703 lines
26 KiB
JavaScript
703 lines
26 KiB
JavaScript
"use strict";
|
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
/*
|
|
ACL System inspired on Zend_ACL.
|
|
All functions accept strings, objects or arrays unless specified otherwise.
|
|
|
|
'*' is used to express 'all'
|
|
|
|
Database structure in Redis (using default prefix 'acl')
|
|
|
|
Users:
|
|
|
|
acl_roles_{userid} = set(roles)
|
|
|
|
Roles:
|
|
|
|
acl_roles = {roleNames} // Used to remove all the permissions associated to ONE resource.
|
|
|
|
acl_parents_{roleName} = set(parents)
|
|
acl_resources_{roleName} = set(resourceNames)
|
|
|
|
Permissions:
|
|
acl_allows_{resourceName}_{roleName} = set(permissions)
|
|
Note: user ids, role names and resource names are all case sensitive.
|
|
|
|
Roadmap:
|
|
- Add support for locking resources. If a user has roles that gives him permissions to lock
|
|
a resource, then he can get exclusive write operation on the locked resource.
|
|
This lock should expire if the resource has not been accessed in some time.
|
|
*/
|
|
const _ = require("lodash");
|
|
const bluebird = require("bluebird");
|
|
const contract_1 = require("./contract");
|
|
contract_1.contract.debug = true;
|
|
function makeArray(arr) {
|
|
return Array.isArray(arr) ? arr : [arr];
|
|
}
|
|
function allowsBucket(role) {
|
|
return 'allows_' + role;
|
|
}
|
|
function keyFromAllowsBucket(str) {
|
|
return str.replace(/^allows_/, '');
|
|
}
|
|
class ACL {
|
|
constructor(backend, logger, options) {
|
|
const buckets = {
|
|
meta: 'meta',
|
|
parents: 'parents',
|
|
permissions: 'permissions',
|
|
resources: 'resources',
|
|
roles: 'roles',
|
|
users: 'users'
|
|
};
|
|
options = _.extend({
|
|
buckets: buckets
|
|
}, options);
|
|
this.logger = logger;
|
|
this.backend = backend;
|
|
this.options = options;
|
|
}
|
|
allow(roles, resources, permissions, cb) {
|
|
contract_1.contract(arguments)
|
|
.params('string|array', 'string|array', 'string|array', 'function')
|
|
.params('string|array', 'string|array', 'string|array')
|
|
.params('array', 'function')
|
|
.params('array')
|
|
.end();
|
|
if ((arguments.length === 1) || ((arguments.length === 2) && _.isObject(roles) && _.isFunction(resources))) {
|
|
return this._allowEx(roles).nodeify(resources);
|
|
}
|
|
else {
|
|
let _this = this;
|
|
roles = makeArray(roles);
|
|
resources = makeArray(resources);
|
|
let backend = _this.backend;
|
|
let transaction = _this.backend.begin();
|
|
backend.add(transaction, _this.options.buckets.meta, 'roles', roles);
|
|
resources.forEach(function (resource) {
|
|
_.each(roles, (role) => {
|
|
backend.add(transaction, allowsBucket(resource), role, permissions);
|
|
});
|
|
});
|
|
roles.forEach(function (role) {
|
|
_this.backend.add(transaction, _this.options.buckets.resources, role, resources);
|
|
});
|
|
return backend.endAsync(transaction).nodeify(cb);
|
|
}
|
|
}
|
|
/* addUserRoles( userId, roles, function(err) )
|
|
* Adds roles to a given user id.
|
|
@param {String|Number} User id.
|
|
@param {String|Array} Role(s) to add to the user id.
|
|
@param {Function} Callback called when finished.
