loopback/test/acl.test.js

475 lines
15 KiB
JavaScript
Raw Permalink Normal View History

2016-05-03 22:50:21 +00:00
// Copyright IBM Corp. 2013,2016. All Rights Reserved.
// Node module: loopback
// This file is licensed under the MIT License.
// License text available at https://opensource.org/licenses/MIT
'use strict';
2013-11-10 06:22:16 +00:00
var assert = require('assert');
var loopback = require('../index');
var Scope = loopback.Scope;
var ACL = loopback.ACL;
var request = require('supertest');
var Role = loopback.Role;
var RoleMapping = loopback.RoleMapping;
2013-11-10 06:22:16 +00:00
var User = loopback.User;
var testModel;
2013-11-10 06:22:16 +00:00
// Speed up the password hashing algorithm for tests
User.settings.saltWorkFactor = 4;
2013-11-12 18:10:32 +00:00
function checkResult(err, result) {
// console.log(err, result);
assert(!err);
}
var ds = null;
before(function() {
ds = loopback.createDataSource({connector: loopback.Memory});
});
2013-11-10 06:22:16 +00:00
2014-11-21 02:35:36 +00:00
describe('security scopes', function() {
beforeEach(function() {
var ds = this.ds = loopback.createDataSource({connector: loopback.Memory});
2014-06-05 07:45:09 +00:00
testModel = loopback.PersistedModel.extend('testModel');
ACL.attachTo(ds);
Role.attachTo(ds);
RoleMapping.attachTo(ds);
User.attachTo(ds);
Scope.attachTo(ds);
testModel.attachTo(ds);
});
2014-11-21 02:35:36 +00:00
it('should allow access to models for the given scope by wildcard', function() {
Scope.create({name: 'userScope', description: 'access user information'},
function(err, scope) {
ACL.create({
principalType: ACL.SCOPE, principalId: scope.id,
model: 'User', property: ACL.ALL,
accessType: ACL.ALL, permission: ACL.ALLOW,
}, function(err, resource) {
2013-11-15 17:41:26 +00:00
Scope.checkPermission('userScope', 'User', ACL.ALL, ACL.ALL, checkResult);
Scope.checkPermission('userScope', 'User', 'name', ACL.ALL, checkResult);
Scope.checkPermission('userScope', 'User', 'name', ACL.READ, checkResult);
2013-11-10 06:22:16 +00:00
});
});
});
2014-11-21 02:35:36 +00:00
it('should allow access to models for the given scope', function() {
Scope.create({name: 'testModelScope', description: 'access testModel information'},
function(err, scope) {
ACL.create({
principalType: ACL.SCOPE, principalId: scope.id,
model: 'testModel', property: 'name',
accessType: ACL.READ, permission: ACL.ALLOW,
}, function(err, resource) {
ACL.create({principalType: ACL.SCOPE, principalId: scope.id,
model: 'testModel', property: 'name',
accessType: ACL.WRITE, permission: ACL.DENY,
}, function(err, resource) {
// console.log(resource);
Scope.checkPermission('testModelScope', 'testModel', ACL.ALL, ACL.ALL,
function(err, perm) {
assert(perm.permission === ACL.DENY); // because name.WRITE == DENY
});
Scope.checkPermission('testModelScope', 'testModel', 'name', ACL.ALL,
function(err, perm) {
assert(perm.permission === ACL.DENY); // because name.WRITE == DENY
});
Scope.checkPermission('testModelScope', 'testModel', 'name', ACL.READ,
function(err, perm) {
assert(perm.permission === ACL.ALLOW);
});
Scope.checkPermission('testModelScope', 'testModel', 'name', ACL.WRITE,
function(err, perm) {
assert(perm.permission === ACL.DENY);
2013-11-14 01:07:43 +00:00
});
});
});
2013-11-12 06:16:51 +00:00
});
});
});
2014-11-21 02:35:36 +00:00
describe('security ACLs', function() {
it('supports checkPermission() returning a promise', function() {
return ACL.create({
principalType: ACL.USER,
principalId: 'u001',
model: 'testModel',
property: ACL.ALL,
accessType: ACL.ALL,
permission: ACL.ALLOW,
})
.then(function() {
