Kristoffer Dalby 47f851c43b policy/v2: evaluate the tests block on user-initiated writes ...

v2 silently dropped policy.tests, so a policy that contradicted its
own assertions still applied. Resolve src/dst via the existing Alias
machinery, walk the compiled global filter rules (acls and grants
both contribute), and run on every user-write boundary: SetPolicy,
the file watcher, and `headscale policy check`. A failing test
rejects the write before it mutates live state.

Boot-time reload skips evaluation; an already-stored policy that
references a deleted user shouldn't lock the server out.

`headscale policy check` runs the engine only under
--bypass-grpc-and-access-database-directly (where it has live users
+ nodes); without the flag a policy with tests is rejected with a
pointer at the flag rather than silently skipped.

Updates #1803

Co-authored-by: Janis Jansons <janhouse@gmail.com>

2026-05-09 14:10:32 +00:00

..

dev

cmd/dev: validate --port fits the derived-port range

2026-04-17 16:31:49 +01:00

headscale

policy/v2: evaluate the tests block on user-initiated writes

2026-05-09 14:10:32 +00:00

hi

docs: expand cmd/hi and integration READMEs

2026-04-10 12:30:07 +01:00

mapresponses

all: fix golangci-lint issues (#3064)

2026-02-06 21:45:32 +01:00