Readjustement of the introduction image and first version of casbin authorization mechanism

web/backend/model.conf

@@ -0,0 +1,12 @@
+# This file define the model of the authorization mechanism
+[request_definition]
+r = sub, obj, act
+
+[policy_definition]
+p = sub, obj, act
+
+[policy_effect]
+e = some(where (p.eft == allow))
+
+[matchers]
+m = r.sub == p.sub && r.obj == p.obj && r.act == p.act

web/backend/package.json

@@ -19,6 +19,7 @@
   "dependencies": {
     "@dedis/kyber": "^3.4.4",
     "axios": "^0.24.0",
+    "casbin": "^5.19.1",
     "cookie-parser": "^1.4.6",
     "crypto": "^1.0.1",
     "express": "^4.17.2",

web/backend/policy.csv

@@ -0,0 +1,63 @@
+p, 330383, roles, list
+p, 330383, election, create
+p, 330383, roles, remove
+p, 330383, roles, add
+p, 330383, proxies, post
+p, 330383, proxies, put
+p, 330383, proxies, delete
+
+p, 228271, roles, list
+p, 228271, election, create
+p, 228271, roles, remove
+p, 228271, roles, add
+p, 228271, proxies, post
+p, 228271, proxies, put
+p, 228271, proxies, delete
+
+p, 330361, roles, list
+p, 330361, election, create
+p, 330361, roles, remove
+p, 330361, roles, add
+p, 330361, proxies, post
+p, 330361, proxies, put
+p, 330361, proxies, delete
+
+p, 175129, roles, list
+p, 175129, election, create
+p, 175129, roles, remove
+p, 175129, roles, add
+p, 175129, proxies, post
+p, 175129, proxies, put
+p, 175129, proxies, delete
+
+p, 324610, roles, list
+p, 324610, election, create
+p, 324610, roles, remove
+p, 324610, roles, add
+p, 324610, proxies, post
+p, 324610, proxies, put
+p, 324610, proxies, delete
+
+p, 330382, roles, list
+p, 330382, election, create
+p, 330382, roles, remove
+p, 330382, roles, add
+p, 330382, proxies, post
+p, 330382, proxies, put
+p, 330382, proxies, delete
+
+p, 315822, roles, list
+p, 315822, election, create
+p, 315822, roles, remove
+p, 315822, roles, add
+p, 315822, proxies, post
+p, 315822, proxies, put
+p, 315822, proxies, delete
+
+p, 321016, roles, list
+p, 321016, election, create
+p, 321016, roles, remove
+p, 321016, roles, add
+p, 321016, proxies, post
+p, 321016, proxies, put
+p, 321016, proxies, delete

web/backend/src/Server.ts

@@ -8,9 +8,19 @@ import crypto from 'crypto';
 import lmdb, { RangeOptions } from 'lmdb';
 import xss from 'xss';
 import createMemoryStore from 'memorystore';
+import { Enforcer, newEnforcer } from 'casbin';
 
 const MemoryStore = createMemoryStore(session);
-
+const ROLES = 'roles';
+const LIST = 'list';
+const REMOVE = 'remove';
+const ADD = 'add';
+const PROXIES = 'proxies';
+const PUT = 'put';
+const POST = 'post';
+const DELETE = 'delete';
+const ELECTION = 'election';
+const CREATE = 'create';
 // store is used to store the session
 const store = new MemoryStore({
   checkPeriod: 86400000, // prune expired entries every 24h
@@ -25,6 +35,26 @@ const app = express();
 
 app.use(morgan('tiny'));
 
+let enf: Enforcer;
+
+const enforcerLoading = newEnforcer('model.conf', 'policy.csv');
+const port = process.env.PORT || 5000;
+
+Promise.all([enforcerLoading])
+  .then((res) => {
+    [enf] = res;
+    console.log(`🛡 Casbin loaded`);
+    app.listen(port);
+    console.log(`🚀 App is listening on port ${port}`);
+  })
+  .catch((err) => {
+    console.error('❌ failed to start:', err);
+  });
+
+function isAuthorized(sciper: number | undefined, subject: string, action: string): boolean {
+  return enf.enforceSync(sciper, subject, action);
+}
+
 declare module 'express-session' {
   export interface SessionData {
     userid: number;
@@ -71,6 +101,7 @@ app.use(express.urlencoded({ extended: true }));
 
