gorm-adapter icon indicating copy to clipboard operation
gorm-adapter copied to clipboard

Loading multiple policy types.

Open Mikkelhost opened this issue 2 years ago • 2 comments

Currently making an RBAC setup for a project. I am using the gorm filtered adapter to make sure that i will not have to implement it at another point due to there being a lot of policies and suddenly a large codebase.

I am a little bit puzzled however. Is there no way to specify for an example that i want to load the following in a single filter?

  1. All p policies regarding "someDomain"
  2. All g policies regarding "someDomain" (Essentially all users within the domain)
  3. All g2 policies regarding "objects::someDomain" (Get all obj groups assigned to some domain)

Or would i have to write my way out of it using the LoadIncrementalFilteredPolicy function going through all the filters?

It seams that the filter type is way different from the fileadapter filter type

My config is currently looking like this

[request_definition]
r = sub, dom, obj, act

[policy_definition]
p = sub, dom, obj, act

[role_definition]
g = _, _, _
g2 = _, _
g3 = _, _ 
[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub, r.dom) && g3(r.dom, p.dom) && (g2(r.obj, p.obj) || (regexMatch(r.obj, p.obj))) && regexMatch(r.act, p.act)

Mikkelhost avatar Aug 10 '22 12:08 Mikkelhost

@tangyang9464 @JalinWang @imp2002

casbin-bot avatar Aug 10 '22 12:08 casbin-bot

@JalinWang

/cc @tangyang9464

hsluoyz avatar Aug 10 '22 12:08 hsluoyz

I am a little bit puzzled however. Is there no way to specify for an example that i want to load the following in a single filter?

  1. All p policies regarding "someDomain"
  2. All g policies regarding "someDomain" (Essentially all users within the domain)
  3. All g2 policies regarding "objects::someDomain" (Get all obj groups assigned to some domain)

Or would i have to write my way out of it using the LoadIncrementalFilteredPolicy function going through all the filters?

@Mikkelhost Sorry but currently the answer is "yes"'😢 But I think it needs to be supported. I'll try to make a PR in days.

JalinWang avatar Aug 18 '22 13:08 JalinWang