[Question] Why doesn't DeleteRole delete role completely from the policies?

[Marif226]

Want to prioritize this issue? Try:

---

What's your scenario? What do you want to achieve?
Your answer here

Your model:

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[role_definition]
g = _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act

Your policy:

p, role1, data1, read
p, role2, data1, write
p, role1, data2, read
p, role2, data2, write

g, role2, role1

Your request(s):

I want to completely delete role2, so that policy becomes:

p, role1, data1, read
p, role1, data2, read

The problem is, DeleteRole method in enforcer only deletes grouping policies, where role is inherited by others, so I need to call RemoveFilteredGroupingPolicy(0, role) manually. I think it is a good idea to include this to DeleteRole:

// DeleteRole deletes a role.
// Returns false if the role does not exist (aka not affected).
func (e *Enforcer) DeleteRole(role string) (bool, error) {
	var err error
	res1, err := e.RemoveFilteredGroupingPolicy(0, role)
	if err != nil {
		return res1, err
	}

	res2, err := e.RemoveFilteredGroupingPolicy(1, role)
	if err != nil {
		return res1, err
	}

	subIndex, err := e.GetFieldIndex("p", constant.SubjectIndex)
	if err != nil {
		return false, err
	}
	res3, err := e.RemoveFilteredPolicy(subIndex, role)
	return res1 || res2 || res3, err
}

[casbin-bot]

@tangyang9464 @JalinWang