Multiple policies config?

[yamilfrich]

Hi, I'm new with Casbin and I'm trying to configure it with multiple policies like:

• Feature policy (for each subscription plan, it will contain or not certain features):
  For example, for the subscription plan "professional" it will have the feature "insights"
  My policy config for this would be probably just:
  p = sub, obj

• Roles policy (basic ACL, like: admin, users, write):
  My policy config would be:
  p2 = sub, obj, act

I read on https://casbin.org/docs/en/syntax-for-models#policy-definition that it's actually possible to define multiple policies and you have some examples below, but I can't find the way to make it work on node-casbin.

When adding the policy in the DB (I'm using casbin-sequelize-adapter) it allows you to use "named" policies by using: e.addNamedPolicies.

But when you want to enforce and choose which namedPolicy you want to use, I can't find how to do so.

This is the config I'm trying (I'm repeating all just in case based on the docs):

[request_definition]
r = sub, obj
r2 = sub, obj, act

[policy_definition]
p = sub, act # features
p2 = sub, obj, act # roles

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = r.sub == p.sub && r.obj == p.obj
m2 = r.sub == p.sub && r.obj == p.obj && r.act == p.act

Hope this is clear, thanks in advance.

[hsluoyz]

@Zxilly @Gabriel-403 @closetool @tangyang9464

[tangyang9464]

It seems that node-casbin does not support this feature now.

[tangyang9464]

@yamilfrich your m2 have an error.
Should it be r2？

[Gabriel-403]

It seems that node-casbin does not support this feature now.

I think so,and this seems that I wrote this part

[yamilfrich]

@yamilfrich your m2 have an error.
Should it be r2？

Not sure, I couldn't make it work anyway, so I couldn't validate if I need to reference to r2, p2, etc.

It seems that node-casbin does not support this feature now.

I think so,and this seems that I wrote this part

So, how would you solve this? Different configs + Different Enforcers?

If so, can they still share the same adapter + db_table?

[tangyang9464]

@yamilfrich r-p-e-m four type must one-to-one correspondence. In Go-casbin you can pass in a EnforceContext to specify which types you need to use for your request. See Multiple sections type

[yamilfrich]

@yamilfrich r-p-e-m four type must one-to-one correspondence. In Go-casbin you can pass in a EnforceContext to specify which types you need to use for your request. See Multiple sections type

Ok thank you 😄 , but I have node, so I need to find a way to make this work with node. Should it be with multiple configs and multiple enforcers? Can they share the same db_table?

[tangyang9464]

@yamilfrich r-p-e-m four type must one-to-one correspondence. In Go-casbin you can pass in a EnforceContext to specify which types you need to use for your request. See Multiple sections type

Ok thank you 😄 , but I have node, so I need to find a way to make this work with node. Should it be with multiple configs and multiple enforcers? Can they share the same db_table?

node-casbin is implementing this feature. It should be consistent with go-casbin

[hsluoyz]

@Zxilly @Gabriel-403 plz implement it

[Gabriel-403]

@Zxilly @Gabriel-403 plz implement it

ok！

[Gabriel-403]

@yamilfrich

This function has been added and can be used later

[yamilfrich]

Thank you, how can we implement it? Is there any code example? 🙏🏻 I'll look in the changes and the code and see if I can manage my way.

[Zxilly]

@yamilfrich Full discussion can be found at casbin/casbin.js#172 casbin/casbin.js#176. If that PR got merged, we will apply it to node-casbin immediately.

[rashid301]

any ETA on this? We have a need for this soon.

[Zxilly]

@rashid301 An early bird version is available at casbin.js@next, but it has some limitation right now. The migration will take place when it is functionally complete.
You can find casbin.js@next at https://github.com/casbin/casbin.js/tree/v1

[Shivansh-yadav13]

hey, can I work on this? it is in the docs but not present.

[vaseala]

how's the progress?

[vaseala]

@Gabriel-403

It seems that node-casbin does not support this feature now.

I think so,and this seems that I wrote this part

https://github.com/Gabriel-403/node-casbin/blob/master/src/coreEnforcer.ts#L378

I find you fixed it, but why not merged it to master branch?

[hsluoyz]

Can we merge this code to origin? @Gabriel-403 @Shivansh-yadav13

/cc @nodece @Zxilly

[Shivansh-yadav13]

I'm not sure of it's working
how is this returning true

import { newEnforcer, newModel, MemoryAdapter, EnforceContext } from 'casbin';

const ec = new EnforceContext('r2', 'p2', 'e', 'm2');

const model = newModel(`
[request_definition]
r = sub, obj
r2 = sub, obj, act

[policy_definition]
p = sub, obj
p2 = sub, obj, act

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = r.sub == p.sub && r.obj == p.obj
m2 = r.sub == p.sub && r.obj == p.obj && r.act == p.act
`);

const adapter = new MemoryAdapter(`
p2, alice, data1, read
p2, bob, data2, write
`);

const enforcer = await newEnforcer(model, adapter);

const res = await enforcer.enforce(ec, 'alice', 'data2', 'read');
console.log(res);

[nodece]

@Shivansh-yadav13 Could you cherry-pick the cc58c57 and 33c784c to your branch, then make a PR?

[nodece]

This should be returned false, could you work on this?

I'm not sure of it's working how is this returning true

import { newEnforcer, newModel, MemoryAdapter, EnforceContext } from 'casbin';

const ec = new EnforceContext('r2', 'p2', 'e', 'm2');

const model = newModel(`
[request_definition]
r = sub, obj
r2 = sub, obj, act

[policy_definition]
p = sub, obj
p2 = sub, obj, act

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = r.sub == p.sub && r.obj == p.obj
m2 = r.sub == p.sub && r.obj == p.obj && r.act == p.act
`);

const adapter = new MemoryAdapter(`
p2, alice, data1, read
p2, bob, data2, write
`);

const enforcer = await newEnforcer(model, adapter);

const res = await enforcer.enforce(ec, 'alice', 'data2', 'read');
console.log(res);

also I think we should set default values here

node-casbin/src/enforceContext.ts

Line 3 in 81e3c15

export class EnforceContext {

[Shivansh-yadav13]

This should be returned false, could you work on this?

@nodece sorry it should be m2 = r2.sub == p2.sub && r2.obj == p2.obj && r2.act == p2.act

[hsluoyz]

@yamilfrich