Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
veritone-functional-permissions
Advanced tools
Table of Contents
Functional permissions library to perform permission checking.
Permissions are checked against the user permissions (an array of integers), that can be retrieved from core-admin-server.
This library may be used on either servers or in the browser, anywhere where it can be require()
ed.
require()
(e.g. Node 6, RequireJS, webpack)This checks if the user's permissions satisfies the the requested permission check.
const perm = require('functional-permissions-lib');
const adminPerms = perm.permissions.admin;
const userInfo = {
permissions: [-8125, 31]
};
if (perm.util.hasAccessTo(adminPerms.org.create, userInfo.permissions)) {
//allow user to perform action
} else {
//deny the user
}
This checks if the user's permissions satisfies any of the requested permission checks.
const perm = require('functional-permissions-lib');
const adminPerms = perm.permissions.admin;
const userInfo = {
permissions: [-8125, 31]
};
if (
perm.util.hasAccessToAny(
[adminPerms.org.create, adminPerms.group.create, adminPerms.role.create],
userInfo.permissions
)
) {
//allow user to perform action
} else {
//deny the user
}
This checks if the user's permissions satisfies all of the requested permission checks.
const perm = require('functional-permissions-lib');
const adminPerms = perm.permissions.admin;
const userInfo = {
permissions: [-8125, 31]
};
if (
perm.util.hasAccessToAll(
[adminPerms.org.create, adminPerms.group.create, adminPerms.role.create],
userInfo.permissions
)
) {
//allow user to perform action
} else {
//deny the user
}
This converts permission ids to a mask. Optionally, the caller can pass in a mask that will be used to add the permissions to.
const mask = getMaskFromPermissionIds([perm.permissions.admin]);
// OR;
const mask = getMaskFromPermissionIds([perm.permissions.admin], [-1526]);
This converts a mask to permissions IDs.
const permissionIds = getPermissionIdsFromMask([-1526]);
This combines permissions.
const perm = require('functional-permissions-lib');
const adminPerms = perm.permissions.admin;
const cmsPerms = perm.permissions.csm;
const permissions = coombinePermissions(
[adminPerms.org.create, adminPerms.group.create, adminPerms.role.create],
[cmsPerms.media.create, cmsPerms.wrklows.create]
);
This repo an also be imported as a go package to help resolve user permissions in go projects.
import (
permissions "github.com/veritone/functional-permissions-lib"
)
// sample usage
func SomethingUseful(...) {
...
masks := []int{2147483648, 2}
// getting permission IDs from masks
perms := GetPermissionIDsFromMasks(masks)
...
perms2 := []int{1, 13, 26, 62}
// getting permission masks from IDs
masks2 := GetMasksFromPermissionIDs(perms2)
...
// getting permission ID for a permission path
permID, err := GetPermissionID("cms.media.read")
defer permission.Free()
...
}
Copyright 2019, Veritone Inc.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
FAQs
responsible for managing functional permissions
The npm package veritone-functional-permissions receives a total of 104 weekly downloads. As such, veritone-functional-permissions popularity was classified as not popular.
We found that veritone-functional-permissions demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.