-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Closed
Description
Describe the bug
The RBAC with domains API is defined like so:
// DeleteDomains would delete all associated users and roles.
// It would delete all domains if parameter is not provided.
func (e *Enforcer) DeleteDomains(domains ...string) (bool, error) {
if len(domains) == 0 {
e.ClearPolicy()
return true, nil
}
for _, domain := range domains {
if _, err := e.DeleteAllUsersByDomain(domain); err != nil {
return false, err
}
}
return true, nil
}This deletes all users by domain, but the domain itself is not deleted. This is verifiable by running DeleteDomains(domain) followed by GetAllDomains() and the original domain would still be present.
To Reproduce
- Add policies that mention a domain
- run
DeleteDomains - run
GetAllDomains - the deleted domain will still be present
Expected behavior
The domain deleted by DeleteDomains should not be in the output of GetAllDomains
Notes:
This issue can be closed if this is expected behavior. This is a minimal reproducer go project here. It can be run like so:
λ git clone https://tangled.sh/@oppi.li/casbin-repro
λ cd casbin-repro
λ go run .
=== casbin issue repro ===
1. adding policies and users...
2. domains before removal:
[server-foo]
3. users with server:member role before removal:
[server:owner user-b]
4. Calling DeleteDomains('server-foo')...
5. Domains after removal:
[server-foo]
6. users with server:member role after removal:
[]
bug: expected 0 domains, got 1: [server-foo]
DeleteDomains() only removes users/roles, not the domain itself!
Reactions are currently unavailable