fix: get_implicit_users_for_permission() (#168)

ci: upgrade node.js version

test: addded more comprehensive tests for get_implicit_users_for_permission()

Signed-off-by: ffyuanda <46557895+ffyuanda@users.noreply.github.com>

.github/workflows/build.yml

@@ -81,7 +81,9 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v2
+        with:
+          node-version: '16'
 
       - name: Setup
         run: npm install -g semantic-release @semantic-release/github @semantic-release/changelog @semantic-release/commit-analyzer @semantic-release/git @semantic-release/release-notes-generator semantic-release-pypi
@@ -98,4 +100,4 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN }}
           PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
-        run: npx semantic-release  
+        run: npx semantic-release

casbin/enforcer.py

@@ -1,5 +1,5 @@
 from casbin.management_enforcer import ManagementEnforcer
-from casbin.util import join_slice, set_subtract
+from casbin.util import join_slice, array_remove_duplicates, set_subtract
 
 
 class Enforcer(ManagementEnforcer):
@@ -174,13 +174,15 @@ def get_implicit_users_for_permission(self, *permission):
         get_implicit_users_for_permission("data1", "read") will get: ["alice", "bob"].
         Note: only users will be returned, roles (2nd arg in "g") will be excluded.
         """
-        subjects = self.get_all_subjects()
-        roles = self.get_all_roles()
-
-        users = set_subtract(subjects, roles)
+        p_subjects = self.get_all_subjects()
+        g_inherit = self.model.get_values_for_field_in_policy("g", "g", 1)
+        g_subjects = self.model.get_values_for_field_in_policy("g", "g", 0)
+        subjects = array_remove_duplicates(g_subjects + p_subjects)
 
         res = list()
-        for user in users:
+        subjects = set_subtract(subjects, g_inherit)
+
+        for user in subjects:
             req = join_slice(user, *permission)
             allowed = self.enforce(*req)
 

tests/test_rbac_api.py

@@ -296,6 +296,15 @@ def test_implicit_user_api(self):
             ["alice", "bob"], e.get_implicit_users_for_permission("data2", "write")
         )
 
+        e.clear_policy()
+        e.add_policy("admin", "data1", "read")
+        e.add_policy("bob", "data1", "read")
+        e.add_grouping_policy("alice", "admin")
+
+        self.assertEqual(
+            ["alice", "bob"], e.get_implicit_users_for_permission("data1", "read")
+        )
+
 
 class TestRbacApiSynced(TestRbacApi):
     def get_enforcer(self, model=None, adapter=None):