RANGER-5797: Improve policy evaluation logic for _any access type and priority handling - #1234
Open
maheshbandal15 wants to merge 1 commit into
Open
maheshbandal15 wants to merge 1 commit into
maheshbandal15 wants to merge 1 commit into
Conversation
… priority handling
maheshbandal15
requested review from
kulkabhay,
mneethiraj,
pradeepagrawal8184 and
rameeshm
and removed request for
kulkabhay
September 16, 2026 23:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Fix 1 - Deny wins at equal priority
Replaced the _any-specific evaluation logic that used getPolicyPriority() >= oldPriority with a simpler rule: only a strictly higher-priority policy can override an existing deny.
Fix 2 - Break only when allow is actually stored
The _any loop now breaks only if the allow was written into accessTypeResults
Test changes
New test resource: agents-common/src/test/resources/policyengine/test_policyengine_hive_any_access_priority.json
Four Hive scenarios with deny/allow policy pairs at different priorities
_any requests for USE caseN_db by user hrt15
New test method: testPolicyEngine_hive_any_access_priority() in TestPolicyEngine.java
How was this patch tested?
mvn clean install
manual tests