Skip to content

TPE Residual Policies Footgun #2538

Description

@tustvold

Category

User level API features/changes

Describe the feature you'd like to request

In 4.12.0 residual_policies now returns the non-trivial residual policies.

However, the naming might suggest that these are the residual policies sufficient to evaluate future requests against. This is subtly wrong, as it misses the fact that a trivial permit should be retained in the event of a non-trivial forbid residual, as otherwise the request may get wrongly rejected.

For example consider the case where you have a permit predicated on the principal, and a forbid predicated on the resource. If you perform TPE with a concrete principal, residual_policies will only return the forbid.

Describe alternatives you've considered

The fix for this might just be documentation, but I thought I would flag it as it caught me by surprise.

Additional context

#2500 (comment) contains some background on how we are using this functionality.

Is this something that you'd be interested in working on?

  • 👋 I may be able to implement this feature request
  • ⚠️ This feature might incur a breaking change

Metadata

Metadata

Assignees

No one assigned

    Labels

    documentationThe documentation needs to be improved or fixed.feature-requestThis issue requets a substantial new feature

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions