See discussions here: #588 (comment)
GetImplicitPermissionsForUser() is a simplified version of batch enforce. It doesn't use the matcher as what enforce() does. Because we know, matcher is an expression actually. There's no way to know which permissions and user will make matcher hold.
Another way to solve it is to add a BatchEnforce() function to allow enforce multiple elements (maybe users, or permissions) at the same time. BatchEnforce() works like a filter to give you the final allowed permissions. Of course this requires to know an initial set of possible allowed permissions in advance. I don't know if this is possible for your scenario.
For example, currently we have:
e.Enforce("alice", "data1", "read") But now we will have:
e.BatchEnforce([][]string{{"alice", "data1", "read"}, {"bob", "data1", "read"}, {"cathy", "data1", "read"}})
e.BatchEnforce([][]string{{"alice", "data1", "read"}, {"alice", "data2", "read"}})
e.BatchEnforce([][]string{{"alice", "data1", "read"}, {"bob", "data2", "write"}})
See discussions here: #588 (comment)
GetImplicitPermissionsForUser()is a simplified version of batch enforce. It doesn't use the matcher as what enforce() does. Because we know, matcher is an expression actually. There's no way to know which permissions and user will make matcher hold.Another way to solve it is to add a
BatchEnforce()function to allow enforce multiple elements (maybe users, or permissions) at the same time.BatchEnforce()works like a filter to give you the final allowed permissions. Of course this requires to know an initial set of possible allowed permissions in advance. I don't know if this is possible for your scenario.For example, currently we have:
But now we will have: