[Bug] Adding policy programmatically is not applied

[derkan]

Want to prioritize this issue? Try:

---

Describe the bug

Adding policy programmatically is not applied.

To Reproduce

model.conf file:

[request_definition]
r = sub, obj, dom, act

[policy_definition]
p = sub, obj, dom, act, eft     #sub can't change position,must be first

[role_definition]
g = _, _, _

[policy_effect]
e = subjectPriority(p.eft) || deny

[matchers]
m = g(r.sub, p.sub, r.dom) && r.dom == p.dom && r.obj == p.obj && r.act == p.act

policy.csvfile:

p, usrrole, languages, domain1, read, allow
p, adminrole, languages, domain1, read, allow
p, adminrole, languages, domain1, update, allow

g, adminrole, usrrole, domain1
g, sysadm, adminrole, domain1

main.go file :

package main

import (
	"github.com/casbin/casbin/v2"
	"log"
)

func main() {
	e, err := casbin.NewEnforcer("model.conf", "policy.csv")
	if err != nil {
		log.Fatalf("error: model: %s", err)
	}
	ok, err := e.AddPolicy("sysadm", "languages", "domain1", "update", "deny")
	log.Printf("%v - custom policy: %v", err, ok)

	ok, err = e.Enforce("sysadm", "languages", "domain1", "update")
	log.Printf("%v - should be false: %v", err, ok)
}

Expected behavior
e.Enforce("sysadm", "languages", "domain1", "update") should return false

Screenshots

2022/07/25 15:45:47 <nil> - custom policy: true
2022/07/25 15:45:47 <nil> - should be false: true

[casbin-bot]

@tangyang9464 @JalinWang

[hsluoyz]

@JalinWang

/cc @tangyang9464

[tangyang9464]

@derkan At present, modifying policies requires manual reordering, @JalinWang we can fix this. But this feature has huge performance problems when modifying policies frequently. It is currently only suitable for scenarios where frequent changes to the role hierarchy are not required

[hsluoyz]

@derkan you are using the priority model and you appended a new rule to the last via the AddPolicy API. It won't take effect because there's already a previous rule got matched and returned true. You can Load Policy with Priority Explicitly: https://casbin.io/docs/priority-model#load-policy-with-priority-explicitly so you can manually append a new high-priority rule that will take effect immediately