fix: pass domains in ConditionalRoleManager transitive link check

Author: hsluoyz

examples/rbac_with_domain_temporal_roles_transitive_policy.csv

@@ -0,0 +1,5 @@
+p, role_top, domainx, data_top, read
+p, role_solo, domainx, data_solo, read
+g, alice, role_mid, domainx, _, _
+g, role_mid, role_top, domainx, 0000-01-01 00:00:00, 0000-01-02 00:00:00
+g, alice, role_solo, domainx, 0000-01-01 00:00:00, 0000-01-02 00:00:00

model_test.go

@@ -769,6 +769,19 @@ func TestTemporalRolesModelWithDomain(t *testing.T) {
 	testDomainEnforce(t, e, "alice", "domain_not_exist", "data8", "write", false)
 }
 
+func TestTemporalRolesModelWithDomainTransitive(t *testing.T) {
+	e, _ := NewEnforcer("examples/rbac_with_domain_temporal_roles_model.conf", "examples/rbac_with_domain_temporal_roles_transitive_policy.csv")
+
+	e.AddNamedDomainLinkConditionFunc("g", "alice", "role_mid", "domainx", util.TimeMatchFunc)
+	e.AddNamedDomainLinkConditionFunc("g", "role_mid", "role_top", "domainx", util.TimeMatchFunc)
+	e.AddNamedDomainLinkConditionFunc("g", "alice", "role_solo", "domainx", util.TimeMatchFunc)
+
+	// single-hop expired link -> correctly denied (control)
+	testDomainEnforce(t, e, "alice", "domainx", "data_solo", "read", false)
+	// two-hop chain whose 2nd link is expired -> must be denied as well
+	testDomainEnforce(t, e, "alice", "domainx", "data_top", "read", false)
+}
+
 func TestReBACModel(t *testing.T) {
 	e, _ := NewEnforcer("examples/rebac_model.conf", "examples/rebac_policy.csv")
 

rbac/default-role-manager/role_manager.go

@@ -817,7 +817,7 @@ func (crm *ConditionalRoleManager) hasLinkHelper(targetName string, roles map[st
 		})
 	}
 
-	return crm.hasLinkHelper(targetName, nextRoles, level-1)
+	return crm.hasLinkHelper(targetName, nextRoles, level-1, domains...)
 }
 
 func (crm *ConditionalRoleManager) getNextRoles(currentRole, nextRole *Role, domains []string, nextRoles map[string]*Role) bool {