currently, to check if a user has access to e.g. /hackathon/1/team/2 we need to run two casbin queries, one for the full domain and one for the /hackathon/1 domain (because an owner of the hackathon can read teams).
It would be nice if this logic were in casbin directly. Sadly, it does not officially support these kinds of hierarchical domains/RBAC. But it can be implemented with a custom function, see apache/casbin#872 (comment)
we should add a AddNamedDomainMatchingFunc to this extent that matches parent domain rules for subdomains, remove all the double rbac checks, and verify that all the rules and permissions are still ok
currently, to check if a user has access to e.g. /hackathon/1/team/2 we need to run two casbin queries, one for the full domain and one for the /hackathon/1 domain (because an owner of the hackathon can read teams).
It would be nice if this logic were in casbin directly. Sadly, it does not officially support these kinds of hierarchical domains/RBAC. But it can be implemented with a custom function, see apache/casbin#872 (comment)
we should add a
AddNamedDomainMatchingFuncto this extent that matches parent domain rules for subdomains, remove all the double rbac checks, and verify that all the rules and permissions are still ok