الـ RBAC و ABAC والملكية: policy واحدة بدل ifs متفرقة

import { as } from "./client.js";
const show = (who, what, r) =>
  console.log(String(r.status).padEnd(4), who.padEnd(6), what.padEnd(28), r.body ? JSON.stringify(r.body).slice(0, 70) : "");

show("hany", "PATCH doc 1 (شركة تانية)", await as("hany")("PATCH", "/docs/1", { title: "hacked" }));
show("zein", "PATCH doc 3 (intern)", await as("zein")("PATCH", "/docs/3", { title: "مرتبات؟" }));
show("mona", "PATCH doc 3 (بتاع sara)", await as("mona")("PATCH", "/docs/3", { title: "اتغيّر" }));
show("mona", "publish doc 1 (بتاعها)", await as("mona")("POST", "/docs/1/publish"));
show("omar", "GET /docs (viewer)", await as("omar")("GET", "/docs"));

$ node server.js & sleep 0.8; node attack.js; kill $!
API: http://localhost:3000
200  hany   PATCH doc 1 (شركة تانية)     {"id":1,"tenant":"acme","owner":"mona","status":"draft","title":"hacke
200  zein   PATCH doc 3 (intern)         {"id":3,"tenant":"acme","owner":"sara","status":"draft","title":"مرتبا
200  mona   PATCH doc 3 (بتاع sara)      {"id":3,"tenant":"acme","owner":"sara","status":"draft","title":"اتغيّ
200  mona   publish doc 1 (بتاعها)       {"id":1,"tenant":"acme","owner":"mona","status":"published","title":"h
200  omar   GET /docs (viewer)           [{"id":1,"tenant":"acme","owner":"mona","status":"published","title":"

// policy.js: كل قرارات الصلاحيات في مكان واحد
// RBAC: كل role بيقدر يعمل أنهي actions
const PERMISSIONS = {
  viewer: ["read"],
  editor: ["read", "update", "publish"],
  admin: ["read", "update", "publish", "delete"],
};

// ABAC: شروط على الـ user والـ document
const RULES = {
  read: (u, d) => d.status === "published" || u.role !== "viewer" || "viewer بيشوف المنشور بس",
  update: (u, d) => u.role === "admin" || d.owner === u.id || "editor بيعدّل بتاعه بس",
  publish: (u, d) => d.owner !== u.id || "صاحب الـ document ما ينشرهوش لنفسه (four-eyes)",
  delete: () => true,
};

export function can(user, action, doc) {
  const deny = (reason) => ({ allow: false, reason });
  if (!user || !doc) return deny("مفيش user أو document");
  if (user.tenant !== doc.tenant) return deny("tenant مختلف");
  if (!PERMISSIONS[user.role]?.includes(action)) return deny(`role ${user.role} ما عندوش ${action}`);
  const rule = RULES[action]?.(user, doc);
  if (rule !== true) return deny(rule || "مفيش rule");
  return { allow: true, reason: "ok" };
}

// الـ list بتتفلتر بنفس الـ policy، مش بشرط تاني مكتوب بإيد
export const visibleDocs = (user, docs) => docs.filter((d) => can(user, "read", d).allow);

$ node test.js
✅ mona  read     doc:1   allow
✅ mona  read     doc:3   allow
✅ mona  update   doc:1   allow
✅ mona  update   doc:3   deny (editor بيعدّل بتاعه بس)
✅ mona  publish  doc:1   deny (صاحب الـ document ما ينشرهوش لنفسه (four-eyes))
✅ mona  publish  doc:3   allow
✅ mona  delete   doc:1   deny (role editor ما عندوش delete)
✅ omar  read     doc:2   allow
✅ omar  read     doc:1   deny (viewer بيشوف المنشور بس)
✅ omar  update   doc:2   deny (role viewer ما عندوش update)
✅ sara  update   doc:1   allow
✅ sara  delete   doc:1   allow
✅ sara  publish  doc:3   deny (صاحب الـ document ما ينشرهوش لنفسه (four-eyes))
✅ hany  read     doc:1   deny (tenant مختلف)
✅ hany  update   doc:1   deny (tenant مختلف)
✅ hany  read     doc:4   allow
✅ zein  read     doc:2   deny (role intern ما عندوش read)
✅ zein  update   doc:3   deny (role intern ما عندوش update)
✅ mona  read     doc:99  deny (مفيش user أو document)
✅ mona  share    doc:1   deny (role editor ما عندوش share)
✅ visibleDocs(omar) = [2]
✅ visibleDocs(mona) = [1,2,3]
✅ visibleDocs(hany) = [4]
✅ visibleDocs(zein) = []

24/24 نجحوا

import express from "express";
import { USERS, DOCS } from "./data.js";
import { can, visibleDocs } from "./policy.js";

const app = express();
app.use(express.json());
app.use((req, res, next) => {
  req.user = USERS[req.get("authorization")?.replace("Bearer ", "")];
  req.user ? next() : res.status(401).end();
});

