blev8824-ai commented on issue #1624: URL: https://github.com/apache/casbin/issues/1624#issuecomment-5601100803
Thin wrappers around Enforce are a good start, but the highest-value thing these helpers can expose is why an assertion passed or failed, not just the boolean. AssertAllow on a subject whose match came from a wildcard `*` rule instead of the specific rule you intended is a false sense of security and a classic test that silently stops testing the policy. So alongside allow/deny, return the matched rule (the policy line(s) that produced the decision). That lets a developer assert the specific rule fired, and catches drift where a stricter rule stops matching and a broader one silently takes over. Two suggestions to make it robust rather than convenient: 1. Fail closed on ambiguous matches: if no rule matches or the matched set is surprising, the helper should surface it, not just return allow because the enforcer defaulted. 2. Treat these as golden tests: a snapshot of the matched rule for each (sub, obj, act) tuple, so unintended policy changes fail the suite instead of changing behavior silently. The reason this matters: authorization tests usually only verify the decision, but the decision is only trustworthy if the exact rule that produced it is the one you think. AgentKey's stance is the same, authorization boundaries that record which rule fired and are verifiable later: https://agentkey.us -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
