feat: support domain matching when getting permissions

[Abingcbc]

fix: #969

How it works

GetImplicitPermissionsForUser depends on GetFilteredPolicies to query permissions. But when enforcer gets filtered policies, it doesn't support domain matching.
So there are main changes in this PR:

1. Make match of role manager public and reuse this function for domain matching when getting policies.
2. Add a new function GetFilteredPolicyWithDomainMatching for the user requirements mentioned in
   [Question] Get implicit permissions with pattern-matching in RBAC don't work #969.
3. Unit tests.

[casbin-bot]

@tangyang9464 @closetool @sagilio please review

[hsluoyz]

@sasakiyori @tangyang9464 plz review

[tangyang9464]

@Abingcbc I have an idea, why not just use rm.HasLink to get permissions directly, because GetFilteredPolicies only works without pattern. This PR solves Domain Match, how to solve RBAC pattern? If use rm.HasLink, then GetImplicitPermissionsForUser and GetPermissionsForUser can be combined into the same method. Code draft

func (e *Enforcer) GetPermissionsForUser(user string, domain ...string) [][]string {
	permission := make([][]string, 0)
	rm := e.GetRoleManager()
	//
		add domain match here
	//
	for _, rule := range e.model["p"]["p"].Policy {
		matched, _ := rm.HasLink(user, rule[0], domain...)
		if matched {
			permission = append(permission, rule)
		}
	}
	return permission
}

[Abingcbc]

@tangyang9464 Thx for your idea! I will refactor this PR.

BTW what do you mean by

GetImplicitPermissionsForUser and GetPermissionsForUser can be combined into the same method.

[tangyang9464]

@tangyang9464 Thx for your idea! I will refactor this PR.

BTW what do you mean by

GetImplicitPermissionsForUser and GetPermissionsForUser can be combined into the same method.

@Abingcbc I wanted to combine the two methods before, but now I think it's inappropriate, please ignore.

[Abingcbc]

@tangyang9464 PTAL

[hsluoyz]

@sasakiyori @tangyang9464 plz review

[Abingcbc]

@tangyang9464 plz review

[tangyang9464]

Will the rule change affect the original policy?

[Abingcbc]

Yep, the rule is a slice. If users update the value in returned slice, the policy will also be changed

[Abingcbc]

Maybe we should also check if this bug happens anywhere else?

[tangyang9464]

Yep, You're right. Could you do this？

[Abingcbc]

ok :)

[Abingcbc]

I will fix this issue in a new PR

[Abingcbc]

@tangyang9464 plz review

[Abingcbc]

@tangyang9464 @hsluoyz plz review

[tangyang9464]

LGTM

[github-actions]

🎉 This PR is included in version 2.50.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[JalinWang]

@Abingcbc @tangyang9464 Hi, I don't think this PR has solved this problem totally.

policy

g, alice, admin, *
g, bob, admin, domain2

test code

	e, _ = NewEnforcer("examples/rbac_with_domain_pattern_model.conf", "examples/rbac_with_domain_pattern_policy.csv")
	e.AddNamedDomainMatchingFunc("g", "KeyMatch", util.KeyMatch)

	res, _ := e.GetRolesForUser("bob", "*")
	t.Log(res)

	res, _ = e.GetRolesForUser("bob", "domain1")
	t.Log(res)

	res, _ = e.GetRolesForUser("bob", "domain2")
	t.Log(res)

result:

expected result:
res, _ := e.GetRolesForUser("bob", "*") returns [admin] (for * matches domain2 and bob is admin in domain2)

/cc @hsluoyz

[JalinWang]

What's more, we can't assume the RoleManager is the default one. And this dependency should not be introduced into Enforcer.

[Abingcbc]

Yep, we may refactor from the first imported dependency

casbin/enforcer.go

Lines 730 to 745 in 9b43426

	func (e *Enforcer) AddNamedMatchingFunc(ptype, name string, fn defaultrolemanager.MatchingFunc) bool {
	if rm, ok := e.rmMap[ptype]; ok {
	rm.(*defaultrolemanager.RoleManager).AddMatchingFunc(name, fn)
	return true
	}
	return false
	}
	// AddNamedDomainMatchingFunc add MatchingFunc by ptype to RoleManager
	func (e *Enforcer) AddNamedDomainMatchingFunc(ptype, name string, fn defaultrolemanager.MatchingFunc) bool {
	if rm, ok := e.rmMap[ptype]; ok {
	rm.(*defaultrolemanager.RoleManager).AddDomainMatchingFunc(name, fn)
	return true
	}
	return false
	}

An interface may be better than struct.

[JalinWang]

I think we should modify the code of DomainManager.
One elegant way is to enable getRoleManager to return all the role managers that match the domain, e.g., "*" return "domain" and "domain2", while now it only returns one.

// load or create a RoleManager instance of domain
func (dm *DomainManager) getRoleManager(domain string, store bool) *RoleManagerImpl {
	var rm *RoleManagerImpl
	var ok bool

	if rm, ok = dm.load(domain); !ok {
		rm = newRoleManagerWithMatchingFunc(dm.maxHierarchyLevel, dm.matchingFunc)
		if store {
			dm.rmMap.Store(domain, rm)
		}
		if dm.domainMatchingFunc != nil {
			dm.rmMap.Range(func(key, value interface{}) bool {
				domain2 := key.(string)
				rm2 := value.(*RoleManagerImpl)
				if domain != domain2 && dm.Match(domain, domain2) {
					rm.copyFrom(rm2)
				}
				return true // change to append()
			})
		}
	}
	return rm
}

[Abingcbc]

policy

g, alice, admin, *
g, bob, admin, domain2

test code

	e, _ = NewEnforcer("examples/rbac_with_domain_pattern_model.conf", "examples/rbac_with_domain_pattern_policy.csv")
	e.AddNamedDomainMatchingFunc("g", "KeyMatch", util.KeyMatch)

	res, _ := e.GetRolesForUser("bob", "*")
	t.Log(res)

	res, _ = e.GetRolesForUser("bob", "domain1")
	t.Log(res)

	res, _ = e.GetRolesForUser("bob", "domain2")
	t.Log(res)

result:

expected result: res, _ := e.GetRolesForUser("bob", "*") returns [admin] (for * matches domain2 and bob is admin in domain2)

Sure, this PR only adds domain matching when getting permissions. And GetRolesForUser is not included in GetImplicitPermission.