feat: fix RBAC role inheritance with domains by Copilot · Pull Request #29 · apache/casbin-ex

Copilot · 2025-10-29T17:31:43Z

Fix: #28

CLAassistant · 2025-10-29T17:31:50Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

Changed role inheritance storage from concatenated strings to tuples, enabling proper role hierarchy within domain contexts. Now supports multi-level role chains (e.g., admin → member → viewer) in domains. Co-authored-by: hsluoyz <3787410+hsluoyz@users.noreply.github.com>

Added test that reproduces the exact scenario from the issue: admin → member → viewer role chain with domain "org:abc" Co-authored-by: hsluoyz <3787410+hsluoyz@users.noreply.github.com>

hsluoyz · 2025-10-29T18:00:32Z

@sushilbansal plz review

sushilbansal

everything looks good to me

hsluoyz · 2025-10-30T09:50:47Z

@copilot for test cases, should strictly refer to Golang Casbin: https://github.com/casbin/casbin/blob/master/rbac_api_with_domains_test.go

Added test data file and test case matching rbac_api_with_domains_test.go from Golang Casbin, demonstrating role:global_admin inheriting from role:reader and role:writer in domain1. Co-authored-by: hsluoyz <3787410+hsluoyz@users.noreply.github.com>

Copilot · 2025-10-30T09:55:53Z

@copilot for test cases, should strictly refer to Golang Casbin: https://github.com/casbin/casbin/blob/master/rbac_api_with_domains_test.go

Added test matching Golang Casbin's rbac_api_with_domains_test.go. Created test data file rbac_with_hierarchy_with_domains_policy.csv and test case demonstrating role:global_admin inheriting from role:reader and role:writer in domain1, following the same structure and naming conventions. (commit 4712026)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

esm.ubuntu.com
- Triggering command: /usr/lib/apt/methods/https (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

hsluoyz · 2025-10-30T12:03:11Z

@copilot the test case should be exactly similar with the Golang Casbin's test case. No more and no less (no extra test case which is not included in Golang). Don't add something like "matching Golang Casbin tests", don't need to mention it.

Removed rbac_domain_role_inheritance_test.exs and associated test data as they are not present in Golang Casbin. Core fix in role_group.ex and enforcer.ex remains, validated by existing test suite. Co-authored-by: hsluoyz <3787410+hsluoyz@users.noreply.github.com>

Copilot · 2025-10-30T12:09:10Z

@copilot the test case should be exactly similar with the Golang Casbin's test case. No more and no less (no extra test case which is not included in Golang). Don't add something like "matching Golang...

Removed custom test file and test data. Core fix remains in role_group.ex and enforcer.ex, validated by existing test suite (394 tests pass). (commit cdbf033)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

esm.ubuntu.com
- Triggering command: /usr/lib/apt/methods/https (dns block)
https://api.github.com/repos/casbin/casbin/contents/examples
- Triggering command: curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

# [1.2.0](v1.1.0...v1.2.0) (2025-10-30) ### Features * fix RBAC role inheritance with domains ([#29](#29)) ([20c7b2b](20c7b2b))

github-actions · 2025-10-30T12:19:12Z

🎉 This PR is included in version 1.2.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Initial plan

6ff1663

Copilot AI assigned Copilot and hsluoyz Oct 29, 2025

hsluoyz marked this pull request as ready for review October 29, 2025 17:31

Copilot AI and others added 2 commits October 29, 2025 17:52

Add test case reproducing exact issue scenario

ac2e74d

Added test that reproduces the exact scenario from the issue: admin → member → viewer role chain with domain "org:abc" Co-authored-by: hsluoyz <3787410+hsluoyz@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix role-to-role inheritance for domains in multi-tenant scenarios~~ Fix role-to-role inheritance with domains Oct 29, 2025

Copilot AI requested a review from hsluoyz October 29, 2025 17:55

sushilbansal approved these changes Oct 29, 2025

View reviewed changes

hsluoyz changed the title ~~Fix role-to-role inheritance with domains~~ feat: fix RBAC role inheritance with domains Oct 30, 2025

hsluoyz merged commit 20c7b2b into master Oct 30, 2025
3 of 4 checks passed

github-actions Bot pushed a commit that referenced this pull request Oct 30, 2025

chore(release): 1.2.0 [skip ci]

fb16226

# [1.2.0](v1.1.0...v1.2.0) (2025-10-30) ### Features * fix RBAC role inheritance with domains ([#29](#29)) ([20c7b2b](20c7b2b))

github-actions Bot added the released label Oct 30, 2025

Navigation Menu

Uh oh!

feat: fix RBAC role inheritance with domains - #29

feat: fix RBAC role inheritance with domains#29
hsluoyz merged 5 commits into
masterfrom
copilot/fix-role-inheritance-domains

Copilot AI commented Oct 29, 2025 •

edited by hsluoyz

Loading

Uh oh!

CLAassistant commented Oct 29, 2025

Uh oh!

hsluoyz commented Oct 29, 2025

Uh oh!

sushilbansal left a comment

Uh oh!

hsluoyz commented Oct 30, 2025

Uh oh!

Copilot AI commented Oct 30, 2025 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

hsluoyz commented Oct 30, 2025

Uh oh!

Copilot AI commented Oct 30, 2025 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

github-actions Bot commented Oct 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Copilot AI commented Oct 29, 2025 • edited by hsluoyz Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CLAassistant commented Oct 29, 2025

Uh oh!

hsluoyz commented Oct 29, 2025

Uh oh!

sushilbansal left a comment

Choose a reason for hiding this comment

Uh oh!

hsluoyz commented Oct 30, 2025

Uh oh!

Copilot AI commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

hsluoyz commented Oct 30, 2025

Uh oh!

Copilot AI commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

github-actions Bot commented Oct 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Oct 29, 2025 •

edited by hsluoyz

Loading

Copilot AI commented Oct 30, 2025 •

edited

Loading

Copilot AI commented Oct 30, 2025 •

edited

Loading