zh/docs/rbac-with-conditions-api/

[giscus[bot]]

zh/docs/rbac-with-conditions-api/

A more user-friendly API for RBAC with conditions.

https://casbin.org/zh/docs/rbac-with-conditions-api/

[Deepak7985]

I want to create a role which has all the permission in my application -> admin
another role which has same access as above but not to delete any resource -> user
How can this be done ??

[hsluoyz]

@Deepak7985 Ask Casbin AI Assistant: https://ai.casbin.com/

[Deepak7985]

hey i tried , but its of no use

[Deepak7985]

I have an admin policy defined as

p, admin, * , *

this ideally should give all permission to admin if i am not wrong.

but when i'm trying to access some resource this is not allowing me to .
I have assined this role for a userId = 3

g, 3, admin

[epistemer]

I'm sorry but I don't understand where in the go code are the startTime and endtime passed ? how do they reach the policy.csv file from the SDK ?

[hsluoyz]

See the source code by yourself

[epistemer]

My question might've been a little bit vague, I'm not asking about the source code, I'm asking about the provided example above. The policy.csv file shows timestamps that are nowhere to be found in the go code, only the time matching function is provided.

[epistemer]

where did those timestamps come from, and how can I add my own ?

[AbhijithMR-403]

has = e.has_permission_for_user("alice", "read")

you needs to also mention the obj
like:
has = e.has_permission_for_user("alice", "data1", "read")

[xiaoLangtou]

Is the hasPermissionForUser method buggy here?

My current model is:

[matchers]
m = g(r.sub, p.sub) && keyMatch3(r.obj, p.obj) && r.act == p.act

Policy example: a route like /abs/{id} should match an actual request route /abs/124.

When I use hasPermissionForUser, the result is false, but when I directly use enforce, the result is true.

Logs:

true  test role permission enforce Admin [ '/user/detail/31', 'GET' ]
false test role permission hasPermissionForUser Admin [ '/user/detail/31', 'GET' ]
false test role permission hasPermissionForUser Admin [ '/user/detail/31', 'GET' ]

[hsluoyz]

@xiaoLangtou enforce and hasPermissionForUser works differently, this is expected. For your case, you should use enforce or batchEnforce