tlyyxjz opened a new pull request, #1758: URL: https://github.com/apache/casbin/pull/1758
Closes #1624 — implements the authorization test helpers proposed there. > Note: @angelinazzz1809 expressed interest in this issue in June and I want to be explicit that this PR is not meant to step on that work — if they have a draft, I'm happy to fold theirs in or withdraw this one. The thread had been quiet for three months, so I built a working reference implementation (currently published as the external module [tlyyxjz/authztest](https://github.com/tlyyxjz/authztest)) to give the proposal something concrete to review. ## What this adds A new `authztest` sub-package with a deliberately small API surface, per the "thin wrappers around `Enforce`" design note: ```go authztest.AssertAllow(t, e, "alice", "data1", "read") authztest.AssertDeny(t, e, "bob", "data1", "write") ``` The value is in failure context. When an assertion fails, instead of a bare `false`, you get a position-by-position near-miss attribution of the closest policies: ``` authztest: expected ALLOW, got DENY for (alice, data2, read) no policy matched; closest candidates: p, admin, data2, write sub: ok ('alice' inherits 'admin' via g) obj: ok ('data2') act: 'read' does not match 'write' (not a wildcard) ``` There are also two exported escape hatches for people who want the diagnosis without `testing.TB` coupling: `Diagnose(e, rvals...)` (human-readable string, shown above) and `Explain(e, rvals...)` (structured `[]NearMiss`). ## Design decisions - **Structural attribution, not matcher re-evaluation.** The analysis walks policy lines and g (role) rules directly. A subject matched through role inheritance is *credited*, not falsely reported as a "sub mismatch" — the blame lands on the position that actually failed. - **Domain-aware.** For `g = _, _, _` models, role links are checked in the policy line's own domain, so multi-tenant failures are unambiguous. - **Wildcard-aware.** The common `p.obj == "*"` idiom is recognized; arity mismatches between policy lines and the request definition are surfaced. - **`Enforce` errors are errors.** Wrong-arity requests report the error instead of being misattributed as denies. - **No new dependencies, no core changes.** The package only reads the model/policy/role-manager through existing public APIs; nothing in `casbin` core imports it. - **`T` is a minimal interface** (`Helper` + `Errorf`), so `*testing.T`, `*testing.B`, `*testing.F` and custom fakes all work. Targeting the v3 line since that's where `master` development happens; the API has no v3-specific surface and can be backported to v2 if maintainers prefer. If the intended home for this is a separate repository under the casbin org rather than a sub-package (the open question from the issue thread), the code transfers as-is. ## Test evidence - 10 unit tests + 1 runnable `ExampleDiagnose` in the package, covering: pass/fail paths for both assertions, RBAC role-inheritance attribution, domain-scoped attribution, wildcard idiom, near-miss ranking, arity mismatch, and `Enforce` error reporting. - `go test ./...` passes for the whole module; `go vet` and `gofmt` clean. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