|
|
@return {Promise} Promise resolved when finished
|
|
*/
|
|
addUserRoles(userId, roles, cb) {
|
|
contract_1.contract(arguments)
|
|
.params('string|number', 'string|array', 'function')
|
|
.params('string|number', 'string|array')
|
|
.end();
|
|
let transaction = this.backend.begin();
|
|
this.backend.add(transaction, this.options.buckets.meta, 'users', userId);
|
|
this.backend.add(transaction, this.options.buckets.users, userId, roles);
|
|
if (Array.isArray(roles)) {
|
|
let _this = this;
|
|
roles.forEach(function (role) {
|
|
_this.backend.add(transaction, _this.options.buckets.roles, role, userId);
|
|
});
|
|
}
|
|
else {
|
|
this.backend.add(transaction, this.options.buckets.roles, roles, userId);
|
|
}
|
|
return this.backend.endAsync(transaction).nodeify(cb);
|
|
}
|
|
/*
|
|
removeUserRoles( userId, roles, function(err) )
|
|
Remove roles from a given user.
|
|
@param {String|Number} User id.
|
|
@param {String|Array} Role(s) to remove to the user id.
|
|
@param {Function} Callback called when finished.
|
|
@return {Promise} Promise resolved when finished
|
|
*/
|
|
removeUserRoles(userId, roles, cb) {
|
|
contract_1.contract(arguments)
|
|
.params('string|number', 'string|array', 'function')
|
|
.params('string|number', 'string|array')
|
|
.end();
|
|
let transaction = this.backend.begin();
|
|
this.backend.remove(transaction, this.options.buckets.users, userId, roles);
|
|
if (Array.isArray(roles)) {
|
|
let _this = this;
|
|
roles.forEach(function (role) {
|
|
_this.backend.remove(transaction, _this.options.buckets.roles, role, userId);
|
|
});
|
|
}
|
|
else {
|
|
this.backend.remove(transaction, this.options.buckets.roles, roles, userId);
|
|
}
|
|
return this.backend.endAsync(transaction).nodeify(cb);
|
|
}
|
|
/*
|
|
userRoles( userId, function(err, roles) )
|
|
Return all the roles from a given user.
|
|
|
|
@param {String|Number} User id.
|
|
@param {Function} Callback called when finished.
|
|
@return {Promise} Promise resolved with an array of user roles
|
|
*/
|
|
userRoles(userId, cb) {
|
|
return this.backend.getAsync(this.options.buckets.users, userId).nodeify(cb);
|
|
}
|
|
/*
|
|
roleUsers( roleName, function(err, users) )
|
|
Return all users who has a given role.
|
|
@param {String|Number} rolename.
|
|
@param {Function} Callback called when finished.
|
|
@return {Promise} Promise resolved with an array of users
|
|
*/
|
|
roleUsers(role, cb) {
|
|
return this.backend.getAsync(this.options.buckets.roles, role).nodeify(cb);
|
|
}
|
|
/*
|
|
hasRole( userId, rolename, function(err, is_in_role) )
|
|
Return boolean whether user is in the role
|
|
@param {String|Number} User id.
|
|
@param {String|Number} rolename.
|
|
@param {Function} Callback called when finished.
|
|
@return {Promise} Promise resolved with boolean of whether user is in role
|
|
*/
|
|
hasRole(userId, role, cb) {
|
|
return this.userRoles(userId).then(function (roles) {
|
|
return roles.indexOf(role) !== -1;
|
|
}).nodeify(cb);
|
|
}
|
|
/*
|
|
addRoleParents( role, parents, function(err) )
|
|
Adds a parent or parent list to role.
|
|
@param {String} Child role.
|
|
@param {String|Array} Parent role(s) to be added.
|
|
@param {Function} Callback called when finished.
