fb137a8fe3
In compileACLWithAutogroupSelf, when a group contains a non-existent user, Group.Resolve() returns a partial IPSet (with IPs from valid users) alongside an error. The code was discarding the entire result via `continue`, losing valid IPs. The non-autogroup-self path (compileFilterRules) already handles this correctly by logging the error and using the IPSet if non-empty. Remove the `continue` on error for both source and destination resolution, matching the existing behavior in compileFilterRules. Also reorder the IsTagged check before User().ID() comparison in the same-user node filter to prevent nil dereference on tagged nodes that have no User set. Fixes #2990 |
||
|---|---|---|
| .. | ||
| matcher | ||
| policyutil | ||
| v2 | ||
| pm.go | ||
| policy.go | ||
| policy_autoapprove_test.go | ||
| policy_route_approval_test.go | ||
| policy_test.go | ||
| route_approval_test.go | ||