This is an automated email from the ASF dual-hosted git repository.
hsluoyz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/casbin.git
The following commit(s) were added to refs/heads/master by this push:
new 1571e4f fix: pass domains in ConditionalRoleManager transitive link
check
1571e4f is described below
commit 1571e4f34fdad9106d05ab8d8ef59f5efc7fe987
Author: Yang Luo <[email protected]>
AuthorDate: Wed Jun 24 00:44:58 2026 +0800
fix: pass domains in ConditionalRoleManager transitive link check
---
.../rbac_with_domain_temporal_roles_transitive_policy.csv | 5 +++++
model_test.go | 13 +++++++++++++
rbac/default-role-manager/role_manager.go | 2 +-
3 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/examples/rbac_with_domain_temporal_roles_transitive_policy.csv
b/examples/rbac_with_domain_temporal_roles_transitive_policy.csv
new file mode 100644
index 0000000..46df2c8
--- /dev/null
+++ b/examples/rbac_with_domain_temporal_roles_transitive_policy.csv
@@ -0,0 +1,5 @@
+p, role_top, domainx, data_top, read
+p, role_solo, domainx, data_solo, read
+g, alice, role_mid, domainx, _, _
+g, role_mid, role_top, domainx, 0000-01-01 00:00:00, 0000-01-02 00:00:00
+g, alice, role_solo, domainx, 0000-01-01 00:00:00, 0000-01-02 00:00:00
diff --git a/model_test.go b/model_test.go
index c3e5432..45a7c2a 100644
--- a/model_test.go
+++ b/model_test.go
@@ -769,6 +769,19 @@ func TestTemporalRolesModelWithDomain(t *testing.T) {
testDomainEnforce(t, e, "alice", "domain_not_exist", "data8", "write",
false)
}
+func TestTemporalRolesModelWithDomainTransitive(t *testing.T) {
+ e, _ :=
NewEnforcer("examples/rbac_with_domain_temporal_roles_model.conf",
"examples/rbac_with_domain_temporal_roles_transitive_policy.csv")
+
+ e.AddNamedDomainLinkConditionFunc("g", "alice", "role_mid", "domainx",
util.TimeMatchFunc)
+ e.AddNamedDomainLinkConditionFunc("g", "role_mid", "role_top",
"domainx", util.TimeMatchFunc)
+ e.AddNamedDomainLinkConditionFunc("g", "alice", "role_solo", "domainx",
util.TimeMatchFunc)
+
+ // single-hop expired link -> correctly denied (control)
+ testDomainEnforce(t, e, "alice", "domainx", "data_solo", "read", false)
+ // two-hop chain whose 2nd link is expired -> must be denied as well
+ testDomainEnforce(t, e, "alice", "domainx", "data_top", "read", false)
+}
+
func TestReBACModel(t *testing.T) {
e, _ := NewEnforcer("examples/rebac_model.conf",
"examples/rebac_policy.csv")
diff --git a/rbac/default-role-manager/role_manager.go
b/rbac/default-role-manager/role_manager.go
index d6e9d16..2caf7be 100644
--- a/rbac/default-role-manager/role_manager.go
+++ b/rbac/default-role-manager/role_manager.go
@@ -817,7 +817,7 @@ func (crm *ConditionalRoleManager) hasLinkHelper(targetName
string, roles map[st
})
}
- return crm.hasLinkHelper(targetName, nextRoles, level-1)
+ return crm.hasLinkHelper(targetName, nextRoles, level-1, domains...)
}
func (crm *ConditionalRoleManager) getNextRoles(currentRole, nextRole *Role,
domains []string, nextRoles map[string]*Role) bool {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