|
|
@return {Promise} Promise resolved when finished
|
|
*/
|
|
addRoleParents(role, parents, cb) {
|
|
contract_1.contract(arguments)
|
|
.params('string|number', 'string|array', 'function')
|
|
.params('string|number', 'string|array')
|
|
.end();
|
|
let transaction = this.backend.begin();
|
|
this.backend.add(transaction, this.options.buckets.meta, 'roles', role);
|
|
this.backend.add(transaction, this.options.buckets.parents, role, parents);
|
|
return this.backend.endAsync(transaction).nodeify(cb);
|
|
}
|
|
;
|
|
/*
|
|
removeRoleParents( role, parents, function(err) )
|
|
|
|
Removes a parent or parent list from role.
|
|
|
|
If `parents` is not specified, removes all parents.
|
|
|
|
@param {String} Child role.
|
|
@param {String|Array} Parent role(s) to be removed [optional].
|
|
@param {Function} Callback called when finished [optional].
|
|
@return {Promise} Promise resolved when finished.
|
|
*/
|
|
removeRoleParents(role, parents, cb) {
|
|
contract_1.contract(arguments)
|
|
.params('string', 'string|array', 'function')
|
|
.params('string', 'string|array')
|
|
.params('string', 'function')
|
|
.params('string')
|
|
.end();
|
|
if (!cb && _.isFunction(parents)) {
|
|
cb = parents;
|
|
parents = null;
|
|
}
|
|
let transaction = this.backend.begin();
|
|
if (parents) {
|
|
this.backend.remove(transaction, this.options.buckets.parents, role, parents);
|
|
}
|
|
else {
|
|
this.backend.del(transaction, this.options.buckets.parents, role);
|
|
}
|
|
return this.backend.endAsync(transaction).nodeify(cb);
|
|
}
|
|
/*
|
|
removeRole( role, function(err) )
|
|
|
|
Removes a role from the system.
|
|
|
|
@param {String} Role to be removed
|
|
@param {Function} Callback called when finished.
|
|
*/
|
|
removeRole(role, cb) {
|
|
contract_1.contract(arguments)
|
|
.params('string', 'function')
|
|
.params('string').end();
|
|
let _this = this;
|
|
// Note that this is not fully transactional.
|
|
return this.backend.getAsync(this.options.buckets.resources, role).then((resources) => {
|
|
let transaction = _this.backend.begin();
|
|
resources.forEach((resource) => {
|
|
let bucket = allowsBucket(resource);
|
|
_this.backend.del(transaction, bucket, role);
|
|
});
|
|
_this.backend.del(transaction, _this.options.buckets.resources, role);
|
|
_this.backend.del(transaction, _this.options.buckets.parents, role);
|
|
_this.backend.del(transaction, _this.options.buckets.roles, role);
|
|
_this.backend.remove(transaction, _this.options.buckets.meta, 'roles', role);
|
|
// `users` collection keeps the removed role
|
|
// because we don't know what users have `role` assigned.
|
|
return _this.backend.endAsync(transaction);
|
|
}).nodeify(cb);
|
|
}
|
|
;
|
|
/*
|
|
removeResource( resource, function(err) )
|
|
Removes a resource from the system
|
|
@param {String} Resource to be removed
|
|
@param {Function} Callback called when finished.
|
|
@return {Promise} Promise resolved when finished
|
|
*/
|
|
removeResource(resource, cb) {
|
|
contract_1.contract(arguments)
|
|
.params('string', 'function')
|
|
.params('string')
|
|
.end();
|
|
let _this = this;
|
|
return this.backend.getAsync(this.options.buckets.meta, 'roles').then(function (roles) {
|
|
let transaction = _this.backend.begin();
|
|
_this.backend.del(transaction, allowsBucket(resource), roles);
|
|
roles.forEach((role) => {
|
|
_this.backend.remove(transaction, _this.options.buckets.resources, role, resource);
|
|
});
|
|
return _this.backend.endAsync(transaction);
|
|
}).nodeify(cb);
|
|
}
|
|
/*
|
|
allow( roles, resources, permissions, function(err) )
|
|
Adds the given permissions to the given roles over the given resources.
