[Bug] keyGet2 in matchers not working as expected

[Takumi Ito]

Want to prioritize this issue? Try:

---

Describe the bug
keyGet2 in matchers is not evaluated correctly

To Reproduce
Steps to reproduce the behavior:
I want to implement RBAC with domain.
What I tried is,

• policy.csv

p, admin, /workspaces/:workspace_id, (GET)|(PUT)|(DELETE), allow
p, member, /workspaces/:workspace_id, GET, allow

g, alice, admin, workspace1
g, alice, member, workspace2
g, bob, admin, workspace2

• model.conf

[request_definition]
r = sub, dom, obj, act

[policy_definition]
p = sub, obj, act, eft

[role_definition]
g = _, _, _

[policy_effect]
e = some(where (p.eft == allow)) && !some(where (p.eft == deny))

[matchers]
m = g(r.sub, p.sub, r.dom) && keyMatch2(r.obj, p.obj) && regexMatch(r.act, p.act) && getKey2(r.obj, p.obj, 'workspace_id') == r.dom

Expected behavior
request alice, workspace1, /workspaces/workspace1, GET expects true, but actually false returns.

Desktop (please complete the following information):

• OS: Windows
• Browser: Microsoft Edge (editor ceased working in chrome)
• Version: Online Editor

Additional context
Registering custom function solved my issue already, but I still don't understand why the above implementation didn't go.

[request_definition]
r = sub, dom, obj, act

[policy_definition]
p = sub, obj, act, eft

[role_definition]
g = _, _, _

[policy_effect]
e = some(where (p.eft == allow)) && !some(where (p.eft == deny))

[matchers]
m = g(r.sub, p.sub, r.dom) && keyMatch2(r.obj, p.obj) && regexMatch(r.act, p.act) && parseWorkspace(r.obj, p.obj, r.dom)

package main

import (
	"fmt"
	"github.com/casbin/casbin/v2"
	"github.com/casbin/casbin/v2/util"
	"log"
)

func main() {
	e, err := casbin.NewEnforcer("./model.conf", "./policy.csv")
	if err != nil {
		log.Fatal(err)
	}
	
	e.AddFunction("parseWorkspace", ParseWorkspace)

	enforce, err := e.Enforce("alice", "workspace1", "/workspaces/workspace1", "GET")
	if err != nil {
		return
	}

	fmt.Println(enforce)
}

func parseWorkspace(requestObj string, policyObj string, dom string) bool {
	return util.KeyGet2(requestObj, policyObj, "workspace_id") == dom
}

func ParseWorkspace(args ...interface{}) (interface{}, error) {
	name1 := args[0].(string)
	name2 := args[1].(string)
	name3 := args[2].(string)

	return parseWorkspace(name1, name2, name3), nil
}

[Yang Luo]

@closetool @tangyang9464

[Yang Tang]

@t5ujiri
Do you test the case in Go code?After my test, Go-casbin can work but the online editor is false.I think it may be online editor's error.

[Kiloson]

@tangyang9464 @t5ujiri Modify getKey2 -> keyGet2

[Yang Tang]

@tangyang9464 @t5ujiri Modify getKey2 -> keyGet2

I forgot to say that.But I test the case use keyGet2 not getKey2

[Takumi Ito]

@closetool @tangyang9464
Here's the capture of online editor with fixed policy showing unexpected result.
The same policy and request worked gracefully in Go code.

[Yang Tang]

maybe online editor depends on the node-casbin instead of Go-casbin

[Kiloson]

cc: @Zxilly

[Zxilly]

@closetool I think node-casbin didn't have keyGet2 right now. I will later add it.

[Yang Luo]

🎉 This issue has been resolved in version 1.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