Hi,
I'm currently using casbin/v2 v2.100.0 and facing an issue where GetImplicitUsersForPermission() does not return the expected users.
✅ Setup
Here is my policy data:
p, perm_edit_check, Check/63195, update
g, policy_edit_check, perm_edit_check
g2, admin/1, policy_edit_check
g3, user/1, admin/1
And here’s my model:
[request_definition]
r = sub, obj, act
[policy_definition]
p = sub, obj, act
p2 = sub
p3 = sub
p4 = sub
[role_definition]
g = _, _
g2 = _, _
g3 = _, _
g4 = _, _
g5 = _, _
[policy_effect]
e = some(where (p.eft == allow))
[matchers]
m = matcher(r.sub, r.obj, r.act)
💡 Goal
I want to retrieve all users who implicitly have the permission:
("Check/63195", "update")
So I'm using:
e.GetImplicitUsersForPermission("Check/63195", "update")
❌ Problem
I expect user/1 to be returned, since the permission follows this chain:
user/1 → g3 → admin/1 → g2 → policy_edit_check → g → perm_edit_check → p → (Check/63195, update)
But GetImplicitUsersForPermission() returns an empty list.
❓Question
Is GetImplicitUsersForPermission() expected to support multi-level inheritance across custom groupings like g2, g3, etc.?
Or does it only work with the default g group and direct inheritance?
If it doesn't support multi-level or non-g roles, is there a recommended way to retrieve users with a given permission across all custom roles (g2, g3, etc.)?
Thanks in advance!
