From 39a42e9d01efd64dacaf31038e7630b48461a21b Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Sat, 31 Oct 2026 14:19:46 +0000 Subject: [PATCH] policy/v2: refuse autogroup:member as a test source As SaaS: unknown user or host. A policy that passed here failed on SaaS. --- hscontrol/policy/v2/test.go | 2 +- hscontrol/policy/v2/test_test.go | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/hscontrol/policy/v2/test.go b/hscontrol/policy/v2/test.go index 2cb32a82f..dde9b208a 100644 --- a/hscontrol/policy/v2/test.go +++ b/hscontrol/policy/v2/test.go @@ -447,7 +447,7 @@ func resolveTestSource(src string, pol *Policy, users []types.User, nodes views. case Asterix: unknown = true case *AutoGroup: - unknown = a.Is(AutoGroupTagged) + unknown = a.Is(AutoGroupTagged) || a.Is(AutoGroupMember) } if unknown { diff --git a/hscontrol/policy/v2/test_test.go b/hscontrol/policy/v2/test_test.go index 583350a4e..4dade080d 100644 --- a/hscontrol/policy/v2/test_test.go +++ b/hscontrol/policy/v2/test_test.go @@ -143,7 +143,8 @@ func TestRunTests(t *testing.T) { "tests": [ { "src": "*", "deny": ["tag:server:80"] }, { "src": "100.64.0.0/30", "deny": ["tag:server:80"] }, - { "src": "autogroup:tagged", "deny": ["tag:server:80"] } + { "src": "autogroup:tagged", "deny": ["tag:server:80"] }, + { "src": "autogroup:member", "deny": ["tag:server:80"] } ] }`, wantPass: false, @@ -151,6 +152,7 @@ func TestRunTests(t *testing.T) { `unknown user or host: "*"`, `unknown user or host: "100.64.0.0/30"`, `unknown user or host: "autogroup:tagged"`, + `unknown user or host: "autogroup:member"`, }, wantNoErrIs: errPolicyTestsFailed, },