snapshot of https://github.com/casbin/casbin.git (master, 2026-09-15; blobs > 131072B omitted)

rbac_api_with_domains.go

@@ -0,0 +1,204 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package casbin
+
+import (
+	"fmt"
+
+	"github.com/casbin/casbin/v3/constant"
+)
+
+// GetUsersForRoleInDomain gets the users that has a role inside a domain. Add by Gordon.
+func (e *Enforcer) GetUsersForRoleInDomain(name string, domain string) []string {
+	if e.GetRoleManager() == nil {
+		return nil
+	}
+	res, _ := e.GetRoleManager().GetUsers(name, domain)
+	return res
+}
+
+// GetRolesForUserInDomain gets the roles that a user has inside a domain.
+func (e *Enforcer) GetRolesForUserInDomain(name string, domain string) []string {
+	if rm := e.GetRoleManager(); rm != nil {
+		res, _ := rm.GetRoles(name, domain)
+		return res
+	}
+	return nil
+}
+
+// GetPermissionsForUserInDomain gets permissions for a user or role inside a domain.
+func (e *Enforcer) GetPermissionsForUserInDomain(user string, domain string) [][]string {
+	res, _ := e.GetImplicitPermissionsForUser(user, domain)
+	return res
+}
+
+// AddRoleForUserInDomain adds a role for a user inside a domain.
+// Returns false if the user already has the role (aka not affected).
+func (e *Enforcer) AddRoleForUserInDomain(user string, role string, domain string) (bool, error) {
+	return e.AddGroupingPolicy(user, role, domain)
+}
+
+// DeleteRoleForUserInDomain deletes a role for a user inside a domain.
+// Returns false if the user does not have the role (aka not affected).
+func (e *Enforcer) DeleteRoleForUserInDomain(user string, role string, domain string) (bool, error) {
+	return e.RemoveGroupingPolicy(user, role, domain)
+}
+
+// DeleteRolesForUserInDomain deletes all roles for a user inside a domain.
+// Returns false if the user does not have any roles (aka not affected).
+func (e *Enforcer) DeleteRolesForUserInDomain(user string, domain string) (bool, error) {
+	if e.GetRoleManager() == nil {
+		return false, fmt.Errorf("role manager is not initialized")
+	}
+	roles, err := e.GetRoleManager().GetRoles(user, domain)
+	if err != nil {
+		return false, err
+	}
+
+	var rules [][]string
+	for _, role := range roles {
+		rules = append(rules, []string{user, role, domain})
+	}
+
+	return e.RemoveGroupingPolicies(rules)
+}
+
+// GetAllUsersByDomain would get all users associated with the domain.
+func (e *Enforcer) GetAllUsersByDomain(domain string) ([]string, error) {
+	m := make(map[string]struct{})
+	g, err := e.model.GetAssertion("g", "g")
+	if err != nil {
+		return []string{}, err
+	}
+	p := e.model["p"]["p"]
+	users := make([]string, 0)
+	index, err := e.GetFieldIndex("p", constant.DomainIndex)
+	if err != nil {
+		return []string{}, err
+	}
+
+	getUser := func(index int, policies [][]string, domain string, m map[string]struct{}) []string {
+		if len(policies) == 0 || len(policies[0]) <= index {
+			return []string{}
+		}
+		res := make([]string, 0)
+		for _, policy := range policies {
+			if _, ok := m[policy[0]]; policy[index] == domain && !ok {
+				res = append(res, policy[0])
+				m[policy[0]] = struct{}{}
+			}
+		}
+		return res
+	}
+
+	users = append(users, getUser(2, g.Policy, domain, m)...)
+	users = append(users, getUser(index, p.Policy, domain, m)...)
+	return users, nil
+}
+
+// DeleteAllUsersByDomain would delete all users associated with the domain.
+func (e *Enforcer) DeleteAllUsersByDomain(domain string) (bool, error) {
+	g, err := e.model.GetAssertion("g", "g")
+	if err != nil {
+		return false, err
+	}
+	p := e.model["p"]["p"]
+	index, err := e.GetFieldIndex("p", constant.DomainIndex)
+	if err != nil {
+		return false, err
+	}
+
+	getUser := func(index int, policies [][]string, domain string) [][]string {
+		if len(policies) == 0 || len(policies[0]) <= index {
+			return [][]string{}
+		}
+		res := make([][]string, 0)
+		for _, policy := range policies {
+			if policy[index] == domain {
+				res = append(res, policy)
+			}
+		}
+		return res
+	}
+
+	users := getUser(2, g.Policy, domain)
+	if _, err = e.RemoveGroupingPolicies(users); err != nil {
+		return false, err
+	}
+	users = getUser(index, p.Policy, domain)
+	if _, err = e.RemovePolicies(users); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+// DeleteDomains would delete all associated policies.
+// It would delete all domains if parameter is not provided.
+func (e *Enforcer) DeleteDomains(domains ...string) (bool, error) {
+	if len(domains) == 0 {
+		var err error
+		domains, err = e.GetAllDomains()
+		if err != nil {
+			return false, err
+		}
+	}
+	for _, domain := range domains {
+		if _, err := e.DeleteAllUsersByDomain(domain); err != nil {
+			return false, err
+		}
+		// remove the domain from the RoleManager.
+		if e.GetRoleManager() != nil {
+			if err := e.GetRoleManager().DeleteDomain(domain); err != nil {
+				return false, err
+			}
+		}
+	}
+	return true, nil
+}
+
+// GetAllDomains would get all domains.
+func (e *Enforcer) GetAllDomains() ([]string, error) {
+	if e.GetRoleManager() == nil {
+		return nil, fmt.Errorf("role manager is not initialized")
+	}
+	return e.GetRoleManager().GetAllDomains()
+}
+
+// GetAllRolesByDomain would get all roles associated with the domain.
+// note: Not applicable to Domains with inheritance relationship  (implicit roles)
+func (e *Enforcer) GetAllRolesByDomain(domain string) ([]string, error) {
+	g, err := e.model.GetAssertion("g", "g")
+	if err != nil {
+		return []string{}, err
+	}
+	policies := g.Policy
+	roles := make([]string, 0)
+	existMap := make(map[string]bool) // remove duplicates
+
+	for _, policy := range policies {
+		if policy[len(policy)-1] == domain {
+			role := policy[len(policy)-2]
+			if _, ok := existMap[role]; !ok {
+				roles = append(roles, role)
+				existMap[role] = true
+			}
+		}
+	}
+
+	return roles, nil
+}