Repository: casbin/casbin
Pull request #220 (2019-04-25 06:38:56)

Fix GetImplicitPermissionsForUser

hsluoyz: @nodece the test cases are not passed, see the Travis CI link above.

Patch:
diff --git a/examples/rbac_with_hierarchy_with_domains_policy.csv b/examples/rbac_with_hierarchy_with_domains_policy.csv
index 49cce40..45d9173 100644
--- a/examples/rbac_with_hierarchy_with_domains_policy.csv
+++ b/examples/rbac_with_hierarchy_with_domains_policy.csv
@@ -1,8 +1,8 @@
 p, role:reader, domain1, data1, read
 p, role:writer, domain1, data1, write
 
-p, alice, domain1, data1, read
-p, alice, domain2, data1, read
+p, alice, domain1, data2, read
+p, alice, domain2, data2, read
 
 g, role:global_admin, role:reader, domain1
 g, role:global_admin, role:writer, domain1
diff --git a/rbac_api.go b/rbac_api.go
index 5fb3f9f..fef0b63 100644
--- a/rbac_api.go
+++ b/rbac_api.go
@@ -173,23 +173,25 @@ func (e *Enforcer) GetImplicitRolesForUser(name string, domain ...string) []stri
 // But GetImplicitPermissionsForUser("alice") will get: [["admin", "data1", "read"], ["alice", "data2", "read"]].
 func (e *Enforcer) GetImplicitPermissionsForUser(user string, domain ...string) [][]string {
 	roles := e.GetImplicitRolesForUser(user, domain...)
-	res := [][]string{}
-	permissions := [][]string{}
-
-	for _, role := range roles {
-		permissions = e.GetPermissionsForUser(role)
-		res = append(res, permissions...)
-	}
+	roles = append([]string{user}, roles...)
 
+	withDomain := false
 	if len(domain) == 1 {
-		permissions = e.GetPermissionsForUserInDomain(user, domain[0])
+		withDomain = true
 	} else if len(domain) > 1 {
 		panic("error: domain should be 1 parameter")
-	} else {
-		permissions = e.GetPermissionsForUser(user)
 	}
 
-	res = append(res, permissions...)
+	res := [][]string{}
+	permissions := [][]string{}
+	for _, role := range roles {
+		if withDomain {
+			permissions = e.GetPermissionsForUserInDomain(role, domain[0])
+		} else {
+			permissions = e.GetPermissionsForUser(role)
+		}
+		res = append(res, permissions...)
+	}
 
 	return res
 }


Test patch:
diff --git a/rbac_api_test.go b/rbac_api_test.go
index 3cdde49..9b5f2d2 100644
--- a/rbac_api_test.go
+++ b/rbac_api_test.go
@@ -230,11 +230,11 @@ func TestImplicitPermissionAPI(t *testing.T) {
 	testGetPermissions(t, e, "alice", [][]string{{"alice", "data1", "read"}})
 	testGetPermissions(t, e, "bob", [][]string{{"bob", "data2", "write"}})
 
-	testGetImplicitPermissions(t, e, "alice", [][]string{{"data1_admin", "data1", "read"}, {"data1_admin", "data1", "write"}, {"data2_admin", "data2", "read"}, {"data2_admin", "data2", "write"}, {"alice", "data1", "read"}})
+	testGetImplicitPermissions(t, e, "alice", [][]string{{"alice", "data1", "read"}, {"data1_admin", "data1", "read"}, {"data1_admin", "data1", "write"}, {"data2_admin", "data2", "read"}, {"data2_admin", "data2", "write"}})
 	testGetImplicitPermissions(t, e, "bob", [][]string{{"bob", "data2", "write"}})
 }
 
 func TestImplicitPermissionAPIWithDomain(t *testing.T) {
 	e := NewEnforcer("examples/rbac_with_domains_model.conf", "examples/rbac_with_hierarchy_with_domains_policy.csv")
-	testGetImplicitPermissionsWithDomain(t, e, "alice", "domain1", [][]string{{"role:reader", "domain1", "data1", "read"}, {"role:writer", "domain1", "data1", "write"}, {"alice", "domain1", "data1", "read"}})
+	testGetImplicitPermissionsWithDomain(t, e, "alice", "domain1", [][]string{{"alice", "domain1", "data2", "read"}, {"role:reader", "domain1", "data1", "read"}, {"role:writer", "domain1", "data1", "write"}})
 }