RBAC with domain and domain pattern returns invalid results

[Nalweakette]

When using model with keymatch, the role manager doesn't create links like it is supposed to do, giving invalid enforce result. RoleManager used to work when it was a "clone" of the node.js version, but broke when it was reworked on this commit a409154

Also note that now buildRoleLinks() must be called to have some "good" results

How to reproduce:

======================================================================
model.conf

[request_definition]
r = sub, dom, obj, act

[policy_definition]
p = sub, dom, obj, act

[role_definition]
g = _, _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub, r.dom) && keyMatch(r.dom, p.dom) && r.obj == p.obj && r.act == p.act

======================================================================
policies.csv

p,perm1,,data1,read
p,perm2,,data1,write
p,perm3,,data2,read
p,perm4,,data2,write

g,adminrole,perm1,*
g,adminrole,perm2,*
g,adminrole,perm3,*
g,adminrole,perm4,*
g,readerrole,perm1,*
g,readerrole,perm3,*

g,admingroup, adminrole, *
g,readergroup, readerrole, *

g,usergroup4, readergroup, domain4
g,usergroup4, perm4, domain4

g,alice,admingroup,domain1
g,alice,readergroup,domain2
g,alice,readergroup,domain4

======================================================================

result tests in https://casbin.org/editor/

alice, domain1, data1, read => true
alice, domain1, data1, write => true
alice, domain1, data2, read => true
alice, domain1, data2, write => true
bob, domain1, data2, write => false
alice, domain2, data1, read => true
alice, domain2, data1, write => false
alice, domain2, data2, read => true
alice, domain2, data2, write => false
alice, domain3, data1, read => false
alice, domain3, data1, write => false
alice, domain3, data2, read => false
alice, domain3, data2, write => false
alice, domain4, data1, write => false
alice, domain4, data1, read => true
alice, domain4, data2, read => true
alice, domain4, data2, write => true

======================================================================

end to end to in EnforcerTest.php

public function testRbacWithDomain()
{
    $e = new Enforcer(
        $this->modelAndPolicyPath . '/rbac_with_domain_pattern_model_and_keymatch_model.conf',
        $this->modelAndPolicyPath . '/rbac_with_domain_pattern_model_and_keymatch_policy.csv'
    );

    $e->addNamedDomainMatchingFunc('g', 'keyMatch', function (string $key1, string $key2) {
        return BuiltinOperations::keyMatch($key1, $key2);
    });

   // NOTE : without $e->buildRoleLinks(); everything is false;
   // WITH $e->buildRoleLinks(); everything is true
   $e->buildRoleLinks();

    $this->assertTrue($e->enforce('alice', 'domain1', 'data1', 'read'));
    $this->assertTrue($e->enforce('alice', 'domain1', 'data1', 'write'));
    $this->assertTrue($e->enforce('alice', 'domain1', 'data2', 'read'));
    $this->assertTrue($e->enforce('alice', 'domain1', 'data2', 'write'));

    $this->assertTrue($e->enforce('alice',  'domain2', 'data1', 'read'));
    $this->assertFalse($e->enforce('alice', 'domain2', 'data1', 'write'));
    $this->assertTrue($e->enforce('alice',  'domain2', 'data2', 'read'));
    $this->assertFalse($e->enforce('alice', 'domain2', 'data2', 'write'));

    $this->assertFalse($e->enforce('alice', 'domain3', 'data1', 'read'));
    $this->assertFalse($e->enforce('alice', 'domain3', 'data1', 'write'));
    $this->assertFalse($e->enforce('alice', 'domain3', 'data2', 'read'));
    $this->assertFalse($e->enforce('alice', 'domain3', 'data2', 'write'));

    $this->assertFalse($e->enforce('alice', 'domain4', 'data1', 'write'));
    $this->assertTrue($e->enforce('alice', 'domain4', 'data1', 'read'));
    $this->assertTrue($e->enforce('alice', 'domain4', 'data2', 'read'));
    $this->assertTrue($e->enforce('alice', 'domain4', 'data2', 'write'));
}

======================================================================

Results are all true, or all false. They doesn't match online editor

[woprrr]

+1 to me I'm fairy interested by That @leeqvip or @basakest it's a really nice catch to fix what's your opinion ?

[hsluoyz]

@leeqvip can we revoke this PR? #120

[leeqvip]

@Nalweakette
It has been fixed in v3.21.4, but this is not the final solution.
It should be pointed out that for blank domain names in the policies, use * instead.

p,perm1,*,data1,read
p,perm2,*,data1,write
p,perm3,*,data2,read
p,perm4,*,data2,write
...

[hsluoyz]

Closed as resolved