[Question] How to get data with rbac with domains models

**Want to prioritize this issue? Try:**

[](https://issuehunt.io/r/casbin/casbin)

------

**What's your scenario? What do you want to achieve?**

I just want to make sure of my implementation. Because I'm new with casbin. this my scenario

- Domains
- order management system (OMS)
- marketing

- Roles
- OMS
- manager
- staff
- sales
- marketing
- manager
- admin

- Permission (subject, domain, resource, action)
- OMS
- order list (write, read)
- order approve (write, read)
- order return (write, read)
- marketing
- banner list (write, read)
- promo list (write, read)
- promo approve (write, read)

- Users
- Alice as a manager in the sales order domain
- Bob as staff in sales order domain
- Martin as sales in sales order domain
- Tasya as a manager in the marketing domain

- Expectation
- As staff in the OMS domain, Bob can write and read order return
- As sales in the OMS domain, Martin write and read order list
- As a manager in the OMS domain, Alice can write and read order list, order return, order approve
- As a manager in the Marketing domain, Tasya can write and read banner list, promo list, promo approve

**Your model:**

```ini
[request_definition]
r = sub, dom, obj, act

[policy_definition]
p = sub, dom, obj, act

[role_definition]
g = _, _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub, r.dom) && r.dom == p.dom && r.obj == p.obj && r.act == p.act
```

**Your policy:**

```
p, permission:sales-order-list, oms, sales-order-list, read
p, permission:sales-order-list, oms, sales-order-list, write
p, permission:sales-order-return, oms, sales-order-return, read
p, permission:sales-order-return, oms, sales-order-return, write
p, permission:sales-order-approve, oms, sales-order-approve, read
p, permission:sales-order-approve, oms, sales-order-approve, write
p, permission:promo-list, marketing, promo-list, read
p, permission:promo-list, marketing, promo-list, write
p, permission:promo-approve, marketing, promo-approve, read
p, permission:promo-approve, marketing, promo-approve, write
p, permission:banner-list, marketing, banner-list, read
p, permission:banner-list, marketing, banner-list, write
g, role:sales, permission:sales-order-list, oms
g, role:staff, permission:sales-order-return, oms
g, role:manager, role:sales, oms
g, role:manager, role:staff, oms
g, role:manager, permission:sales-order-approve, oms
g, role:manager, permission:promo-list, marketing
g, role:manager, permission:promo-approve, marketing
g, role:manager, permission:banner-list, marketing
g, alice, role:manager, oms
g, bob, role:staff, oms
g, martin, role:sales, oms
g, tasya, role:manager, marketing
```

**Your request(s):**

This is my code to add all policy

```go
// Add permission
// OMS
e.AddPolicy("permission:sales-order-list", "oms", "sales-order-list", "read")
e.AddPolicy("permission:sales-order-list", "oms", "sales-order-list", "write")
e.AddPolicy("permission:sales-order-return", "oms", "sales-order-return", "read")
e.AddPolicy("permission:sales-order-return", "oms", "sales-order-return", "write")
e.AddPolicy("permission:sales-order-approve", "oms", "sales-order-approve", "read")
e.AddPolicy("permission:sales-order-approve", "oms", "sales-order-approve", "write")

// Marketing
e.AddPolicy("permission:promo-list", "marketing", "promo-list", "read")
e.AddPolicy("permission:promo-list", "marketing", "promo-list", "write")
e.AddPolicy("permission:promo-approve", "marketing", "promo-approve", "read")
e.AddPolicy("permission:promo-approve", "marketing", "promo-approve", "write")
e.AddPolicy("permission:banner-list", "marketing", "banner-list", "read")
e.AddPolicy("permission:banner-list", "marketing", "banner-list", "write")

// Roles
// OMS
e.AddGroupingPolicy("role:sales", "permission:sales-order-list", "oms")
e.AddGroupingPolicy("role:staff", "permission:sales-order-return", "oms")
e.AddGroupingPolicy("role:manager", "role:sales", "oms")
e.AddGroupingPolicy("role:manager", "role:staff", "oms")
e.AddGroupingPolicy("role:manager", "permission:sales-order-approve", "oms")

// Marketing
e.AddGroupingPolicy("role:manager", "permission:promo-list", "marketing")
e.AddGroupingPolicy("role:manager", "permission:promo-approve", "marketing")
e.AddGroupingPolicy("role:manager", "permission:banner-list", "marketing")

// User
e.AddRoleForUserInDomain("alice", "role:manager", "oms")
e.AddRoleForUserInDomain("bob", "role:staff", "oms")
e.AddRoleForUserInDomain("martin", "role:sales", "oms")
e.AddRoleForUserInDomain("tasya", "role:manager", "marketing")

e.SavePolicy()
```

