}

// Remove a role.
func (rbac *Rbac) Remove(name string) {
	rbac.mutex.Lock()
	defer rbac.mutex.Unlock()
	delete(rbac.roles, name)
}

// Internal getRole
func (rbac *Rbac) getRole(name string) Role {
	role, ok := rbac.roles[name]
	if !ok {
		role = rbac.factory(rbac, name)
		rbac.roles[name] = role
	}
	return role
}

// Return a role or nil if not exists.
func (rbac *Rbac) Get(name string) Role {
	rbac.mutex.RLock()
	defer rbac.mutex.RUnlock()
	role, ok := rbac.roles[name]
	if !ok {
		return nil
	}
	return role
}

// Test if the `name` has `permission` in the `assert` condition.
func (rbac *Rbac) IsGranted(name, permission string,
	assert AssertionFunc) bool {
	rbac.mutex.RLock()
	defer rbac.mutex.RUnlock()
	if assert != nil && !assert(name, permission, rbac) {
		return false
	}
	if role, ok := rbac.roles[name]; ok {
		return role.HasPermission(permission)
	}
	return false
}

// Dump RBAC
func (rbac *Rbac) Dump() Map {
	m := make(Map)
	for _, role := range rbac.roles {
		roleMap := RoleToMap(role)
		m[strconv.Itoa(role.Rank())+role.Name()] = roleMap
	}
	return m
}