return ACL.checkPermission(ACL.USER, 'u001', 'testModel', 'name', ACL.ALL);
})
.then(function(access) {
assert(access.permission === ACL.ALLOW);
});
});
it('supports checkAccessForContext() returning a promise', function() {
var testModel = ds.createModel('testModel', {
acls: [
{principalType: ACL.USER, principalId: 'u001',
accessType: ACL.ALL, permission: ACL.ALLOW},
],
});
return ACL.checkAccessForContext({
principals: [{type: ACL.USER, id: 'u001'}],
model: 'testModel',
accessType: ACL.ALL,
})
.then(function(access) {
assert(access.permission === ACL.ALLOW);
});
});
it('should order ACL entries based on the matching score', function() {
var acls = [
{
'model': 'account',
'accessType': '*',
'permission': 'DENY',
'principalType': 'ROLE',
'principalId': '$everyone',
},
{
'model': 'account',
'accessType': '*',
'permission': 'ALLOW',
'principalType': 'ROLE',
'principalId': '$owner',
},
{
'model': 'account',
'accessType': 'READ',
'permission': 'ALLOW',
'principalType': 'ROLE',
'principalId': '$everyone',
}];
var req = {
model: 'account',
property: 'find',
accessType: 'WRITE',
};
acls = acls.map(function(a) { return new ACL(a); });
var perm = ACL.resolvePermission(acls, req);
assert.deepEqual(perm, {model: 'account',
property: 'find',
accessType: 'WRITE',
permission: 'ALLOW',
methodNames: []});
});
2013-11-12 06:16:51 +00:00
2014-11-21 02:35:36 +00:00
it('should allow access to models for the given principal by wildcard', function() {
// jscs:disable validateIndentation
ACL.create({
principalType: ACL.USER, principalId: 'u001', model: 'User', property: ACL.ALL,
accessType: ACL.ALL, permission: ACL.ALLOW,
}, function(err, acl) {
ACL.create({
principalType: ACL.USER, principalId: 'u001', model: 'User', property: ACL.ALL,
accessType: ACL.READ, permission: ACL.DENY,
}, function(err, acl) {
2014-11-21 02:35:36 +00:00
ACL.checkPermission(ACL.USER, 'u001', 'User', 'name', ACL.READ, function(err, perm) {
2013-11-14 01:24:42 +00:00
assert(perm.permission === ACL.DENY);
});
2014-11-21 02:35:36 +00:00
ACL.checkPermission(ACL.USER, 'u001', 'User', 'name', ACL.ALL, function(err, perm) {
2013-11-14 01:24:42 +00:00
assert(perm.permission === ACL.DENY);
});
});
2013-11-12 06:16:51 +00:00
});
});
2014-11-21 02:35:36 +00:00
it('should allow access to models by exception', function() {
ACL.create({
principalType: ACL.USER, principalId: 'u001', model: 'testModel', property: ACL.ALL,
accessType: ACL.ALL, permission: ACL.DENY,
}, function(err, acl) {
ACL.create({
principalType: ACL.USER, principalId: 'u001', model: 'testModel', property: ACL.ALL,
accessType: ACL.READ, permission: ACL.ALLOW,
}, function(err, acl) {
ACL.create({
principalType: ACL.USER, principalId: 'u002', model: 'testModel', property: ACL.ALL,
accessType: ACL.EXECUTE, permission: ACL.ALLOW,
}, function(err, acl) {
ACL.checkPermission(ACL.USER, 'u001', 'testModel', 'name', ACL.READ,
function(err, perm) {
assert(perm.permission === ACL.ALLOW);
});
ACL.checkPermission(ACL.USER, 'u001', 'testModel', ACL.ALL, ACL.READ,
function(err, perm) {
assert(perm.permission === ACL.ALLOW);
});
ACL.checkPermission(ACL.USER, 'u001', 'testModel', 'name', ACL.WRITE,
function(err, perm) {
assert(perm.permission === ACL.DENY);
});
ACL.checkPermission(ACL.USER, 'u001', 'testModel', 'name', ACL.ALL,
function(err, perm) {
assert(perm.permission === ACL.DENY);
});
ACL.checkPermission(ACL.USER, 'u002', 'testModel', 'name', ACL.WRITE,
function(err, perm) {
assert(perm.permission === ACL.ALLOW);
});
ACL.checkPermission(ACL.USER, 'u002', 'testModel', 'name', ACL.READ,
function(err, perm) {
assert(perm.permission === ACL.ALLOW);