|
|
|
|
@param {String|Array} role(s) to add permissions to.
|
|
@param {String|Array} resource(s) to add permisisons to.
|
|
@param {String|Array} permission(s) to add to the roles over the resources.
|
|
@param {Function} Callback called when finished.
|
|
|
|
allow( permissionsArray, function(err) )
|
|
|
|
@param {Array} Array with objects expressing what permissions to give.
|
|
|
|
[{roles:{String|Array}, allows:[{resources:{String|Array}, permissions:{String|Array}]]
|
|
|
|
@param {Function} Callback called when finished.
|
|
@return {Promise} Promise resolved when finished
|
|
*/
|
|
removeAllow(role, resources, permissions, cb) {
|
|
contract_1.contract(arguments)
|
|
.params('string', 'string|array', 'string|array', 'function')
|
|
.params('string', 'string|array', 'string|array')
|
|
.params('string', 'string|array', 'function')
|
|
.params('string', 'string|array')
|
|
.end();
|
|
resources = makeArray(resources);
|
|
if (cb || (permissions && !_.isFunction(permissions))) {
|
|
permissions = makeArray(permissions);
|
|
}
|
|
else {
|
|
cb = permissions;
|
|
permissions = null;
|
|
}
|
|
return this.removePermissions(role, resources, permissions, cb);
|
|
}
|
|
;
|
|
/*
|
|
removePermissions( role, resources, permissions)
|
|
Remove permissions from the given roles owned by the given role.
|
|
Note: we loose atomicity when removing empty role_resources.
|
|
@param {String}
|
|
@param {String|Array}
|
|
@param {String|Array}
|
|
*/
|
|
removePermissions(role, resources, permissions, cb) {
|
|
let _this = this;
|
|
let transaction = _this.backend.begin();
|
|
_.each(resources, resource => {
|
|
let bucket = allowsBucket(resource);
|
|
if (permissions) {
|
|
_this.backend.remove(transaction, bucket, role, permissions);
|
|
}
|
|
else {
|
|
_this.backend.del(transaction, bucket, role);
|
|
_this.backend.remove(transaction, _this.options.buckets.resources, role, resource);
|
|
}
|
|
});
|
|
// Remove resource from role if no rights for that role exists.
|
|
// Not fully atomic...
|
|
return _this.backend.endAsync(transaction).then(function () {
|
|
let transaction = _this.backend.begin();
|
|
return bluebird.all(_.map(resources, resource => {
|
|
let bucket = allowsBucket(resource);
|
|
return _this.backend.getAsync(bucket, role).then(function (permissions) {
|
|
if (permissions.length === 0) {
|
|
_this.backend.remove(transaction, _this.options.buckets.resources, role, resource);
|
|
}
|
|
});
|
|
})).then(function () {
|
|
return _this.backend.endAsync(transaction);
|
|
});
|
|
}).nodeify(cb);
|
|
}
|
|
;
|
|
/*
|
|
allowedPermissions( userId, resources, function(err, obj) )
|
|
Returns all the allowable permissions a given user have to
|
|
access the given resources.
|
|
It returns an array of objects where every object maps a
|
|
resource name to a list of permissions for that resource.
|
|
|
|
@param {String|Number} User id.
|
|
@param {String|Array} resource(s) to ask permissions for.
|
|
@param {Function} Callback called when finished.
|
|
*/
|
|
allowedPermissions(userId, resources, cb) {
|
|
if (!userId) {
|
|
return cb(null, {});
|
|
}
|
|
contract_1.contract(arguments)
|
|
.params('string|number', 'string|array', 'function')
|
|
.params('string|number', 'string|array')
|
|
.end();
|
|
if (this.backend.unionsAsync) {
|
|
return this.optimizedAllowedPermissions(userId, resources, cb);
|
|
}
|
|
let _this = this;
|
|
resources = makeArray(resources);
|
|
return this.userRoles(userId).then(roles => {
|
|
let result = {};
|
|
return bluebird.all(_.map(resources, resource => {
|
|
return _this._resourcePermissions(roles, resource).then(function (permissions) {
|
|
result[resource] = permissions;
|
|
});
|
|
})).then(function () {
|
|
return result;
|
|
});
|
|
}).nodeify(cb);
|
|
}
|
|
/*
|
|
optimizedAllowedPermissions( userId, resources, function(err, obj) )
|
|
|
|
Returns all the allowable permissions a given user have to
|
|
access the given resources.
