Category
User level API features/changes
Describe the feature you'd like to request
In 4.12.0 residual_policies now returns the non-trivial residual policies.
However, the naming might suggest that these are the residual policies sufficient to evaluate future requests against. This is subtly wrong, as it misses the fact that a trivial permit should be retained in the event of a non-trivial forbid residual, as otherwise the request may get wrongly rejected.
For example consider the case where you have a permit predicated on the principal, and a forbid predicated on the resource. If you perform TPE with a concrete principal, residual_policies will only return the forbid.
Describe alternatives you've considered
The fix for this might just be documentation, but I thought I would flag it as it caught me by surprise.
Additional context
#2500 (comment) contains some background on how we are using this functionality.
Is this something that you'd be interested in working on?
Category
User level API features/changes
Describe the feature you'd like to request
In 4.12.0 residual_policies now returns the non-trivial residual policies.
However, the naming might suggest that these are the residual policies sufficient to evaluate future requests against. This is subtly wrong, as it misses the fact that a trivial permit should be retained in the event of a non-trivial forbid residual, as otherwise the request may get wrongly rejected.
For example consider the case where you have a permit predicated on the principal, and a forbid predicated on the resource. If you perform TPE with a concrete principal, residual_policies will only return the forbid.
Describe alternatives you've considered
The fix for this might just be documentation, but I thought I would flag it as it caught me by surprise.
Additional context
#2500 (comment) contains some background on how we are using this functionality.
Is this something that you'd be interested in working on?