Implements a new detector that identifies conflicts where a user has one effect (allow/deny) for an action while their role has the opposite effect for the same action.

Implementation

• New ModelDetector interface: Extends detector framework to support detectors requiring both Model and RoleManager access
• EffectConflictDetector: Detects explicit allow/deny conflicts between user-level and role-level policies
• Updated RunDetections(): Handles both Detector and ModelDetector interfaces via type assertion

Design

The detector is opt-in rather than default. In Casbin, explicit user policies intentionally override role policies, so effect conflicts are often legitimate (e.g., denying a user an action their role allows). Users wanting strict validation can enable it:

e.SetDetectors([]detector.Detector{
    detector.NewDefaultDetector(),
    detector.NewEffectConflictDetector(),
})
err := e.RunDetections()  // Returns error on conflict

Example Conflict

p, alice, data2, write, deny
p, admin, data2, write, allow
g, alice, admin

The detector flags this as: user 'alice' has 'deny' effect for (data2, write), but role 'admin' has 'allow' effect for the same action

Testing

• 11 test cases covering conflicts, non-conflicts, edge cases (multiple roles, default effects, nil validation)
• Integration test verifying enforcer usage
• No regressions in existing test suite

• Fixes [feature] add second default detector: EffectConflictDetector #1666

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.