// middleware واحد: يجيب الـ document ويسأل الـ policy، ويسجّل القرار
const authorize = (action) => (req, res, next) => {
  const doc = DOCS.find((d) => d.id === Number(req.params.id));
  const { allow, reason } = can(req.user, action, doc);
  console.log(`${allow ? "allow" : "deny "} ${req.user.id} ${action} doc:${req.params.id} ← ${reason}`);
  if (!allow) {
    // مش من حقك تعرف إنه موجود ← 404. تقدر تشوفه بس مش مسموحلك ← 403
    const canSee = doc && can(req.user, "read", doc).allow;
    return canSee
      ? res.status(403).json({ error: reason })
      : res.status(404).json({ error: "مش موجود" }); // السبب في الـ log بس
  }
  req.doc = doc;
  next();
};

app.get("/docs", (req, res) => res.json(visibleDocs(req.user, DOCS).map((d) => d.title)));
app.get("/docs/:id", authorize("read"), (req, res) => res.json(req.doc));
app.patch("/docs/:id", authorize("update"), (req, res) => {
  req.doc.title = req.body.title;
  res.json(req.doc);
});
app.post("/docs/:id/publish", authorize("publish"), (req, res) => {
  req.doc.status = "published";
  res.json(req.doc);
});
app.delete("/docs/:id", authorize("delete"), (req, res) => {
  DOCS.splice(DOCS.indexOf(req.doc), 1);
  res.status(204).end();
});

app.listen(3000, () => console.log("API: http://localhost:3000"));

// data.js: مستخدمين في شركتين (tenants)، و documents
export const USERS = {
  "tok-mona": { id: "mona", tenant: "acme", role: "editor" },
  "tok-omar": { id: "omar", tenant: "acme", role: "viewer" },
  "tok-sara": { id: "sara", tenant: "acme", role: "admin" },
  "tok-hany": { id: "hany", tenant: "globex", role: "admin" },
  "tok-zein": { id: "zein", tenant: "acme", role: "intern" }, // role جديد محدش عرّفه
};
export const DOCS = [
  { id: 1, tenant: "acme", owner: "mona", status: "draft", title: "خطة Q3" },
  { id: 2, tenant: "acme", owner: "sara", status: "published", title: "سياسة الإجازات" },
  { id: 3, tenant: "acme", owner: "sara", status: "draft", title: "مرتبات" },
  { id: 4, tenant: "globex", owner: "hany", status: "published", title: "عقد globex" },
];

// client.js
export const as = (tok) => async (method, path, body) => {
  const r = await fetch("http://localhost:3000" + path, {
    method,
    headers: { authorization: `Bearer tok-${tok}`, "content-type": "application/json" },
    body: body && JSON.stringify(body),
  });
  const text = await r.text();
  return { status: r.status, body: text ? JSON.parse(text) : null };
};

// test.js: بيختبر الـ policy لوحدها، من غير server
import { can, visibleDocs } from "./policy.js";
import { USERS, DOCS } from "./data.js";
const u = (id) => Object.values(USERS).find((x) => x.id === id);
const doc = (id) => DOCS.find((d) => d.id === id);

const matrix = [
  ["mona", "read", 1, true], ["mona", "read", 3, true], ["mona", "update", 1, true],
  ["mona", "update", 3, false], ["mona", "publish", 1, false], ["mona", "publish", 3, true],
  ["mona", "delete", 1, false], ["omar", "read", 2, true], ["omar", "read", 1, false],
  ["omar", "update", 2, false], ["sara", "update", 1, true], ["sara", "delete", 1, true],
  ["sara", "publish", 3, false], ["hany", "read", 1, false], ["hany", "update", 1, false],
  ["hany", "read", 4, true], ["zein", "read", 2, false], ["zein", "update", 3, false],
  ["mona", "read", 99, false], ["mona", "share", 1, false],
];
let ok = 0;
for (const [who, action, id, want] of matrix) {
  const r = can(u(who), action, doc(id));
  const pass = r.allow === want;
  if (pass) ok++;
  console.log(pass ? "✅" : "❌", who.padEnd(5), action.padEnd(8), `doc:${id}`.padEnd(7), r.allow ? "allow" : `deny (${r.reason})`);
}
const titles = (who) => visibleDocs(u(who), DOCS).map((d) => d.id).join(",");
const lists = [["omar", "2"], ["mona", "1,2,3"], ["hany", "4"], ["zein", ""]];
for (const [who, want] of lists) {
  const got = titles(who);
  if (got === want) ok++;
  console.log(got === want ? "✅" : "❌", `visibleDocs(${who}) = [${got}]`);
}
console.log(`\n${ok}/${matrix.length + lists.length} نجحوا`);