});
});
});
});
});
2014-11-21 02:35:36 +00:00
it('should honor defaultPermission from the model', function() {
2013-11-20 21:31:30 +00:00
var Customer = ds.createModel('Customer', {
name: {
type: String,
acls: [
{principalType: ACL.USER, principalId: 'u001',
accessType: ACL.WRITE, permission: ACL.DENY},
{principalType: ACL.USER, principalId: 'u001',
accessType: ACL.ALL, permission: ACL.ALLOW},
],
},
2013-11-20 21:31:30 +00:00
}, {
acls: [
{principalType: ACL.USER, principalId: 'u001',
accessType: ACL.ALL, permission: ACL.ALLOW},
],
2013-11-20 21:31:30 +00:00
});
Customer.settings.defaultPermission = ACL.DENY;
ACL.checkPermission(ACL.USER, 'u001', 'Customer', 'name', ACL.WRITE,
function(err, perm) {
2013-11-20 21:31:30 +00:00
assert(perm.permission === ACL.DENY);
});
2014-11-21 02:35:36 +00:00
ACL.checkPermission(ACL.USER, 'u001', 'Customer', 'name', ACL.READ, function(err, perm) {
2013-11-20 21:31:30 +00:00
assert(perm.permission === ACL.ALLOW);
});
2014-11-21 02:35:36 +00:00
ACL.checkPermission(ACL.USER, 'u002', 'Customer', 'name', ACL.WRITE, function(err, perm) {
2013-11-20 21:31:30 +00:00
assert(perm.permission === ACL.DENY);
});
});
2014-11-21 02:35:36 +00:00
it('should honor static ACLs from the model', function() {
2013-11-15 17:41:26 +00:00
var Customer = ds.createModel('Customer', {
name: {
type: String,
acls: [
{principalType: ACL.USER, principalId: 'u001',
accessType: ACL.WRITE, permission: ACL.DENY},
{principalType: ACL.USER, principalId: 'u001',
accessType: ACL.ALL, permission: ACL.ALLOW},
],
},
2013-11-15 17:41:26 +00:00
}, {
acls: [
{principalType: ACL.USER, principalId: 'u001',
accessType: ACL.ALL, permission: ACL.ALLOW},
{principalType: ACL.USER, principalId: 'u002',
accessType: ACL.EXECUTE, permission: ACL.ALLOW},
{principalType: ACL.USER, principalId: 'u003',
accessType: ACL.EXECUTE, permission: ACL.DENY},
],
2013-11-15 17:41:26 +00:00
});
/*
Customer.settings.acls = [
{principalType: ACL.USER, principalId: 'u001', accessType: ACL.ALL, permission: ACL.ALLOW}
];
*/
ACL.checkPermission(ACL.USER, 'u001', 'Customer', 'name', ACL.WRITE,
function(err, perm) {
2013-11-15 17:41:26 +00:00
assert(perm.permission === ACL.DENY);
});
ACL.checkPermission(ACL.USER, 'u001', 'Customer', 'name', ACL.READ,
function(err, perm) {
2013-11-15 17:41:26 +00:00
assert(perm.permission === ACL.ALLOW);
});
ACL.checkPermission(ACL.USER, 'u001', 'Customer', 'name', ACL.ALL,
function(err, perm) {
assert(perm.permission === ACL.ALLOW);
2013-11-15 17:41:26 +00:00
});
ACL.checkPermission(ACL.USER, 'u002', 'Customer', 'name', ACL.READ,
function(err, perm) {
assert(perm.permission === ACL.ALLOW);
});
ACL.checkPermission(ACL.USER, 'u003', 'Customer', 'name', ACL.WRITE,
function(err, perm) {
assert(perm.permission === ACL.DENY);
});
2013-11-15 17:41:26 +00:00
});
it('should filter static ACLs by model/property', function() {
var Model1 = ds.createModel('Model1', {
name: {
type: String,
acls: [
{principalType: ACL.USER, principalId: 'u001',
accessType: ACL.WRITE, permission: ACL.DENY},
{principalType: ACL.USER, principalId: 'u001',
accessType: ACL.ALL, permission: ACL.ALLOW},
],
},
}, {
acls: [
{principalType: ACL.USER, principalId: 'u001', property: 'name',
accessType: ACL.ALL, permission: ACL.ALLOW},
{principalType: ACL.USER, principalId: 'u002', property: 'findOne',
accessType: ACL.ALL, permission: ACL.ALLOW},
{principalType: ACL.USER, principalId: 'u003', property: ['findOne', 'findById'],
accessType: ACL.ALL, permission: ACL.ALLOW},
],
});
var staticACLs = ACL.getStaticACLs('Model1', 'name');
assert(staticACLs.length === 3);
