英文:
Is it possible to match p.obj with role by pattern in casbin?
问题
这是我正在使用的model.conf文件：
[request_definition]
r = sub, obj, act
[policy_definition]
p = sub, obj, act, eft
[role_definition]
g = _, _
g2 = _, _
[policy_effect]
e = some(where (p.eft == allow)) && !some(where (p.eft == deny))
[matchers]
m = g(r.sub, p.sub) && g2(r.obj, p.obj) && regexMatch(r.act, p.act)
这是相关的策略（用户可以阅读自己的帖子，管理员可以阅读所有帖子）：
p, admin, /posts/:id/attachments, GET, allow
p, alice, /posts/1/attachments, GET, allow
g, bob, admin
g2, /files/1.jpg, /posts/1/attachments
这些请求的结果应该是true：
alice, /files/1.jpg, GET
bob, /files/1.jpg, GET
目前，我可以通过添加规则g, /posts/1/attachments, /posts/:id/attachments使策略生效，但我想知道是否可以通过模式匹配来匹配这些角色名称，这样我就不必为每个帖子创建规则了。
（我找到的最接近的示例是AddNamedMatchingFunc("g","KeyMatch2",util.KeyMatch2)方法，我尝试在g2上使用它，但似乎它只匹配r.obj和角色上的模式。）
英文:
This is the model.conf I'm using:
[request_definition]
r = sub, obj, act
[policy_definition]
p = sub, obj, act, eft
[role_definition]
g = _, _
g2 = _, _
[policy_effect]
e = some(where (p.eft == allow)) && !some(where (p.eft == deny))
[matchers]
m = g(r.sub, p.sub) && g2(r.obj, p.obj) && regexMatch(r.act, p.act)
This is the relevant policy (The users can read their own posts, and admins can read all posts.):
p, admin, /posts/:id/attachments, GET, allow
p, alice, /posts/1/attachments, GET, allow
g, bob, admin
g2, /files/1.jpg, /posts/1/attachments
The result of these requests are expected to be true:
alice, /files/1.jpg, GET
bob, /files/1.jpg, GET
Currently, I can make the policy work by adding the rule g, /posts/1/attachments, /posts/:id/attachments, but I want to know whether it's possible to match these role names by pattern, so that I wouldn't have to create a rule for every post.
(The closest example I found is the AddNamedMatchingFunc("g","KeyMatch2",util.KeyMatch2) method, and I tried to use it on g2, but it seems that it only matches the pattern on r.obj and the roles.)
答案1
得分: 1
g的第二个参数不支持使用模式。但是这里有一个解决方法，可以使用多个g来达到相同的效果：
g，模式1，角色1
g，角色1，模式2
与以下代码等效：
g，模式1，模式2
英文:
The 2nd arg of g is not supported to be pattern. But here's a workaround to use multiple g to have the same effect:
g, pattern1, role1
g, role1, pattern2
is the same as:
g, pattern1, pattern2
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论