Constrained RBAC prevents one user from accumulating combinations of roles that defeat a control. For example, the person who requests a payment may be forbidden from holding the role that approves it.
Design a ConstrainedRoleDirectory class:
- The constructor receives equal-length arrays.
leftRoles[i] conflicts with rightRoles[i], and every conflict is symmetric. assign(user, role) assigns the role and returns true, unless the user holds a conflicting role. Assigning an already-held role is an idempotent success.revoke(user, role) removes a held role and returns true; it returns false when the user does not hold it.hasRole(user, role) reports current assignment state.
Conflicts apply only within one user's role set. A rejected assignment must leave all existing assignments unchanged. Role and user names are case-sensitive.
Example 1:
Input:
Output:
Explanation: Alice keeps auditor, while the conflicting trader assignment is rejected without changing her roles.
Example 2:
Input:
Output:
Explanation: Revoking requester removes the conflict that previously blocked approver.
Constraints
0 <= leftRoles.length == rightRoles.length <= 10^4- Each conflict pair contains two distinct role names.
- User and role names contain
1 to 100 printable ASCII characters. - Names are case-sensitive.
- At most
10^4 method calls are made.
Enforce RBAC Separation of Dutymedium