diff --git a/examples/abac_not_using_policy_model.conf b/examples/abac_not_using_policy_model.conf new file mode 100644 index 0000000..3dfaae4 --- /dev/null +++ b/examples/abac_not_using_policy_model.conf @@ -0,0 +1,11 @@ +[request_definition] +r = sub, obj, act + +[policy_definition] +p = sub, obj, act, eft + +[policy_effect] +e = some(where (p.eft == allow)) && !some(where (p.eft == deny)) + +[matchers] +m = r.sub == r.obj.Owner diff --git a/examples/abac_rule_effect_policy.csv b/examples/abac_rule_effect_policy.csv new file mode 100644 index 0000000..aa47394 --- /dev/null +++ b/examples/abac_rule_effect_policy.csv @@ -0,0 +1,4 @@ +p, alice, /data1, read, deny +p, alice, /data1, write, allow +p, bob, /data2, write, deny +p, bob, /data2, read, allow diff --git a/test/model.test.ts b/test/model.test.ts index a735c7a..4fccab4 100644 --- a/test/model.test.ts +++ b/test/model.test.ts @@ -189,6 +189,18 @@ test('TestABACModel', async () => { await testEnforce(e, 'bob', data2, 'write', true); }); +test('TestABACNotUsingPolicy', async () => { + const e = await newEnforcer('examples/abac_not_using_policy_model.conf', 'examples/abac_rule_effect_policy.csv'); + + const data1 = new TestResource('data1', 'alice'); + const data2 = new TestResource('data2', 'bob'); + + await testEnforce(e, 'alice', data1, 'read', true); + await testEnforce(e, 'alice', data1, 'write', true); + await testEnforce(e, 'alice', data2, 'read', false); + await testEnforce(e, 'alice', data2, 'write', false); +}); + test('TestKeyMatchModel', async () => { const e = await newEnforcer('examples/keymatch_model.conf', 'examples/keymatch_policy.csv');