|
|
|
|
It returns a map of resource name to a list of permissions for that resource.
|
|
|
|
This is the same as allowedPermissions, it just takes advantage of the unions
|
|
function if available to reduce the number of backend queries.
|
|
|
|
@param {String|Number} User id.
|
|
@param {String|Array} resource(s) to ask permissions for.
|
|
@param {Function} Callback called when finished.
|
|
*/
|
|
optimizedAllowedPermissions(userId, resources, cb) {
|
|
if (!userId) {
|
|
return cb(null, {});
|
|
}
|
|
contract_1.contract(arguments)
|
|
.params('string|number', 'string|array', 'function|undefined')
|
|
.params('string|number', 'string|array')
|
|
.end();
|
|
resources = makeArray(resources);
|
|
let self = this;
|
|
return this._allUserRoles(userId).then(function (roles) {
|
|
let buckets = resources.map(allowsBucket);
|
|
if (roles.length === 0) {
|
|
let emptyResult = {};
|
|
buckets.forEach(function (bucket) {
|
|
emptyResult[bucket] = [];
|
|
});
|
|
return bluebird.resolve(emptyResult);
|
|
}
|
|
return self.backend.unionsAsync(buckets, roles);
|
|
}).then(function (response) {
|
|
let result = {};
|
|
Object.keys(response).forEach(function (bucket) {
|
|
result[keyFromAllowsBucket(bucket)] = response[bucket];
|
|
});
|
|
return result;
|
|
}).nodeify(cb);
|
|
}
|
|
/*
|
|
isAllowed( userId, resource, permissions, function(err, allowed) )
|
|
|
|
Checks if the given user is allowed to access the resource for the given
|
|
permissions (note: it must fulfill all the permissions).
|
|
|
|
@param {String|Number} User id.
|
|
@param {String|Array} resource(s) to ask permissions for.
|
|
@param {String|Array} asked permissions.
|
|
@param {Function} Callback called wish the result.
|
|
*/
|
|
isAllowed(userId, resource, permissions, cb) {
|
|
contract_1.contract(arguments)
|
|
.params('string|number', 'string', 'string|array', 'function')
|
|
.params('string|number', 'string', 'string|array')
|
|
.end();
|
|
let _this = this;
|
|
return this.backend.getAsync(this.options.buckets.users, userId).then(function (roles) {
|
|
if (roles.length) {
|
|
return _this.areAnyRolesAllowed(roles, resource, permissions);
|
|
}
|
|
else {
|
|
return false;
|
|
}
|
|
}).nodeify(cb);
|
|
}
|
|
/*
|
|
areAnyRolesAllowed( roles, resource, permissions, function(err, allowed) )
|
|
|
|
Returns true if any of the given roles have the right permissions.
|
|
|
|
@param {String|Array} Role(s) to check the permissions for.
|
|
@param {String} resource(s) to ask permissions for.
|
|
@param {String|Array} asked permissions.
|
|
@param {Function} Callback called with the result.
