feat: add nil checks on RoleManager (#1371)

enforcer.go

@@ -200,6 +200,9 @@ func (e *Enforcer) SetLogger(logger log.Logger) {
 	for k := range e.rmMap {
 		e.rmMap[k].SetLogger(e.logger)
 	}
+	for k := range e.condRmMap {
+		e.condRmMap[k].SetLogger(e.logger)
+	}
 }
 
 func (e *Enforcer) initialize() {
@@ -273,12 +276,20 @@ func (e *Enforcer) SetWatcher(watcher persist.Watcher) error {
 
 // GetRoleManager gets the current role manager.
 func (e *Enforcer) GetRoleManager() rbac.RoleManager {
-	return e.rmMap["g"]
+	if e.rmMap != nil && e.rmMap["g"] != nil {
+		return e.rmMap["g"]
+	} else {
+		return nil
+	}
 }
 
 // GetNamedRoleManager gets the role manager for the named policy.
 func (e *Enforcer) GetNamedRoleManager(ptype string) rbac.RoleManager {
-	return e.rmMap[ptype]
+	if e.rmMap != nil && e.rmMap[ptype] != nil {
+		return e.rmMap[ptype]
+	} else {
+		return nil
+	}
 }
 
 // SetRoleManager sets the current role manager.
@@ -535,6 +546,9 @@ func (e *Enforcer) EnableAcceptJsonRequest(acceptJsonRequest bool) {
 
 // BuildRoleLinks manually rebuild the role inheritance relations.
 func (e *Enforcer) BuildRoleLinks() error {
+	if e.rmMap == nil {
+		return errors.New("rmMap is nil")
+	}
 	for _, rm := range e.rmMap {
 		err := rm.Clear()
 		if err != nil {

management_api.go

@@ -111,8 +111,15 @@ func (e *Enforcer) GetFilteredNamedPolicyWithMatcher(ptype string, matcher strin
 	functions := e.fm.GetFunctions()
 	if _, ok := e.model["g"]; ok {
 		for key, ast := range e.model["g"] {
-			rm := ast.RM
-			functions[key] = util.GenerateGFunction(rm)
+			// g must be a normal role definition (ast.RM != nil)
+			//   or a conditional role definition (ast.CondRM != nil)
+			// ast.RM and ast.CondRM shouldn't be nil at the same time
+			if ast.RM != nil {
+				functions[key] = util.GenerateGFunction(ast.RM)
+			}
+			if ast.CondRM != nil {
+				functions[key] = util.GenerateConditionalGFunction(ast.CondRM)
+			}
 		}
 	}
 

rbac_api.go

@@ -15,6 +15,7 @@
 package casbin
 
 import (
+	"fmt"
 	"strings"
 
 	"github.com/casbin/casbin/v2/constant"
@@ -24,13 +25,21 @@ import (
 
 // GetRolesForUser gets the roles that a user has.
 func (e *Enforcer) GetRolesForUser(name string, domain ...string) ([]string, error) {
-	res, err := e.model["g"]["g"].RM.GetRoles(name, domain...)
+	rm := e.GetRoleManager()
+	if rm == nil {
+		return nil, fmt.Errorf("role manager is not initialized")
+	}
+	res, err := rm.GetRoles(name, domain...)
 	return res, err
 }
 
 // GetUsersForRole gets the users that has a role.
 func (e *Enforcer) GetUsersForRole(name string, domain ...string) ([]string, error) {
-	res, err := e.model["g"]["g"].RM.GetUsers(name, domain...)
+	rm := e.GetRoleManager()
+	if rm == nil {
+		return nil, fmt.Errorf("role manager is not initialized")
+	}
+	res, err := rm.GetUsers(name, domain...)
 	return res, err
 }
 
@@ -298,6 +307,9 @@ func (e *Enforcer) GetImplicitPermissionsForUser(user string, domain ...string)
 func (e *Enforcer) GetNamedImplicitPermissionsForUser(ptype string, user string, domain ...string) ([][]string, error) {
 	permission := make([][]string, 0)
 	rm := e.GetRoleManager()
+	if rm == nil {
+		return nil, fmt.Errorf("role manager is not initialized")
+	}
 	domainIndex, _ := e.GetFieldIndex(ptype, constant.DomainIndex)
 	for _, rule := range e.model["p"][ptype].Policy {
 		if len(domain) == 0 {
@@ -483,6 +495,9 @@ func (e *Enforcer) GetImplicitUsersForResource(resource string) ([][]string, err
 	subjectIndex, _ := e.GetFieldIndex("p", "sub")
 	objectIndex, _ := e.GetFieldIndex("p", "obj")
 	rm := e.GetRoleManager()
+	if rm == nil {
+		return nil, fmt.Errorf("role manager is not initialized")
+	}
 
 	isRole := make(map[string]bool)
 	for _, role := range e.GetAllRoles() {
@@ -525,6 +540,9 @@ func (e *Enforcer) GetImplicitUsersForResourceByDomain(resource string, domain s
 	objectIndex, _ := e.GetFieldIndex("p", "obj")
 	domIndex, _ := e.GetFieldIndex("p", "dom")
 	rm := e.GetRoleManager()
+	if rm == nil {
+		return nil, fmt.Errorf("role manager is not initialized")
+	}
 
 	isRole := make(map[string]bool)
 

rbac_api_with_domains.go

@@ -14,17 +14,26 @@
 
 package casbin
 
-import "github.com/casbin/casbin/v2/constant"
+import (
+	"fmt"
+	"github.com/casbin/casbin/v2/constant"
+)
 
 // GetUsersForRoleInDomain gets the users that has a role inside a domain. Add by Gordon
 func (e *Enforcer) GetUsersForRoleInDomain(name string, domain string) []string {
-	res, _ := e.model["g"]["g"].RM.GetUsers(name, domain)
+	if e.GetRoleManager() == nil {
+		return nil
+	}
+	res, _ := e.GetRoleManager().GetUsers(name, domain)
 	return res
 }
 
 // GetRolesForUserInDomain gets the roles that a user has inside a domain.
 func (e *Enforcer) GetRolesForUserInDomain(name string, domain string) []string {
-	res, _ := e.model["g"]["g"].RM.GetRoles(name, domain)
+	if e.GetRoleManager() == nil {
+		return nil
+	}
+	res, _ := e.GetRoleManager().GetRoles(name, domain)
 	return res
 }
 
@@ -49,7 +58,10 @@ func (e *Enforcer) DeleteRoleForUserInDomain(user string, role string, domain st
 // DeleteRolesForUserInDomain deletes all roles for a user inside a domain.
 // Returns false if the user does not have any roles (aka not affected).
 func (e *Enforcer) DeleteRolesForUserInDomain(user string, domain string) (bool, error) {
-	roles, err := e.model["g"]["g"].RM.GetRoles(user, domain)
+	if e.GetRoleManager() == nil {
+		return false, fmt.Errorf("role manager is not initialized")
+	}
+	roles, err := e.GetRoleManager().GetRoles(user, domain)
 	if err != nil {
 		return false, err
 	}
@@ -142,7 +154,10 @@ func (e *Enforcer) DeleteDomains(domains ...string) (bool, error) {
 
 // GetAllDomains would get all domains.
 func (e *Enforcer) GetAllDomains() ([]string, error) {
-	return e.model["g"]["g"].RM.GetAllDomains()
+	if e.GetRoleManager() == nil {
+		return nil, fmt.Errorf("role manager is not initialized")
+	}
+	return e.GetRoleManager().GetAllDomains()
 }
 
 // GetAllRolesByDomain would get all roles associated with the domain.