Support overriding rules per route

README.md

@@ -49,6 +49,8 @@ The API exposed by this plugin is the configuration options:
 | `onDeny` | `(Reply, sub, obj, act) => any`                             | Invoked when Casbin's `enforce` resolves to false | Returns a `403 Forbidden` error |
 | `hook`   | `'onRequest' | 'preParsing' | preValidation` | 'preHandler' | Which lifecycle to use for performing the check   | 'onRoute'                       |
 
+You can also set `getSub`, `getObj` and `getAct` params inside route options. Route extraction rules take precedence over global plugin rules.
+
 ## Examples
 
 A working example can be found in the [examples](examples) folder.
@@ -94,9 +96,10 @@ fastify.get(
   {
     // ensure user is authenticated
     preValidation: [fastify.authenticate],
-    // enable fastify-casbin-rest plugin on this route
+    // enable fastify-casbin-rest plugin on this route, override default "getObj" rule
     casbin: {
-      rest: true
+      rest: true,
+      getObj: request => request.userId
     }
   },
   async () => `You're in!`

plugin.js

@@ -29,10 +29,14 @@ async function fastifyCasbinRest (fastify, options) {
         routeOptions[hook] = [routeOptions[hook]]
       }
 
+      const getSub = routeOptions.casbin.getSub || options.getSub
+      const getObj = routeOptions.casbin.getObj || options.getObj
+      const getAct = routeOptions.casbin.getAct || options.getAct
+
       routeOptions[hook].push(async (request, reply) => {
-        const sub = options.getSub(request)
-        const obj = options.getObj(request)
-        const act = options.getAct(request)
+        const sub = getSub(request)
+        const obj = getObj(request)
+        const act = getAct(request)
 
         fastify.log.info({ sub, obj, act }, 'Invoking casbin enforce')
 

test/casbinRest.test.js

@@ -204,3 +204,40 @@ test('supports specifying custom hooks', t => {
     fastify.close()
   })
 })
+
+test('supports overriding plugin rules on route level', t => {
+  t.plan(4)
+
+  const fastify = Fastify()
+
+  fastify.register(makeStubCasbin())
+  fastify.register(plugin, {
+    hook: 'onRequest',
+    getSub: request => request.user,
+    getObj: request => request.url,
+    getAct: request => request.method
+  })
+
+  fastify.get('/', {
+    casbin: {
+      rest: true,
+      getSub: request => request.method,
+      getObj: request => request.user,
+      getAct: request => request.url
+    }
+  }, () => 'ok')
+
+  fastify.ready(async err => {
+    t.error(err)
+
+    fastify.casbin.enforce.callsFake((sub, obj, act) => {
+      t.equal(sub, 'GET')
+      t.equal(obj, undefined)
+      t.equal(act, '/')
+      return Promise.resolve(false)
+    })
+
+    await fastify.inject('/')
+    fastify.close()
+  })
+})