|
|
*/
|
|
areAnyRolesAllowed(roles, resource, permissions, cb) {
|
|
contract_1.contract(arguments)
|
|
.params('string|array', 'string', 'string|array', 'function')
|
|
.params('string|array', 'string', 'string|array')
|
|
.end();
|
|
roles = makeArray(roles);
|
|
permissions = makeArray(permissions);
|
|
if (roles.length === 0) {
|
|
return bluebird.resolve(false).nodeify(cb);
|
|
}
|
|
else {
|
|
return this._checkPermissions(roles, resource, permissions).nodeify(cb);
|
|
}
|
|
}
|
|
/*
|
|
whatResources(role, function(err, {resourceName: [permissions]})
|
|
|
|
Returns what resources a given role or roles have permissions over.
|
|
|
|
whatResources(role, permissions, function(err, resources) )
|
|
|
|
Returns what resources a role has the given permissions over.
|
|
|
|
@param {String|Array} Roles
|
|
@param {String[Array} Permissions
|
|
@param {Function} Callback called wish the result.
|
|
*/
|
|
whatResources(roles, permissions, cb) {
|
|
contract_1.contract(arguments)
|
|
.params('string|array')
|
|
.params('string|array', 'string|array')
|
|
.params('string|array', 'function')
|
|
.params('string|array', 'string|array', 'function')
|
|
.end();
|
|
roles = makeArray(roles);
|
|
if (_.isFunction(permissions)) {
|
|
cb = permissions;
|
|
permissions = undefined;
|
|
}
|
|
else if (permissions) {
|
|
permissions = makeArray(permissions);
|
|
}
|
|
return this.permittedResources(roles, permissions, cb);
|
|
}
|
|
permittedResources(roles, permissions, cb) {
|
|
let _this = this;
|
|
let result = _.isUndefined(permissions) ? {} : [];
|
|
return this._rolesResources(roles).then(function (resources) {
|
|
return bluebird.all(resources.map(function (resource) {
|
|
return _this._resourcePermissions(roles, resource).then(function (p) {
|
|
if (permissions) {
|
|
let commonPermissions = _.intersection(permissions, p);
|
|
if (commonPermissions.length > 0) {
|
|
result.push(resource);
|
|
}
|
|
}
|
|
else {
|
|
result[resource] = p;
|
|
}
|
|
});
|
|
})).then(function () {
|
|
return result;
|
|
});
|
|
}).nodeify(cb);
|
|
}
|
|
// -----------------------------------------------------------------------------
|
|
//
|
|
// Private methods
|
|
//
|
|
// -----------------------------------------------------------------------------
|
|
//
|
|
// Same as allow but accepts a more compact input.
|
|
//
|
|
_allowEx(objs) {
|
|
let _this = this;
|
|
objs = makeArray(objs);
|
|
let demuxed = [];
|
|
objs.forEach(function (obj) {
|
|
let roles = obj.roles;
|
|
obj.allows.forEach(function (allow) {
|
|
demuxed.push({
|
|
roles: roles,
|
|
resources: allow.resources,
|
|
permissions: allow.permissions
|
|
});
|
|
});
|
|
});
|
|
return bluebird.reduce(demuxed, function (values, obj) {
|
|
const roles = obj.roles;
|
|
const resources = obj.resources;
|
|
const permissions = obj.permissions;
|
|
return _this.allow(roles, resources, permissions, null);
|
|
}, null);
|
|
}
|
|
//
|
|
// Returns the parents of the given roles
|
|
//
|
|
_rolesParents(roles) {
|
|
return this.backend.unionAsync(this.options.buckets.parents, roles);
|
|
}
|
|
//
|
|
// Return all roles in the hierarchy including the given roles.
|
|
//
|
|
/*
|
|
Acl.prototype._allRoles = function(roleNames, cb){
|
|
var _this = this, roles;
|
|
|
|
_this._rolesParents(roleNames, function(err, parents){
|
|
roles = _.union(roleNames, parents);
|
|
async.whilst(
|
|
function (){
|
|
return parents.length >0;
|
|
},
|
|
function (cb) {
|
|
_this._rolesParents(parents, function(err, result){
|
|
if(!err){
|
|
roles = _.union(roles, parents);
|
|
parents = result;
|
|
}
|
|
cb(err);
|
|
});
|
|
},
|
|
function(err){
|
|
cb(err, roles);
|
|
}
|
|
);
|
|
});
|
|
};
|
|
*/
|
|
//
|
|
// Return all roles in the hierarchy including the given roles.
