Function TestCachedGFunctionAfterBuildRoleLinks

enforcer_cached_gfunction_test.go:156–201

TestCachedGFunctionAfterBuildRoleLinks tests the specific scenario mentioned in the bug report: adding grouping policies and calling BuildRoleLinks() manually should properly invalidate the cache.

(t *testing.T)

// TestCachedGFunctionAfterBuildRoleLinks tests the specific scenario mentioned in the bug report:
// adding grouping policies and calling BuildRoleLinks() manually should properly invalidate the cache.
func TestCachedGFunctionAfterBuildRoleLinks(t *testing.T) {
	e, err := NewEnforcer("examples/rbac_model.conf", "examples/rbac_policy.csv")
	if err != nil {
		t.Fatalf("Failed to create enforcer: %v", err)
	}

	// First, make some enforce calls to ensure the g() function closure is created and cached
	// This will cache "bob" NOT having data2_admin role in the g() function's sync.Map
	for i := 0; i < 3; i++ {
		ok, enforceErr := e.Enforce("bob", "data2", "read")
		if enforceErr != nil {
			t.Fatalf("Enforce failed on iteration %d: %v", i, enforceErr)
		}
		if ok {
			t.Errorf("bob should not have read access to data2 on iteration %d (before adding role)", i)
		}
	}

	// Disable autoBuildRoleLinks to manually control when role links are rebuilt
	e.EnableAutoBuildRoleLinks(false)

	// Manually add the grouping policy to the model (bypassing BuildIncrementalRoleLinks)
	// This simulates the scenario where policies are loaded from database
	err = e.model.AddPolicy("g", "g", []string{"bob", "data2_admin"})
	if err != nil {
		t.Fatalf("Failed to add grouping policy to model: %v", err)
	}

	// Manually build role links as mentioned in the issue
	// This is the key part - BuildRoleLinks() should invalidate the matcher map cache
	err = e.BuildRoleLinks()
	if err != nil {
		t.Fatalf("Failed to build role links: %v", err)
	}

	// Now bob should have read access to data2 through the data2_admin role
	// This is where the bug would manifest - if BuildRoleLinks() doesn't invalidate the cache,
	// the old g() function closure with "bob->data2_admin = false" cached will still be used
	ok, err := e.Enforce("bob", "data2", "read")
	if err != nil {
		t.Fatalf("Enforce failed after BuildRoleLinks: %v", err)
	}
	if !ok {
		t.Error("bob should have read access to data2 after BuildRoleLinks() - this indicates the g() function cache was not properly invalidated")
	}
}