diff --git a/examples/priority_model_explicit_customized.conf b/examples/priority_model_explicit_customized.conf new file mode 100644 index 000000000..c12040c88 --- /dev/null +++ b/examples/priority_model_explicit_customized.conf @@ -0,0 +1,14 @@ +[request_definition] +r = subject, obj, act + +[policy_definition] +p = priority, obj, act, eft, subject + +[role_definition] +g = _, _ + +[policy_effect] +e = priority(p.eft) || deny + +[matchers] +m = g(r.subject, p.subject) && r.obj == p.obj && r.act == p.act \ No newline at end of file diff --git a/examples/priority_policy_explicit_customized.csv b/examples/priority_policy_explicit_customized.csv new file mode 100644 index 000000000..a861e2ba7 --- /dev/null +++ b/examples/priority_policy_explicit_customized.csv @@ -0,0 +1,12 @@ +p, 10, data1, read, deny, data1_deny_group +p, 10, data1, write, deny, data1_deny_group +p, 10, data2, read, allow, data2_allow_group +p, 10, data2, write, allow, data2_allow_group + + +p, 1, data1, write, allow, alice +p, 1, data1, read, allow, alice +p, 1, data2, read, deny, bob + +g, bob, data2_allow_group +g, alice, data1_deny_group diff --git a/rbac_api_test.go b/rbac_api_test.go index b2ba1b819..41ab44f0e 100644 --- a/rbac_api_test.go +++ b/rbac_api_test.go @@ -15,6 +15,7 @@ package casbin import ( + "github.com/casbin/casbin/v2/constant" "sort" "testing" @@ -461,3 +462,57 @@ func testGetImplicitUsersForRole(t *testing.T, e *Enforcer, name string, res []s t.Error("Implicit users for ", name, ": ", myRes, ", supposed to be ", res) } } + +func TestExplicitPriorityModify(t *testing.T) { + e, _ := NewEnforcer("examples/priority_model_explicit.conf", "examples/priority_policy_explicit.csv") + + testEnforce(t, e, "bob", "data2", "write", true) + _, err := e.AddPolicy("1", "bob", "data2", "write", "deny") + if err != nil { + t.Fatalf("AddPolicy: %v", err) + } + testEnforce(t, e, "bob", "data2", "write", false) + + _, err = e.DeletePermissionsForUser("bob") + if err != nil { + t.Fatalf("DeletePermissionForUser: %v", err) + } + testEnforce(t, e, "bob", "data2", "write", true) + + _, err = e.DeleteRole("data2_allow_group") + if err != nil { + t.Fatalf("DeleteRole: %v", err) + } + testEnforce(t, e, "bob", "data2", "write", false) +} + +func TestCustomizedFieldIndex(t *testing.T) { + e, _ := NewEnforcer("examples/priority_model_explicit_customized.conf", + "examples/priority_policy_explicit_customized.csv") + + testEnforce(t, e, "bob", "data2", "write", true) + _, err := e.AddPolicy("1", "data2", "write", "deny", "bob") + if err != nil { + t.Fatalf("AddPolicy: %v", err) + } + testEnforce(t, e, "bob", "data2", "write", false) + + _, err = e.DeletePermissionsForUser("bob") + if err == nil { + t.Fatalf("Failed to warning SetFieldIndex") + } + + e.SetFieldIndex("p", constant.SubjectIndex, 4) + + _, err = e.DeletePermissionsForUser("bob") + if err != nil { + t.Fatalf("DeletePermissionForUser: %v", err) + } + testEnforce(t, e, "bob", "data2", "write", true) + + _, err = e.DeleteRole("data2_allow_group") + if err != nil { + t.Fatalf("DeleteRole: %v", err) + } + testEnforce(t, e, "bob", "data2", "write", false) +}