mirror of
https://github.com/juanfont/headscale.git
synced 2026-07-18 08:55:24 +00:00
b29ae25356
v2 silently dropped policy.tests, so a policy that contradicted its own assertions still applied. Resolve src/dst via the existing Alias machinery, walk the compiled global filter rules (acls and grants both contribute), and run on every user-write boundary: SetPolicy, the file watcher, and `headscale policy check`. A failing test rejects the write before it mutates live state. Boot-time reload skips evaluation; an already-stored policy that references a deleted user shouldn't lock the server out. `headscale policy check` is a thin frontend for the new CheckPolicy gRPC method. The server-side handler builds a fresh PolicyManager from the request bytes and the state's live users/nodes, runs SetPolicy on the sandbox so the tests block executes, and returns the result through gRPC status. No persistence, no policy_mode coupling. --bypass-grpc-and-access-database-directly opens the DB directly when the server is not running. cmd/headscale/cli/root.go no longer special-cases `policy check` in init() (the early return from PR #2580 broke --config registration and viper priming for --bypass). integration/cli_policy_test.go covers policy_mode={file,database} x fixture={acl-only, acl+passing-tests, acl+failing-tests} x bypass={false,true} = 12 rows. Updates #1803 Co-authored-by: Janis Jansons <janhouse@gmail.com> |
||
|---|---|---|
| .. | ||
| build.yml | ||
| check-generated.yml | ||
| check-tests.yaml | ||
| container-main.yml | ||
| docs-deploy.yml | ||
| docs-test.yml | ||
| gh-action-integration-generator.go | ||
| gh-actions-updater.yaml | ||
| integration-test-template.yml | ||
| lint.yml | ||
| needs-more-info-comment.yml | ||
| needs-more-info-timer.yml | ||
| nix-module-test.yml | ||
| release.yml | ||
| stale.yml | ||
| support-request.yml | ||
| test-integration.yaml | ||
| test.yml | ||
| update-flake.yml | ||