 // This endpoint allows anyone to get a "default" proxy. Clients can still use
 // the proxy of their choice thought.
+
 app.get('/api/config/proxy', (req, res) => {
   res.status(200).send(process.env.DELA_NODE_URL);
 });
@@ -154,49 +185,58 @@ app.post('/api/logout', (req, res) => {
 // As the user is logged on the app via this express but must also be logged in
 // the react. This endpoint serves to send to the client (actually to react)
 // the information of the current user.
-app.get('/api/personal_info', (req, res) => {
-  res.set('Access-Control-Allow-Origin', '*');
-  if (req.session.userid) {
-    res.json({
-      sciper: req.session.userid,
-      lastname: req.session.lastname,
-      firstname: req.session.firstname,
-      role: req.session.role,
-      islogged: true,
-    });
-  } else {
-    res.json({
-      sciper: 0,
-      lastname: '',
-      firstname: '',
-      role: '',
-      islogged: false,
-    });
-  }
-});
-
-function isAuthorized(roles: string[], req: express.Request): boolean {
-  if (!req.session || !req.session.userid) {
-    return false;
+function setMapAuthorization(list: string[][]) {
+  const m = new Map<String, Array<String>>();
+  for (let i = 0; i < list.length; i += 1) {
+    for (let j = 1; j < list[0].length; j += +2) {
+      console.log(list[i][j]);
+      if (m.has(list[i][j])) {
+        m.get(list[i][j])?.push(list[i][j + 1]);
+      } else {
+        m.set(list[i][j], [list[i][j + 1]]);
+      }
+    }
   }
-
-  const { role } = req.session;
-
-  return roles.includes(role as string);
+  console.log(m);
+  return m;
 }
+app.get('/api/personal_info', (req, res) => {
+  let m = new Map<String, Array<String>>();
+  enf.getFilteredPolicy(0, String(req.session.userid)).then((list) => {
+    m = setMapAuthorization(list);
+    res.set('Access-Control-Allow-Origin', '*');
+    if (req.session.userid) {
+      res.json({
+        sciper: req.session.userid,
+        lastname: req.session.lastname,
+        firstname: req.session.firstname,
+        role: req.session.role,
+        islogged: true,
+        authorization: Object.fromEntries(m),
+      });
+    } else {
+      res.json({
+        sciper: 0,
+        lastname: '',
+        firstname: '',
+        role: '',
+        islogged: false,
+        authorization: Object.fromEntries(m),
+      });
+    }
+  });
+});
 
 // ---
 // Users role
 // ---
-
 // This call allow a user that is admin to get the list of the people that have
 // a special role (not a voter).
 app.get('/api/user_rights', (req, res) => {
-  if (!isAuthorized(['admin'], req)) {
+  if (!isAuthorized(req.session.userid, ROLES, LIST)) {
     res.status(400).send('Unauthorized - only admins allowed');
     return;
   }
-
   const opts: RangeOptions = {};
   const users = Array.from(
     usersDB.getRange(opts).map(({ key, value }) => ({ id: '0', sciper: key, role: value }))
@@ -206,13 +246,11 @@ app.get('/api/user_rights', (req, res) => {
 
 // This call (only for admins) allow an admin to add a role to a voter.
 app.post('/api/add_role', (req, res) => {
-  if (!isAuthorized(['admin'], req)) {
+  if (!isAuthorized(req.session.userid, ROLES, ADD)) {
     res.status(400).send('Unauthorized - only admins allowed');
     return;
   }
 
-  // {sciper: xxx, role: xxx}
-
   const { sciper } = req.body;
   const { role } = req.body;
 
@@ -224,13 +262,12 @@ app.post('/api/add_role', (req, res) => {
 
 // This call (only for admins) allow an admin to remove a role to a user.
 app.post('/api/remove_role', (req, res) => {
-  if (!isAuthorized(['admin'], req)) {
+  if (!isAuthorized(req.session.userid, ROLES, REMOVE)) {
     res.status(400).send('Unauthorized - only admins allowed');
     return;
   }
 