|
|
//
|
|
_allRoles(roleNames) {
|
|
let _this = this;
|
|
return this._rolesParents(roleNames).then(function (parents) {
|
|
if (parents.length > 0) {
|
|
return _this._allRoles(parents).then(function (parentRoles) {
|
|
return _.union(roleNames, parentRoles);
|
|
});
|
|
}
|
|
else {
|
|
return roleNames;
|
|
}
|
|
});
|
|
}
|
|
//
|
|
// Return all roles in the hierarchy of the given user.
|
|
//
|
|
_allUserRoles(userId) {
|
|
let _this = this;
|
|
return this.userRoles(userId).then(function (roles) {
|
|
if (roles && roles.length > 0) {
|
|
return _this._allRoles(roles);
|
|
}
|
|
else {
|
|
return [];
|
|
}
|
|
});
|
|
}
|
|
//
|
|
// Returns an array with resources for the given roles.
|
|
//
|
|
_rolesResources(roles) {
|
|
let _this = this;
|
|
roles = makeArray(roles);
|
|
return this._allRoles(roles).then(function (allRoles) {
|
|
let result = [];
|
|
// check if bluebird.map simplifies this code
|
|
return bluebird.all(allRoles.map(function (role) {
|
|
return _this.backend.getAsync(_this.options.buckets.resources, role).then(function (resources) {
|
|
result = result.concat(resources);
|
|
});
|
|
})).then(function () {
|
|
return result;
|
|
});
|
|
});
|
|
}
|
|
//
|
|
// Returns the permissions for the given resource and set of roles
|
|
//
|
|
_resourcePermissions(roles, resource) {
|
|
let _this = this;
|
|
if (roles.length === 0) {
|
|
return bluebird.resolve([]);
|
|
}
|
|
else {
|
|
return this.backend.unionAsync(allowsBucket(resource), roles).then(function (resourcePermissions) {
|
|
return _this._rolesParents(roles).then(function (parents) {
|
|
if (parents && parents.length) {
|
|
return _this._resourcePermissions(parents, resource).then(function (morePermissions) {
|
|
return _.union(resourcePermissions, morePermissions);
|
|
});
|
|
}
|
|
else {
|
|
return resourcePermissions;
|
|
}
|
|
});
|
|
});
|
|
}
|
|
}
|
|
//
|
|
// NOTE: This function will not handle circular dependencies and result in a crash.
|
|
//
|
|
_checkPermissions(roles, resource, permissions) {
|
|
let _this = this;
|
|
return this.backend.unionAsync(allowsBucket(resource), roles).then(function (resourcePermissions) {
|
|
if (resourcePermissions.indexOf('*') !== -1) {
|
|
return true;
|
|
}
|
|
else {
|
|
permissions = permissions.filter(function (p) {
|
|
return resourcePermissions.indexOf(p) === -1;
|
|
});
|
|
if (permissions.length === 0) {
|
|
return true;
|
|
}
|
|
else {
|
|
return _this.backend.unionAsync(_this.options.buckets.parents, roles).then(function (parents) {
|
|
if (parents && parents.length) {
|
|
return _this._checkPermissions(parents, resource, permissions);
|
|
}
|
|
else {
|
|
return false;
|
|
}
|
|
});
|
|
}
|
|
}
|
|
});
|
|
}
|
|
}
|
|
exports.ACL = ACL;
|
|
;
|
|
// -----------------------------------------------------------------------------
|
|
//
|
|
// Helpers
|
|
//
|
|
// -----------------------------------------------------------------------------
|
|
//# sourceMappingURL=ACLC.js.map
|