Combine priority and deny-override models

[apiscevs]

Hi Dev team,

you've recently added explicit priority model support in 1.9.0, many thanks for that.

Is there any chance to support two policy effects at once? For example Priority model with deny override.
Something like:

[policy_effect]
e = (priority(p.eft) || deny) || (!some(where (p.eft == deny))) 

The value of support such a combined policy effect is that users can have multiple groups assigned with a different eff (allow, deny) and not be dependant on policy position in the file. Please see the example below.

model.conf

[request_definition]
r = sub, obj, act

[policy_definition]
p = priority, sub, obj, act, eft

[role_definition]
g = _, _

[policy_effect]
e = priority(p.eft) || deny

[matchers]
m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act

---

policy.csv

p, 10, data1_deny_group, data1, write, deny
p, 10, data1_allow_group, data1, write, allow

g, alice, data1_deny_group
g, alice, data1_allow_group

---

enforcement result of
e.Enforce("alice", "data1", "write")
will be false, because both groups have the same priority and in this case, Casbin takes the first one, that is deny.

However, if we switch policy and have a policy file like:

policy.csv

p, 10, data1_allow_group, data1, write, allow
p, 10, data1_deny_group, data1, write, deny

g, alice, data1_deny_group
g, alice, data1_allow_group

The result of enforcement - e.Enforce("alice", "data1", "write")
will be Allow, as first is allow policy.

---

In such cases, when there're multiple groups with the same priority, combine Priority and deny-override models.
For example, when enforcement happens, casbin can realize that there're multiple matching policies with the same priority, and in such cases it can additionally apply a deny-override effect?

[sagilio]

I think this feature can be supported.
I have not edit permission for the issue now. @hsluoyz @xcaptain

[apiscevs]

Hello Sagilio,
maybe you have any insights on when presumably this might be added to the Casbin.Net toolbelt?
The thing is that we're starting a new project soon, and having this feature is one of the core requirements.

Thanks,
Alex

[sagilio]

I have read your test case. I think you can try this model directly. @apiscevs

[request_definition]
r = sub, obj, act

[policy_definition]
p = priority, sub, obj, act, eft

[role_definition]
g = _, _

[policy_effect]
e = !some(where (p.eft == deny))

[matchers]
m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act

If you use the explicit priority feature, you only need to include a policy token named priority, and not necessary to set e = priority(p.eft) || deny.

[apiscevs]

Hi Sagilio,

unfortunately, that doesn't work.
Please see the example below:

[request_definition]
r = sub, obj, act

[policy_definition]
p = priority, sub, obj, act, eft

[role_definition]
g = _, _

[policy_effect]
e = !some(where (p.eft == deny))

[matchers]
m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act

p, 5, data1_allow_group, data1, write, allow
p, 10, data1_deny_group, data1, write, deny

g, alice, data1_deny_group
g, alice, data1_allow_group

When enforcing the following statement enforcer.Enforce("alice", "data1", "write"),
the expected result should be allowed, as data1_allow_group priority is higher.
However, the result is deny. It looks like the priority index is ignored.

[sagilio]

Ok, I got what you mean.

[sagilio]

@apiscevs I think the feature needs to auto-group policies firstly, so it will have some break changes. I think this feature is more suitable for integration on the preview branch of our v2.0, how do you think about this？
Here is a migrate guide.

[apiscevs]

Hello @sagilio,
you mean this functionality can be already achieved using the "auto-group" feature in V2,0, or you plan to implement it in v2.0.
I've taken a look at v2.0 breaking changes list, doesn't look scary at all.

[github-actions]

🎉 This issue has been resolved in version 1.10.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