and enforcing works well for this scenario, my question is how to get data

- Get all permission
- I expect
- [permission:sales-order-list oms sales-order-list read]
- [permission:banner-list marketing banner-list write]
- ... (all permission)

- Get all permission in the domain
- I expect
- [permission:sales-order-list oms sales-order-list read]
- [permission:sales-order-list oms sales-order-list write]
- ... (permission with a specific domain)

- Get all permission for users in the domain
- I expect Alice have
- [permission:sales-order-approve oms sales-order-approve read]
- [permission:sales-order-list oms sales-order-list write]
- I expect bob have
- [permission:sales-order-return oms sales-order-return read]
- [permission:sales-order-return oms sales-order-return write]
- Get all roles
- I expect
- [role:sales oms]
- [role:staff oms]
- [role:manager oms]
- [role:manager marketing]
- Get all roles in the domain
- I expect in OMS
- role:sales
- role:staff
- role:manager
- I expect in Marketing [role:manager]
- Get all roles for user in domain
- I expect alice have [role:manager]
- I expect bob have [role:staff]
- Get all users
- I expect [alice bob martn tasya]
- Get all users in domain
- I expect in OMS [alice bob martn]
- I expect in Marketing [tasya]

I try to do like this,

```go
// Get for application
// GET /rbac/permissions
policies:= e.GetPolicy()
fmt.Printf("\n\nlist of all policies: %s \n\n", policies)

// GET /rbac/permissions/domain/:domain how to get permission
domains := []string{"oms", "marketing"}
for _, domain := range domains {
permissions := e.GetFilteredPolicy(1, domain)
fmt.Printf("list of permissions in domain %s : %s \n\n", domain, permissions)
}

// GET /rbac/roles - this not expected
var roles [][]string
var checkdup = make(map[string]string)
rawroles := e.GetGroupingPolicy()
for _, raw := range rawroles {
role := raw[0]
domain := raw[2]
if strings.Contains(role, "role:") {
if val, ok := checkdup[role]; ok {
if val == domain {
continue
}
}
roles = append(roles, []string{role, domain})
checkdup[role] = domain
}
}
fmt.Printf("list of roles: %s \n\n", roles)

// GET /rbac/roles/domain/:domain
var roles [][]string
var checkdup = make(map[string]string)
rawroles := e.GetFilteredGroupingPolicy(2, "marketing")
for _, raw := range rawroles {
role := raw[0]
domain := raw[2]
if strings.Contains(role, "role:") {
if val, ok := checkdup[role]; ok {
if val == domain {
continue
}
}
roles = append(roles, []string{role, domain})
checkdup[role] = domain
}
}
fmt.Printf("list of roles by domain: %s \n\n", roles)

//Get /rbac/users/domain/:domain
var users []string
rawusers := e.GetAllUsersByDomain("marketing")
for _, raw := range rawusers {
if strings.Contains(raw, "role:") || strings.Contains(raw, "permission:") {
continue
}
users = append(users, raw)
}
fmt.Printf("list of users: %s \n\n", users)
```

but I think this is not right, do you have some idea how to get this data? how to paginate data? I assume the record will be in thousands.
btw, I'm using `role:` and `permission:` for filtering the policy, I need to know the difference.
there's any way to filter policy without hardcoded text?

playground https://go.dev/play/p/rGckPHtCdxu

thanks