Hey folks I am trying to create a RBAC model where users get mapped to a role, a role can consist of multiple rules and a rules contains multiple permissions and in the end I want to query for user -> resource , so as you can see there are multiple hops involved.
The model I wrote looks as follows -
// Kind refers to org / tier name
[request_definition]
r = kind, sub, tag, act
// rule is a specific rule identifier
[policy_definition]
p = kind, rule, tag, act
[role_definition]
g = _, _, _ # entity, entity-role mapping
g2 = _, _ # role-rule mapping
// check if there is any matcher that provides allow
[policy_effect]
e = some(where (p.eft == allow))
// find me roles that match this user, and then check if there is a rule that matches this // role which allows for this obj/tag and action
[matchers]
m = g(r.sub, role) && g2(role, p.rule) && r.tag == p.tag && r.act == p.act && r.kind == p.kind)
But the above matcher does not seem to work. How do I specify find a role that matches the users and see if the role has a rule in it for which the permission is provided.
The role variable essentially is a free variable which Casbin needs to figure out?
Is this not possible ?
