import { Effector } from './effect'; import { FunctionMap, Model, PolicyOp } from './model'; import { Adapter, FilteredAdapter, Watcher, BatchAdapter, UpdatableAdapter, WatcherEx } from './persist'; import { RoleManager } from './rbac'; import { MatchingFunc } from './rbac'; import { FileSystem } from './persist'; /** * CoreEnforcer defines the core functionality of an enforcer. */ export declare class CoreEnforcer { protected modelPath: string; protected model: Model; protected fm: FunctionMap; protected eft: Effector; private matcherMap; private defaultEnforceContext; protected adapter: UpdatableAdapter | FilteredAdapter | Adapter | BatchAdapter; protected watcher: Watcher | null; protected watcherEx: WatcherEx | null; protected rmMap: Map; protected enabled: boolean; protected autoSave: boolean; protected autoBuildRoleLinks: boolean; protected autoNotifyWatcher: boolean; protected fs?: FileSystem; /** * setFileSystem sets a file system to read the model file or the policy file. * @param fs {@link FileSystem} */ setFileSystem(fs: FileSystem): void; /** * getFileSystem gets the file system, */ getFileSystem(): FileSystem | undefined; private getExpression; /** * loadModel reloads the model from the model CONF file. * Because the policy is attached to a model, * so the policy is invalidated and needs to be reloaded by calling LoadPolicy(). */ loadModel(): void; /** * getModel gets the current model. * * @return the model of the enforcer. */ getModel(): Model; /** * setModel sets the current model. * * @param m the model. */ setModel(m: Model): void; /** * getAdapter gets the current adapter. * * @return the adapter of the enforcer. */ getAdapter(): Adapter; /** * setAdapter sets the current adapter. * * @param adapter the adapter. */ setAdapter(adapter: Adapter): void; /** * setWatcher sets the current watcher. * * @param watcher the watcher. */ setWatcher(watcher: Watcher): void; /** * setWatcherEx sets the current watcherEx. * * @param watcherEx the watcherEx. */ setWatcherEx(watcherEx: WatcherEx): void; /** * setRoleManager sets the current role manager. * * @param rm the role manager. */ setRoleManager(rm: RoleManager): void; /** * setRoleManager sets the role manager for the named policy. * * @param ptype the named policy. * @param rm the role manager. */ setNamedRoleManager(ptype: string, rm: RoleManager): void; /** * getRoleManager gets the current role manager. */ getRoleManager(): RoleManager; /** * getNamedRoleManager gets role manager by name. */ getNamedRoleManager(name: string): RoleManager | undefined; /** * setEffector sets the current effector. * * @param eft the effector. */ setEffector(eft: Effector): void; /** * clearPolicy clears all policy. */ clearPolicy(): void; initRmMap(): void; sortPolicies(): void; /** * loadPolicy reloads the policy from file/database. */ loadPolicy(): Promise; /** * loadFilteredPolicy reloads a filtered policy from file/database. * * @param filter the filter used to specify which type of policy should be loaded. */ loadFilteredPolicy(filter: any): Promise; /** * LoadIncrementalFilteredPolicy append a filtered policy from file/database. * * @param filter the filter used to specify which type of policy should be appended. */ loadIncrementalFilteredPolicy(filter: any): Promise; /** * isFiltered returns true if the loaded policy has been filtered. * * @return if the loaded policy has been filtered. */ isFiltered(): boolean; /** * savePolicy saves the current policy (usually after changed with * Casbin API) back to file/database. */ savePolicy(): Promise; /** * enableEnforce changes the enforcing state of Casbin, when Casbin is * disabled, all access will be allowed by the enforce() function. * * @param enable whether to enable the enforcer. */ enableEnforce(enable: boolean): void; /** * enableLog changes whether to print Casbin log to the standard output. * * @param enable whether to enable Casbin's log. */ enableLog(enable: boolean): void; /** * enableAutoSave controls whether to save a policy rule automatically to * the adapter when it is added or removed. * * @param autoSave whether to enable the AutoSave feature. */ enableAutoSave(autoSave: boolean): void; /** * enableAutoNotifyWatcher