Role-Based Access Control assigns permissions to roles and roles to users. When roles inherit from other roles, an access check must include both the user's assigned role and every ancestor in its inheritance chain.
Design a RbacPermissionChecker class:
RbacPermissionChecker() creates a stateless permission checker.boolean hasPermission(int[] direct, int[] parent, int userRole, int permission) returns whether the user's role grants the requested permission directly or through inheritance.
There are n roles numbered from 0 to n - 1:
direct[i] is a bitmask of the permissions granted directly to role i.parent[i] is the role inherited by role i, or -1 when role i has no parent.- A role inherits every permission granted to its parent, its parent's parent, and so on.
permission contains exactly one set bit representing the requested permission.
Inheritance flows from parent to child. A parent does not inherit permissions from its children, and a role does not inherit from its siblings. Each call is independent.
Example 1:
Input:
Output:
Explanation: Role 2 directly grants bit 4, inherits bit 2 from role 1, and inherits bit 1 from role 0. Its effective mask is 4 | 2 | 1 = 7, which contains permission bit 1.
Example 2:
Input:
Output:
Explanation: Role 0 grants only bit 1 and has no parent. Bits granted to descendant roles 1 and 2 do not flow upward, so permission bit 2 is denied.
Constraints
1 <= direct.length == parent.length <= 10^50 <= direct[i] <= 2^31 - 1parent[i] is -1 or a valid role index.- Every parent chain ends at
-1 and contains no cycle. 0 <= userRole < direct.lengthpermission is a power of two in the range [1, 2^30].- At most
100 calls are made to hasPermission.
Check Effective RBAC Permissionsmedium