Skip to content

feat: add DefaultDetector which supports RBAC role loop detection#483

Merged
hsluoyz merged 3 commits intomasterfrom
copilot/add-default-detector-implementation
Dec 28, 2025
Merged

feat: add DefaultDetector which supports RBAC role loop detection#483
hsluoyz merged 3 commits intomasterfrom
copilot/add-default-detector-implementation

Conversation

Copy link
Contributor

Copilot AI commented Dec 28, 2025

Implements DefaultDetector to detect role inheritance cycles (A→B→C→A) in RBAC graphs using depth-first search.

Implementation

DefaultDetector.java

  • Iterative DFS (stack-based) to avoid stack overflow on deep graphs (10K+ roles)
  • Detects cycles via visited/recursion-stack sets; returns "Cycle detected: A -> B -> C -> A" or null
  • Accesses DefaultRoleManager.allRoles via reflection to build local adjacency list
  • O(V+E) time complexity with thread-safe local data structures

DefaultDetectorTest.java

  • 14 tests covering: simple cycles, self-loops, disconnected components, large graphs (10K roles)

Usage

RoleManager rm = new DefaultRoleManager(10);
rm.addLink("A", "B");
rm.addLink("B", "C");
rm.addLink("C", "A");

Detector detector = new DefaultDetector();
String result = detector.check(rm);
// Returns: "Cycle detected: A -> B -> C -> A"
Original prompt

This section details on the original issue you should resolve

<issue_title>feat(detector): implement DefaultDetector with RBAC cycle detection</issue_title>
<issue_description>Background:
Provide a default implementation for Detector to detect role inheritance cycles (A→B→C→A).

Tasks:

  1. Add DefaultDetector.java under the org.casbin.jcasbin.detector package, implementing the Detector interface.

  2. Use depth-first search (DFS) to traverse the passed-in RoleManager instance and detect whether any cycle exists.

  3. Detailed steps:

    • Obtain the adjacency relationships of the current graph from APIs provided by RoleManager (such as getRoles(String name) and getUsers(String name)). Since DefaultRoleManager’s addLink method simply establishes parent-child relationships between Role objects
      github.com
      , you can build a directed graph by recursively traversing roles’ getAllRoles().
    • Maintain visited and stack sets; discovering a back edge is considered a cycle; once the first cycle is found, generate and return a description in the form "Cycle detected: A -> B -> C -> A".
    • If traversal finishes without finding any cycle, return null.
  4. Do not modify the source code of RoleManager or Role, and do not change existing API signatures. All logic should be self-contained within DefaultDetector.

  5. Pay attention to performance: even on large RBAC graphs (e.g., 10000 roles), DFS should run in linear time; avoid repeated traversal.

Constraints:

  • The code should support multi-threaded access, but you may create data structures locally inside the method to avoid sharing references with the internal state of RoleManager.
  • During implementation, do not catch and swallow exceptions; if an error occurs, throw a runtime exception directly.
    </issue_description>

Comments on the Issue (you are @copilot in this section)


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Copilot AI self-assigned this Dec 28, 2025
@CLAassistant
Copy link

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@hsluoyz hsluoyz marked this pull request as ready for review December 28, 2025 11:03
Copilot AI and others added 2 commits December 28, 2025 11:03
Co-authored-by: hsluoyz <3787410+hsluoyz@users.noreply.github.com>
Co-authored-by: hsluoyz <3787410+hsluoyz@users.noreply.github.com>
Copilot AI changed the title [WIP] Add DefaultDetector implementation for RBAC cycle detection feat(detector): implement DefaultDetector with iterative DFS cycle detection Dec 28, 2025
Copilot AI requested a review from hsluoyz December 28, 2025 11:08
@codecov-commenter
Copy link

Codecov Report

❌ Patch coverage is 90.76923% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.80%. Comparing base (d79d4db) to head (aca0f3d).
⚠️ Report is 2 commits behind head on master.

Files with missing lines Patch % Lines
...a/org/casbin/jcasbin/detector/DefaultDetector.java 90.76% 4 Missing and 2 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master     #483      +/-   ##
==========================================
+ Coverage   67.31%   67.80%   +0.49%     
==========================================
  Files          60       61       +1     
  Lines        3004     3069      +65     
  Branches      559      569      +10     
==========================================
+ Hits         2022     2081      +59     
- Misses        802      806       +4     
- Partials      180      182       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@hsluoyz hsluoyz changed the title feat(detector): implement DefaultDetector with iterative DFS cycle detection feat: add DefaultDetector which supports RBAC role loop detection Dec 28, 2025
@hsluoyz hsluoyz merged commit 8ccf1b8 into master Dec 28, 2025
2 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat(detector): implement DefaultDetector with RBAC cycle detection

4 participants