Repository: casbin/casbin
Pull request #217 (2019-04-23 16:06:59)

Add domain paramter for GetImplicitPermissionsForUser


Patch:
diff --git a/examples/rbac_with_hierarchy_with_domains_policy.csv b/examples/rbac_with_hierarchy_with_domains_policy.csv
index 8e0f3d6..49cce40 100644
--- a/examples/rbac_with_hierarchy_with_domains_policy.csv
+++ b/examples/rbac_with_hierarchy_with_domains_policy.csv
@@ -1,6 +1,9 @@
 p, role:reader, domain1, data1, read
 p, role:writer, domain1, data1, write
 
+p, alice, domain1, data1, read
+p, alice, domain2, data1, read
+
 g, role:global_admin, role:reader, domain1
 g, role:global_admin, role:writer, domain1
 
diff --git a/rbac_api.go b/rbac_api.go
index fe8b57d..5fb3f9f 100644
--- a/rbac_api.go
+++ b/rbac_api.go
@@ -171,14 +171,25 @@ func (e *Enforcer) GetImplicitRolesForUser(name string, domain ...string) []stri
 //
 // GetPermissionsForUser("alice") can only get: [["alice", "data2", "read"]].
 // But GetImplicitPermissionsForUser("alice") will get: [["admin", "data1", "read"], ["alice", "data2", "read"]].
-func (e *Enforcer) GetImplicitPermissionsForUser(user string) [][]string {
-	roles := e.GetImplicitRolesForUser(user)
-	roles = append([]string{user}, roles...)
-
+func (e *Enforcer) GetImplicitPermissionsForUser(user string, domain ...string) [][]string {
+	roles := e.GetImplicitRolesForUser(user, domain...)
 	res := [][]string{}
+	permissions := [][]string{}
+
 	for _, role := range roles {
-		permissions := e.GetPermissionsForUser(role)
+		permissions = e.GetPermissionsForUser(role)
 		res = append(res, permissions...)
 	}
+
+	if len(domain) == 1 {
+		permissions = e.GetPermissionsForUserInDomain(user, domain[0])
+	} else if len(domain) > 1 {
+		panic("error: domain should be 1 parameter")
+	} else {
+		permissions = e.GetPermissionsForUser(user)
+	}
+
+	res = append(res, permissions...)
+
 	return res
 }


Test patch:
diff --git a/rbac_api_test.go b/rbac_api_test.go
index 807d33e..3cdde49 100644
--- a/rbac_api_test.go
+++ b/rbac_api_test.go
@@ -214,12 +214,27 @@ func testGetImplicitPermissions(t *testing.T, e *Enforcer, name string, res [][]
 	}
 }
 
+func testGetImplicitPermissionsWithDomain(t *testing.T, e *Enforcer, name string, domain string, res [][]string) {
+	t.Helper()
+	myRes := e.GetImplicitPermissionsForUser(name, domain)
+	t.Log("Implicit permissions for", name, "under", domain, ":", myRes)
+
+	if !util.Array2DEquals(res, myRes) {
+		t.Error("Implicit permissions for", name, "under", domain, ":", myRes, ", supposed to be ", res)
+	}
+}
+
 func TestImplicitPermissionAPI(t *testing.T) {
 	e := NewEnforcer("examples/rbac_model.conf", "examples/rbac_with_hierarchy_policy.csv")
 
 	testGetPermissions(t, e, "alice", [][]string{{"alice", "data1", "read"}})
 	testGetPermissions(t, e, "bob", [][]string{{"bob", "data2", "write"}})
 
-	testGetImplicitPermissions(t, e, "alice", [][]string{{"alice", "data1", "read"}, {"data1_admin", "data1", "read"}, {"data1_admin", "data1", "write"}, {"data2_admin", "data2", "read"}, {"data2_admin", "data2", "write"}})
+	testGetImplicitPermissions(t, e, "alice", [][]string{{"data1_admin", "data1", "read"}, {"data1_admin", "data1", "write"}, {"data2_admin", "data2", "read"}, {"data2_admin", "data2", "write"}, {"alice", "data1", "read"}})
 	testGetImplicitPermissions(t, e, "bob", [][]string{{"bob", "data2", "write"}})
 }
+
+func TestImplicitPermissionAPIWithDomain(t *testing.T) {
+	e := NewEnforcer("examples/rbac_with_domains_model.conf", "examples/rbac_with_hierarchy_with_domains_policy.csv")
+	testGetImplicitPermissionsWithDomain(t, e, "alice", "domain1", [][]string{{"role:reader", "domain1", "data1", "read"}, {"role:writer", "domain1", "data1", "write"}, {"alice", "domain1", "data1", "read"}})
+}