controls whether to save a policy rule automatically notify the Watcher when it is added or removed. * @param enable whether to enable the AutoNotifyWatcher feature. */ enableAutoNotifyWatcher(enable: boolean): void; /** * enableAutoBuildRoleLinks controls whether to save a policy rule * automatically to the adapter when it is added or removed. * * @param autoBuildRoleLinks whether to automatically build the role links. */ enableAutoBuildRoleLinks(autoBuildRoleLinks: boolean): void; /** * add matching function to RoleManager by ptype * @param ptype g * @param fn the function will be added */ addNamedMatchingFunc(ptype: string, fn: MatchingFunc): Promise; /** * add domain matching function to RoleManager by ptype * @param ptype g * @param fn the function will be added */ addNamedDomainMatchingFunc(ptype: string, fn: MatchingFunc): Promise; /** * buildRoleLinks manually rebuild the role inheritance relations. */ buildRoleLinks(): Promise; /** * buildIncrementalRoleLinks provides incremental build the role inheritance relations. * @param op policy operation * @param ptype g * @param rules policies */ buildIncrementalRoleLinks(op: PolicyOp, ptype: string, rules: string[][]): Promise; protected buildRoleLinksInternal(): Promise; private privateEnforce; /** * If the matchers does not contain an asynchronous method, call it faster. * * enforceSync decides whether a "subject" can access a "object" with * the operation "action", input parameters are usually: (sub, obj, act). * * @param rvals the request needs to be mediated, usually an array * of strings, can be class instances if ABAC is used. * @return whether to allow the request. */ enforceSync(...rvals: any[]): boolean; /** * If the matchers does not contain an asynchronous method, call it faster. * * enforceSync decides whether a "subject" can access a "object" with * the operation "action", input parameters are usually: (sub, obj, act). * * @param rvals the request needs to be mediated, usually an array * of strings, can be class instances if ABAC is used. * @return whether to allow the request and the reason rule. */ enforceExSync(...rvals: any[]): [boolean, string[]]; /** * Same as enforceSync. To be removed. */ enforceWithSyncCompile(...rvals: any[]): boolean; /** * enforce decides whether a "subject" can access a "object" with * the operation "action", input parameters are usually: (sub, obj, act). * * @param rvals the request needs to be mediated, usually an array * of strings, can be class instances if ABAC is used. * @return whether to allow the request. */ enforce(...rvals: any[]): Promise; /** * enforceWithMatcher decides whether a "subject" can access a "object" with * the operation "action" but with the matcher passed, * input parameters are usually: (matcher, sub, obj, act). * * @param matcher matcher string. * @param rvals the request needs to be mediated, usually an array * of strings, can be class instances if ABAC is used. * @return whether to allow the request. */ enforceWithMatcher(matcher: string, ...rvals: any[]): Promise; /** * enforce decides whether a "subject" can access a "object" with * the operation "action", input parameters are usually: (sub, obj, act). * * @param rvals the request needs to be mediated, usually an array * of strings, can be class instances if ABAC is used. * @return whether to allow the request and the reason rule. */ enforceEx(...rvals: any[]): Promise<[boolean, string[]]>; /** * enforceExWithMatcher decides whether a "subject" can access a "object" with * the operation "action" but with the matcher passed, * input parameters are usually: (matcher, sub, obj, act). * * @param matcher matcher string. * @param rvals the request needs to be mediated, usually an array * of strings, can be class instances if ABAC is used. * @return whether to allow the request and the reason rule. */ enforceExWithMatcher(matcher: string, ...rvals: any[]): Promise<[boolean, string[]]>; /** * batchEnforce enforces each request and returns result in a bool array. * @param rvals the request need to be mediated, usually an array * of array of strings, can be class instances if ABAC is used. * @returns whether to allow the requests. */ batchEnforce(rvals: any[]): Promise; }