hsluoyz commented on issue #481: URL: https://github.com/apache/casbin-node-casbin/issues/481#issuecomment-5207362750
@TessilimiTheo Your setup is fine — this was a real bug on our side. `enforce()` honoured the `p.dom == '*'` branch of your matcher, but `getImplicitPermissionsForUser()` compared the domain field with plain string equality, so every rule stored on the `*` domain was silently dropped and you got an empty list. Fixed in [[80648e0](https://github.com/apache/casbin-node-casbin/commit/80648e03a3522fe12568231e1243511316d7eeb7)](https://github.com/apache/casbin-node-casbin/commit/80648e03a3522fe12568231e1243511316d7eeb7), aligning the implicit role/permission APIs with Go Casbin. Register a domain matching function once and your example works as expected: ```js await e.addNamedDomainMatchingFunc('g', keyMatchFunc); ``` `getImplicitPermissionsForUser('michael', 'tenant1')` now returns the `abstract_roles1` permissions with the domain resolved to `tenant1`, and `g, theo, super_user, *` grants across every tenant. With that in place you can also simplify your matcher — the `|| g(r.sub, p.sub, '*')` branch becomes redundant. See `examples/rbac_with_domain_pattern_in_policy_*` for a runnable version of your policy. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