   const { sciper } = req.body;
-
   usersDB
     .remove(sciper)
     .then(() => {
@@ -256,40 +293,12 @@ app.post('/api/remove_role', (req, res) => {
 // ---
 // Proxies
 // ---
-
 const proxiesDB = lmdb.open<string, string>({ path: `${process.env.DB_PATH}proxies` });
-
-app.get('/api/proxies', (req, res) => {
-  const output = new Map<string, string>();
-  proxiesDB.getRange({}).forEach((entry) => {
-    output.set(entry.key, entry.value);
-  });
-
-  res.status(200).json({ Proxies: Object.fromEntries(output) });
-});
-
-app.get('/api/proxies/:nodeAddr', (req, res) => {
-  const { nodeAddr } = req.params;
-
-  const proxy = proxiesDB.get(decodeURIComponent(nodeAddr));
-
-  if (proxy === undefined) {
-    res.status(404).send('not found');
-    return;
-  }
-
-  res.status(200).json({
-    NodeAddr: nodeAddr,
-    Proxy: proxy,
-  });
-});
-
 app.post('/api/proxies', (req, res) => {
-  if (!isAuthorized(['admin', 'operator'], req)) {
+  if (!isAuthorized(req.session.userid, PROXIES, POST)) {
     res.status(400).send('Unauthorized - only admins and operators allowed');
     return;
   }
-
   try {
     const bodydata = req.body;
     proxiesDB.put(bodydata.NodeAddr, bodydata.Proxy);
@@ -301,7 +310,7 @@ app.post('/api/proxies', (req, res) => {
 });
 
 app.put('/api/proxies/:nodeAddr', (req, res) => {
-  if (!isAuthorized(['admin', 'operator'], req)) {
+  if (!isAuthorized(req.session.userid, PROXIES, PUT)) {
     res.status(400).send('Unauthorized - only admins and operators allowed');
     return;
   }
@@ -316,7 +325,6 @@ app.put('/api/proxies/:nodeAddr', (req, res) => {
     res.status(404).send('not found');
     return;
   }
-
   try {
     const bodydata = req.body;
     if (bodydata.Proxy === undefined) {
@@ -333,7 +341,7 @@ app.put('/api/proxies/:nodeAddr', (req, res) => {
 });
 
 app.delete('/api/proxies/:nodeAddr', (req, res) => {
-  if (!isAuthorized(['admin', 'operator'], req)) {
+  if (!isAuthorized(req.session.userid, PROXIES, DELETE)) {
     res.status(400).send('Unauthorized - only admins and operators allowed');
     return;
   }
@@ -358,6 +366,31 @@ app.delete('/api/proxies/:nodeAddr', (req, res) => {
   }
 });
 
+app.get('/api/proxies', (req, res) => {
+  const output = new Map<string, string>();
+  proxiesDB.getRange({}).forEach((entry) => {
+    output.set(entry.key, entry.value);
+  });
+
+  res.status(200).json({ Proxies: Object.fromEntries(output) });
+});
+
+app.get('/api/proxies/:nodeAddr', (req, res) => {
+  const { nodeAddr } = req.params;
+
+  const proxy = proxiesDB.get(decodeURIComponent(nodeAddr));
+
+  if (proxy === undefined) {
+    res.status(404).send('not found');
+    return;
+  }
+
+  res.status(200).json({
+    NodeAddr: nodeAddr,
+    Proxy: proxy,
+  });
+});
+
 // ---
 // end of proxies
 // ---
@@ -461,12 +494,10 @@ function sendToDela(dataStr: string, req: express.Request, res: express.Response
 
 // Secure /api/evoting to admins and operators
 app.use('/api/evoting/*', (req, res, next) => {
-  if (!isAuthorized(['admin', 'operator'], req)) {
-    console.log('role is:', req.session.role);
+  if (!isAuthorized(req.session.userid, ELECTION, CREATE)) {
     res.status(400).send('Unauthorized - only admins and operators allowed');
     return;
   }
-
   next();
 });
 
@@ -557,8 +588,3 @@ app.get('*', (req, res) => {
   const url = new URL(req.url, `http://${req.headers.host}`);
   res.status(404).send(`not found ${xss(url.toString())}`);
 });
-
-const port = process.env.PORT || 5000;
-app.listen(port);
-
-console.log(`App is listening on port ${port}`);

web/backend/tsconfig.json

@@ -25,6 +25,8 @@
     }
   },
   "include": [
+    "model.conf",
+    "policy.csv",
     "src/Server.ts",
     "config.json"
   ],