@eang/core
Version:
eang - model driven enterprise event processing
165 lines • 6.34 kB
JavaScript
import { describe, it, expect } from 'vitest';
import { Authorizer, RuleEffect, AuthzAction } from '../src/authorizer.js';
import { OrganizationObj, PersonObj } from '../eang-core.js';
describe('Validate Default Policy', () => {
//setup state
const authz = new Authorizer();
const anonymous = new PersonObj({ key: 'anonymous', username: 'anonymous' });
const policyRuleChain = [
{
effect: RuleEffect.allow,
matcher: (accessRequest) => {
const { subject, action, entity } = accessRequest;
return (subject.key === 'anonymous' &&
action.type === AuthzAction.read().type &&
entity.typeOf === 'Organization');
}
// mapper: (entity: OrganizationObj) => {
// entity.name = 'Anonymous Organization'
// return entity // Modify the entity for anonymous users
// }
}
];
it('anonymous should be denied', () => {
const request = {
subject: anonymous,
action: AuthzAction.read(),
entity: new OrganizationObj({ name: 'Organization 1' })
};
const result = authz.authorize(request, policyRuleChain);
expect(result.effect).toBe(RuleEffect.deny);
});
});
// describe('Authorization for ABAC', () => {
// const user = {
// anonymous: null,
// admin: {
// name: 'Admin',
// connectionsTo: {
// memberOf: [{ key: 'group::modeadmin', type: 'organization' }]
// }
// },
// payrollManager: {
// connections: { memberOf: [{ key: 'group::payroll' }] }
// }
// }
// const accessRequest: AccessRequest = {
// subject: user.admin,
// action: { type: 'read' },
// resource: {
// type: 'person',
// firstname: 'John',
// lastname: 'Doe',
// ssn: '123456789'
// }
// }
// it('should match with contains', () => {
// const authz = new Authorizer()
// let ar = authz.enforce(accessRequest, [
// {
// effect: 'allow',
// matcher: ({ subject }, a) =>
// a.contains(subject, ['connectionsTo', 'memberOf'], {
// key: 'group::modeadmin'
// })
// }
// ])
// expect(ar.effect).toEqual('allow')
// ar = authz.enforce(accessRequest, [
// {
// effect: 'allow',
// matcher: ({ subject }, a) => a.contains(subject, 'name', 'Admin')
// }
// ])
// expect(ar.effect).toEqual('allow')
// ar = authz.enforce(accessRequest, [
// {
// effect: 'allow',
// matcher: ({ subject }, a) => a.contains(subject, ['name'], 'Not the name')
// }
// ])
// expect(ar.effect).toEqual('deny')
// })
// it('anonymous should only see last 4 digits of SSN', () => {
// const authz = new Authorizer()
// const ar = authz.enforce(accessRequest, [
// {
// effect: 'allow',
// filter: (rt) => rt === 'person',
// mapper: (resource) => {
// if (resource.ssn) {
// resource.ssn = resource.ssn.substr(resource.ssn.length - 4)
// }
// return resource
// }
// }
// ])
// expect(ar.resource.ssn).toEqual('6789')
// })
// it('should not match', () => {
// const defaultRule: AccessRule = {
// effect: 'allow',
// matcher: ({ resource }) => resource.firstname === 'Doe'
// }
// const authz = new Authorizer([defaultRule])
// const ar = authz.enforce(accessRequest)
// expect(ar.effect).toEqual(RuleEffect.deny)
// })
// it('should match', () => {
// const defaultRule: AccessRule = {
// effect: 'allow',
// matcher: ({ resource }) => resource.firstname === 'John'
// }
// const authz = new Authorizer([defaultRule])
// const ar = authz.enforce(accessRequest)
// expect(ar.effect).toEqual(RuleEffect.allow)
// })
// it('should filter', () => {
// const defaultRule: AccessRule = { effect: 'allow', filter: (_, at) => at === 'read' }
// const authz = new Authorizer([defaultRule])
// const writeRule: AccessRule = { effect: 'allow', filter: (_, at) => at === 'write' }
// let ar = authz.enforce(accessRequest, [writeRule])
// expect(ar.matchedRule).toEqual(defaultRule)
// ar = authz.enforce({ action: { type: 'write' }, resource: {} } as AccessRequest, [
// writeRule
// ])
// expect(ar.matchedRule).toEqual(writeRule)
// })
// it('should apply default policy chain', () => {
// const authz = new Authorizer([{ effect: 'allow' }])
// const ar = authz.enforce(accessRequest, [{ effect: 'deny' }])
// expect(ar.effect).toEqual(RuleEffect.allow)
// })
// it('should allow with various allow defaults', () => {
// const authz = new Authorizer()
// let ar = authz.enforce(accessRequest, [{ effect: 'allow' }])
// expect(ar.effect).toEqual(RuleEffect.allow)
// ar = authz.enforce(accessRequest, [{ effect: 'allow', filter: () => true }])
// expect(ar.effect).toEqual(RuleEffect.allow)
// ar = authz.enforce(accessRequest, [
// { effect: 'allow', filter: () => true, matcher: () => true }
// ])
// expect(ar.effect).toEqual(RuleEffect.allow)
// })
// it('should deny with various allow defaults', () => {
// const authz = new Authorizer()
// let ar = authz.enforce(accessRequest, [{ effect: 'deny' }])
// expect(ar.effect).toEqual(RuleEffect.deny)
// ar = authz.enforce(accessRequest, [{ effect: 'deny', filter: () => true }])
// expect(ar.effect).toEqual(RuleEffect.deny)
// ar = authz.enforce(accessRequest, [
// { effect: 'deny', filter: () => true, matcher: () => true }
// ])
// expect(ar.effect).toEqual(RuleEffect.deny)
// })
// it('should deny any request if no policies are provided', () => {
// const authz = new Authorizer()
// const accessResponse1 = authz.enforce(accessRequest)
// expect(accessResponse1.effect).toEqual(RuleEffect.deny)
// const accessResponse2 = authz.enforce(accessRequest, [])
// expect(accessResponse2.effect).toEqual(RuleEffect.deny)
// const accessResponse3 = authz.enforce(accessRequest, null)
// expect(accessResponse3.effect).toEqual(RuleEffect.deny)
// })
// })
//# sourceMappingURL=authorizer.test.js.map