[BUG]: KeyError: 'g' when build_role_links

[zhou93]

Below is my role definition

[role_definition]
g = _, _, (_, _)
g2 = _, _

From the code, we can see that when params_tokens is greater than 0, it will be added to cond_rm_map:

if len(assertion.tokens) <= 2 and len(assertion.params_tokens) != 0:
    assertion.cond_rm = default_role_manager.ConditionalRoleManager(10)
    self.cond_rm_map[ptype] = assertion.cond_rm

In the build_role_links function, there is no check if the map contains the required key, which can cause an error:

def build_role_links(self, rm_map):
    """initializes the roles in RBAC."""

    if "g" not in self.keys():
        return

    for ptype, ast in self["g"].items():
        rm = rm_map[ptype]
        ast.build_role_links(rm)

In the build_conditional_role_links function, the check is correctly implemented:

def build_conditional_role_links(self, cond_rm_map):
    if "g" not in self.keys():
        return
    self.print_policy()
    for ptype, ast in self["g"].items():
        cond_rm = cond_rm_map.get(ptype)
        if cond_rm:
            ast.build_conditional_role_links(cond_rm)

[casbin-bot]

@techoner @Nekotoxin

[Yang Luo]

@leeqvip

[github-actions]

🎉 This issue has been resolved in version 1.36.3 🎉

The release is available on:

• v1.36.3
• GitHub release

Your semantic-release bot 📦🚀

[zhou93]

Error When Calling get_implicit_permissions_for_user

In the above scenario, calling the function get_implicit_permissions_for_user results in an error.

From the code, we can see:

def get_named_implicit_permissions_for_user(self, ptype, user, domain="", filter_policy_dom=True):
    """
    gets implicit permissions for a user or role by named policy.
    Compared to get_permissions_for_user(), this function retrieves permissions for inherited roles.
    For example:
    p, admin, data1, read
    p, alice, data2, read
    g, alice, admin

    get_permissions_for_user("alice") can only get: [["alice", "data2", "read"]].
    But get_implicit_permissions_for_user("alice") will get: [["admin", "data1", "read"], ["alice", "data2", "read"]].

    For given domain policies are filtered by corresponding domain matching function of DomainManager
    Inherited roles can be matched by domain. For domain neutral policies set:
        filter_policy_dom = False

    filter_policy_dom: bool - For given *domain*, policies will be filtered by domain as well. Default = True
    """
    roles = self.get_implicit_roles_for_user(user, domain)

    roles.insert(0, user)

    res = []

    # policy domain should be matched by domain_match_fn of DomainManager
    domain_matching_func = self.get_role_manager().domain_matching_func
    if domain and domain_matching_func != None:
        domain = partial(domain_matching_func, domain)

    for role in roles:
        permissions = self.get_named_permissions_for_user_in_domain(
            ptype, role, domain if filter_policy_dom else ""
        )
        res.extend(permissions)

    return res

This function calls get_role_manager, which is defined as follows:

def get_role_manager(self):
    """gets the current role manager."""
    return self.rm_map["g"]

At this point, rm_map does not contain g, because g is in cond_rm_map.