tlyyxjz commented on issue #1624: URL: https://github.com/apache/casbin/issues/1624#issuecomment-5536412983
Hi @nodece, following up on this proposal. @angelinazzz1809 expressed interest back in June — no pressure on them, but since this thread has been quiet for three months, I went ahead and built a working reference implementation as an external module, per the "external package" note in the proposal: **https://github.com/tlyyxjz/authztest** ```go authztest.AssertAllow(t, e, "alice", "data1", "read") authztest.AssertDeny(t, e, "bob", "data1", "write") ``` The part this issue asks for — failure context — works like this: ``` authztest: expected ALLOW, got DENY for (alice, data2, read) no policy matched; closest candidates: p, admin, data2, write sub: ok ('alice' inherits 'admin' via g) obj: ok ('data2') act: 'read' does not match 'write' (not a wildcard) ``` Details: - Near-miss attribution, position by position, on both failed `AssertAllow` and failed `AssertDeny` (the latter shows which policy line allowed the request) - A subject matched through `g` role inheritance is credited, not falsely reported as "sub mismatch" — the blame lands on the position that actually failed - Domain-aware (`g = _, _, _`): role links are checked in the policy line's own domain, so multi-tenant failures are unambiguous - Wildcard-aware (`p.obj == "*"` idiom), arity mismatches surfaced, `Enforce` errors reported as errors instead of misattributed denies - Depends only on `casbin/v2`; Go 1.23+; MIT; CI on Go 1.23–1.25; docs at pkg.go.dev/github.com/tlyyxjz/authztest Two things I'd appreciate direction on: 1. Does this match the intended shape of the helpers, or would you prefer a smaller surface (bare `AssertAllow`/`AssertDeny` without the diagnosis)? 2. Should this stay a separate module (current state) or eventually be adopted under the casbin org? If @angelinazzz1809 has a draft in progress, happy to fold anything useful in or step back entirely — the goal is to get good failure context into the ecosystem, not to claim the issue. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
