fix: add rbac with resource roles and domain example (#329)

Author: selfuppen

examples/rbac_with_resource_roles_and_domain_model.conf

@@ -0,0 +1,15 @@
+[request_definition]
+r = sub, dom, obj, act
+
+[policy_definition]
+p = sub, dom, obj, act
+
+[role_definition]
+g = _, _, _
+g2 = _, _
+
+[policy_effect]
+e = some(where (p.eft == allow))
+
+[matchers]
+m = g(r.sub, p.sub, r.dom) && g2(r.obj, p.obj) && r.dom == p.dom && r.act == p.act

examples/rbac_with_resource_roles_and_domain_policy.csv

@@ -0,0 +1,10 @@
+p, data_group_admin, domain1, data_group, read
+p, data_group_admin, domain1, data_group, write
+p, data_group_admin, domain2, data_group2, read
+p, data_group_admin, domain2, data_group2, write
+
+g, alice, data_group_admin, domain1
+g, bob, data_group_admin, domain2
+
+g2, data1, data_group
+g2, data2, data_group2

src/test/java/org/casbin/jcasbin/main/ModelUnitTest.java

@@ -464,4 +464,27 @@ public void testGlobMatchModel() {
         testEnforce(e, "u4", "/foo", "read", false);
         testEnforce(e, "u4", "foo", "read", true);
     }
+
+    @Test
+    public void testRbacWithResourceRolesAndDomain() {
+        Enforcer e = new Enforcer("examples/rbac_with_resource_roles_and_domain_model.conf", "examples/rbac_with_resource_roles_and_domain_policy.csv");
+
+        testDomainEnforce(e, "alice", "domain1", "data1", "read", true);
+        testDomainEnforce(e, "alice", "domain1", "data1", "write", true);
+        testDomainEnforce(e, "alice", "domain1", "data2", "read", false);
+        testDomainEnforce(e, "alice", "domain1", "data2", "write", false);
+        testDomainEnforce(e, "alice", "domain2", "data1", "read", false);
+        testDomainEnforce(e, "alice", "domain2", "data1", "write", false);
+        testDomainEnforce(e, "alice", "domain2", "data2", "read", false);
+        testDomainEnforce(e, "alice", "domain2", "data2", "write", false);
+
+        testDomainEnforce(e, "bob", "domain1", "data2", "read", false);
+        testDomainEnforce(e, "bob", "domain1", "data2", "write", false);
+        testDomainEnforce(e, "bob", "domain1", "data1", "read", false);
+        testDomainEnforce(e, "bob", "domain1", "data1", "write", false);
+        testDomainEnforce(e, "bob", "domain2", "data1", "read", false);
+        testDomainEnforce(e, "bob", "domain2", "data1", "write", false);
+        testDomainEnforce(e, "bob", "domain2", "data2", "read", true);
+        testDomainEnforce(e, "bob", "domain2", "data2", "write", true);
+    }
 }