Share your code. npm Orgs help your team discover, share, and reuse code. Create a free org »

    rbac-corepublic

    rbac-core

    npm version Build Status Coverage Status Dependency Status

    The RBAC core from hapi-rbac

    This is inspired by the XACML policies.

    Versions

    How to use it

    First, install

    npm install --save rbac-core
    

    Import it to your project

    const Rbac = require('rbac-core');
    const DataRetrievalRouter = Rbac.DataRetrievalRouter;

    Create your data sources in the data retrieval router

    const dataRetrieverRouter = new DataRetrievalRouter();
     
    /**
     * register(prefixes, dataretriever): registers a data retriever.
     *
     * prefixes - a string or array of strings with prefixes which this data retriever will be associated
     * dataretriever - a function with the following signature
     *         source - The requested prefix
     *         key - the key being requested
     *         context - An object with contextual information
     **/
    dataRetrieverRouter.register('credentials', (source, key, context) => {
     
        // Obtain your value (e.g. from the context)
        const value = context.user[key];
     
        return value;
    });
     
    // You can handle multiple prefixes with a single data retriever
    dataRetrieverRouter.register(['connection', 'status'], (source, key, context) => {
     
        let value;
     
        switch (source) {
            case 'connection':
                // Obtain connection info
                value = context.connection[key];
                break;
            case 'status':
                // Obtain from somewhere else
                value = getStatusValue(key);
                break;
        }
     
        return value;
    });

    Evaluate your policies against a certain context

    const context = {
        user: {
            username: 'francisco',
            group: ['articles:admin', 'articles:developer'],
            validated: true,
            exampleField1: "test-value"
        },
        connection: {
            remoteip: '192.168.0.123',
            remoteport: 90,
            localip: '192.168.0.2'
            localport: 80,
            exampleField2: "test-value"
        }
    };
     
    dataRetrieverRouter.setContext(context);
     
    const policy = {
        target: [
            // if username matches 'francisco' OR (exampleField1 matches exampleField2 AND user group matches 'articles:*')
            { 'credentials:username': 'francisco' },
            // OR
            {
                'credentials:exampleField1': { field: 'connection:exampleField2' }
                // AND
                'credentials:group': /^articles\:.*$/ //(using native javascript RegExp)
            }
        ],
        apply: 'deny-overrides', // permit, unless one denies
        rules: [
            {
                target: { 'credentials:group': 'articles:admin', 'credentials:validated': false }, // if group is 'articles:admin' AND is not validated
                effect: 'deny'  // then deny (deny access to users that are not validated)
            },
            {
                target: { 'connection:remoteip': ['192.168.0.2', '192.168.0.3'] }, // if remoteip is one of '192.168.0.2' or '192.168.0.3'
                effect: 'deny'  // then deny (deny blacklisted ips)
            },
            {
                effect: 'permit' // else permit
            }
        ]
    };
     
    Rbac.evaluatePolicy(policy, dataRetrieverRouter, (err, result) => {
     
        switch (result) {
            case Rbac.PERMIT:
                console.log('ACCESS GRANTED');
                break;
            case Rbac.DENY:
                console.log('ACCESS DENIED');
                break;
        }
    });
     

    If you want to extend your existent data retriever router, you can do it.

    // You can just extend
    const dataRetrieverRouter1 = dataRetrieverRouter.createChild();
     
    // You can also directly add context to the extension, for isolation
    const dataRetrieverRouter2 = dataRetrieverRouter.createChild(context);

    Both dataRetrieverRouter1 and dataRetrieverRouter2 will have all the registered data retrievers from dataRetrieverRouter.

    Changes to dataRetrieverRouter will influence dataRetrieverRouter1 and dataRetrieverRouter2.

    Changes to any of dataRetrieverRouter1 or dataRetrieverRouter2 will not cause influence on any data retriever routers, but themselves.

    Contexts are preserved per data retriever router.

    You can also get data from data retriever router

    dataRetrieverRouter.get('credentials:username', (err, result) => {
        ...
    });

    And you can override the context on get, by passing it in the second argument

    dataRetrieverRouter.get('credentials:username', { username: 'the_overrider', group: ['anonymous'] }, (err, result) => {
        ...
    });

    Learn more about Rule Based Access Control

    To have a better idea of how this works, you can check my Bachelor's project presentation about XACML here (english), or here (portuguese).

    Even though this plugin doesn't implement the XACML specification, it was based on its policies.

    Keywords

    install

    npm i rbac-core

    Downloadsweekly downloads

    386

    version

    3.0.0

    license

    ISC

    repository

    githubgithub

    last publish

    collaborators

    • avatar