mirror of
https://github.com/juanfont/headscale.git
synced 2026-07-18 00:45:06 +00:00
47f851c43b
v2 silently dropped policy.tests, so a policy that contradicted its own assertions still applied. Resolve src/dst via the existing Alias machinery, walk the compiled global filter rules (acls and grants both contribute), and run on every user-write boundary: SetPolicy, the file watcher, and `headscale policy check`. A failing test rejects the write before it mutates live state. Boot-time reload skips evaluation; an already-stored policy that references a deleted user shouldn't lock the server out. `headscale policy check` runs the engine only under --bypass-grpc-and-access-database-directly (where it has live users + nodes); without the flag a policy with tests is rejected with a pointer at the flag rather than silently skipped. Updates #1803 Co-authored-by: Janis Jansons <janhouse@gmail.com> |
||
|---|---|---|
| .. | ||
| dev | ||
| headscale | ||
| hi | ||
| mapresponses | ||