staticACLs = ACL.getStaticACLs('Model1', 'findOne');
assert(staticACLs.length === 2);
staticACLs = ACL.getStaticACLs('Model1', 'findById');
assert(staticACLs.length === 1);
assert(staticACLs[0].property === 'findById');
});
2014-11-21 02:35:36 +00:00
it('should check access against LDL, ACL, and Role', function() {
2013-11-20 21:31:30 +00:00
// var log = console.log;
var log = function() {};
// Create
User.create({name: 'Raymond', email: 'x@y.com', password: 'foobar'}, function(err, user) {
2013-11-20 21:31:30 +00:00
log('User: ', user.toObject());
var userId = user.id;
2013-11-20 21:31:30 +00:00
// Define a model with static ACLs
var Customer = ds.createModel('Customer', {
name: {
type: String,
acls: [
{principalType: ACL.USER, principalId: userId,
accessType: ACL.WRITE, permission: ACL.DENY},
{principalType: ACL.USER, principalId: userId,
accessType: ACL.ALL, permission: ACL.ALLOW},
],
},
2013-11-20 21:31:30 +00:00
}, {
acls: [
{principalType: ACL.USER, principalId: userId,
accessType: ACL.ALL, permission: ACL.ALLOW},
2014-01-16 23:05:10 +00:00
],
defaultPermission: 'DENY',
2013-11-20 21:31:30 +00:00
});
ACL.create({
principalType: ACL.USER, principalId: userId,
model: 'Customer', property: ACL.ALL,
accessType: ACL.ALL, permission: ACL.ALLOW,
}, function(err, acl) {
2013-11-20 21:31:30 +00:00
log('ACL 1: ', acl.toObject());
Role.create({name: 'MyRole'}, function(err, myRole) {
2013-11-20 21:31:30 +00:00
log('Role: ', myRole.toObject());
myRole.principals.create({principalType: RoleMapping.USER, principalId: userId},
function(err, p) {
2013-11-20 21:31:30 +00:00
log('Principal added to role: ', p.toObject());
ACL.create({
principalType: ACL.ROLE, principalId: 'MyRole',
model: 'Customer', property: ACL.ALL,
accessType: ACL.READ, permission: ACL.DENY,
}, function(err, acl) {
2013-11-20 21:31:30 +00:00
log('ACL 2: ', acl.toObject());
ACL.checkAccessForContext({
2013-11-20 21:31:30 +00:00
principals: [
{type: ACL.USER, id: userId},
2013-11-20 21:31:30 +00:00
],
model: 'Customer',
property: 'name',
accessType: ACL.READ,
2013-11-20 21:31:30 +00:00
}, function(err, access) {
assert(!err && access.permission === ACL.ALLOW);
});
2014-01-16 23:05:10 +00:00
ACL.checkAccessForContext({
2014-01-16 23:05:10 +00:00
principals: [
{type: ACL.ROLE, id: Role.EVERYONE},
2014-01-16 23:05:10 +00:00
],
model: 'Customer',
property: 'name',
accessType: ACL.READ,
2014-01-16 23:05:10 +00:00
}, function(err, access) {
assert(!err && access.permission === ACL.DENY);
});
2013-11-20 21:31:30 +00:00
});
});
});
});
});
});
2013-11-10 06:22:16 +00:00
});
describe('access check', function() {
it('should occur before other remote hooks', function(done) {
var app = loopback();
var MyTestModel = app.registry.createModel('MyTestModel');
var checkAccessCalled = false;
var beforeHookCalled = false;
app.use(loopback.rest());
app.set('remoting', {errorHandler: {debug: true, log: false}});
app.enableAuth();
app.dataSource('test', {connector: 'memory'});
app.model(MyTestModel, {dataSource: 'test'});
// fake / spy on the checkAccess method
MyTestModel.checkAccess = function() {
var cb = arguments[arguments.length - 1];
checkAccessCalled = true;
var allowed = true;
cb(null, allowed);
};
MyTestModel.beforeRemote('find', function(ctx, next) {
// ensure this is called after checkAccess
if (!checkAccessCalled) return done(new Error('incorrect order'));
beforeHookCalled = true;
next();
});
request(app)
.get('/MyTestModels')
.end(function(err, result) {
assert(beforeHookCalled, 'the before hook should be called');
assert(checkAccessCalled, 'checkAccess should have been called');
done();
});
});
});