[Question] using eval() and no polices added, the admin won't be check

[BERZERKCOOLeST]

type User struct {
	Name string
	Age  int
}

var abacConf = `[request_definition]
r = sub, obj, act

[policy_definition]
p = sub_rule, obj, act

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = eval(p.sub_rule) && r.obj == p.obj && r.act == p.act || r.sub.Name == 'admin'`

func TestABAC(t *testing.T) {
	m, _ := model.NewModelFromString(abacConf)
	e, _ := casbin.NewEnforcer(m, false)
	// e.AddPolicy("r.sub.Age > 18", "res", "read") // if uncomment this line, we get result(ok is true, err is nil).
	ok, err := e.Enforce(&User{
		Name: "admin",
		Age:  17,
	}, "res", "read")
	t.Log(ok, err) // false please make sure rule exists in policy when using eval() in matcher
}

it returns the error now even that sub is a admin, how to deal with this?

[casbin-bot]

@tangyang9464 @JalinWang

[hsluoyz]

@BERZERKCOOLeST Casbin is based on policy rule matching. It means you need to have at least one "p" (policy rule) in matcher eval(p.sub_rule) && r.obj == p.obj && r.act == p.act || r.sub.Name == 'admin' to make the matcher evaluates for one request and one policy. If you have no policy, the matcher will never run at all, and of course returns false. For your case, I just recommend checking "admin" string in Golang.

See about how Casbin works: https://casbin.org/docs/understanding-casbin-detail/#visual-representation-of-the-acl-model-policy-and-request-matching