https://cerbos.dev logo
Join Slack
Powered by
Good day everyone, The fix that you provided to th...
# help
b
Good day everyone, The fix that you provided to the issue we raised above, rolled out in 0.49.0, is breaking our implementation due to a perceived change in evaluation. I was wondering if this is intended
I have the following resource policy
Copy code
{
  "policies": [
    {
      "apiVersion": "api.cerbos.dev/v1",
      "metadata": {
        "hash": "13999133081537641005",
        "storeIdentifer": "resource./api/v1/stitchit/networkassets/_id.vdefault",
        "storeIdentifier": "resource./api/v1/stitchit/networkassets/_id.vdefault",
        "sourceAttributes": {
          "attributes": {
            "driver": "postgres",
            "update_ts": "2025-12-11T14:47:02Z"
          }
        }
      },
      "resourcePolicy": {
        "resource": "/api/v1/stitchit/networkassets/_id",
        "version": "default",
        "rules": [
          {
            "actions": [
              "GET"
            ],
            "roles": [
              "inventory_sessions_read",
              "tenant-admin",
              "tenant-contributor",
              "tenant-user",
              "tenant-portal"
            ],
            "effect": "EFFECT_ALLOW",
            "name": "get.api.v1.stitchit.networkassets.id"
          },
          {
            "actions": [
              "DATA"
            ],
            "roles": [
              "data_access"
            ],
            "effect": "EFFECT_ALLOW",
            "name": "data.api.v1.stitchit.networkassets.id"
          }
        ]
      }
    }
  ]
}
The intend is that specific roles have access to GET, but at specific enforcement points, DATA access might be further restricted. User can have a role policy like the following, to further restrict DATA access based on criteria:
Copy code
{
  "policies": [
    {
      "apiVersion": "api.cerbos.dev/v1",
      "description": "Vancouver access 2",
      "metadata": {
        "hash": "10364997532867708535",
        "storeIdentifer": "role.ug_fd6cd5840631409abe3d347ea947ffca/bcaa9a67-5600-47a8-8bef-006a7105f974.data",
        "storeIdentifier": "role.ug_fd6cd5840631409abe3d347ea947ffca/bcaa9a67-5600-47a8-8bef-006a7105f974.data",
        "sourceAttributes": {
          "attributes": {
            "driver": "postgres",
            "update_ts": "2025-12-11T15:13:27Z"
          }
        }
      },
      "rolePolicy": {
        "role": "ug_fd6cd5840631409abe3d347ea947ffca",
        "parentRoles": [
          "data_access"
        ],
        "scope": "bcaa9a67-5600-47a8-8bef-006a7105f974.data",
        "rules": [
          {
            "resource": "*",
            "allowActions": [
              "*"
            ],
            "condition": {
              "match": {
                "all": {
                  "of": [
                    {
                      "expr": "request.resource.attr.city in [\"vancouver\"]"
                    }
                  ]
                }
              }
            }
          }
        ]
      }
    }
  ]
}
I send the following PlanResources request
Copy code
curl <http://localhost:3592/api/plan/resources?pretty> -d '{
  "requestId":  "test01", 
  "actions":  ["GET", "DATA"], 
  "resource":  {
    "policyVersion": "default", 
    "kind":  "/api/v1/stitchit/networkassets/_id",
    "scope" : "bcaa9a67-5600-47a8-8bef-006a7105f974.data"
  },
  "principal":  {
    "id":  "Ben",
    "roles":  ["tenant-admin","ug_fd6cd5840631409abe3d347ea947ffca"] 
  },
  "includeMeta": true
}'
In 0.46.0 I get the following response
Copy code
{
  "requestId": "test01",
  "actions": [
    "GET",
    "DATA"
  ],
  "resourceKind": "/api/v1/stitchit/networkassets/_id",
  "policyVersion": "default",
  "filter": {
    "kind": "KIND_CONDITIONAL",
    "condition": {
      "expression": {
        "operator": "eq",
        "operands": [
          {
            "variable": "request.resource.attr.city"
          },
          {
            "value": "vancouver"
          }
        ]
      }
    }
  },
  "meta": {
    "filterDebug": "(eq request.resource.attr.city \"vancouver\")",
    "matchedScopes": {
      "DATA": "",
      "GET": ""
    }
  },
  "cerbosCallId": "01KC72P6CP8FXVEV5W5SHP8S1Z"
}
But now in 0.49.0 I get a different response
Copy code
{
  "requestId": "test01",
  "actions": [
    "GET",
    "DATA"
  ],
  "resourceKind": "/api/v1/stitchit/networkassets/_id",
  "policyVersion": "default",
  "filter": {
    "kind": "KIND_ALWAYS_ALLOWED"
  },
  "meta": {
    "filterDebug": "(true)",
    "matchedScopes": {
      "DATA": "",
      "GET": ""
    }
  },
  "cerbosCallId": "01KC72SB6RCGM5AZBYKHPRBN58"
}
The condition is not restricting any longer?
s
This looks like a regression to me. I'll take a look on a fresh head in the morning. Thanks for raising (again).
🙏 2
b
Would be happy to test out the regression fix. Just let us know! Thanks Sam
b
Thank you Sam!
s
OK, I over-egged my previous "fix" and tripped over myself. This pending change should fix this case, and the prior case, and carries the benefit of also simplifying the double negation we experienced before: 
(not(and(not(eq), not(eq))))
is now back at 
(or(eq, eq))
where it rightfully belongs 👀
🙏 1
b
As soon as it hits master, we'll test!
s
Appreciate it!
whackamole
PR is merged, the image should land in the registry once the action completes.
🙌 1
Open in Slack
PreviousNext
Powered by