Skip to content

[Bug] RBAC with domains: DeleteDomains does not remove the domain itself #1492

@oppiliappan

Description

@oppiliappan

Describe the bug
The RBAC with domains API is defined like so:

// DeleteDomains would delete all associated users and roles.
// It would delete all domains if parameter is not provided.
func (e *Enforcer) DeleteDomains(domains ...string) (bool, error) {
	if len(domains) == 0 {
		e.ClearPolicy()
		return true, nil
	}
	for _, domain := range domains {
		if _, err := e.DeleteAllUsersByDomain(domain); err != nil {
			return false, err
		}
	}
	return true, nil
}

This deletes all users by domain, but the domain itself is not deleted. This is verifiable by running DeleteDomains(domain) followed by GetAllDomains() and the original domain would still be present.

To Reproduce

  1. Add policies that mention a domain
  2. run DeleteDomains
  3. run GetAllDomains
  4. the deleted domain will still be present

Expected behavior
The domain deleted by DeleteDomains should not be in the output of GetAllDomains

Notes:

This issue can be closed if this is expected behavior. This is a minimal reproducer go project here. It can be run like so:

λ git clone https://tangled.sh/@oppi.li/casbin-repro

λ cd casbin-repro

λ go run .
=== casbin issue repro ===

1. adding policies and users...
2. domains before removal:
   [server-foo]
3. users with server:member role before removal:
   [server:owner user-b]
4. Calling DeleteDomains('server-foo')...
5. Domains after removal:
   [server-foo]
6. users with server:member role after removal:
   []

 bug: expected 0 domains, got 1: [server-foo]
   DeleteDomains() only removes users/roles, not the domain itself!

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions