aserto-dev / azm

61%

main: 68%

LAST BUILD ON BRANCH fix-inverse

branch: fix-inverse

CHANGE BRANCH

x

Reset

Sync Branches

• fix-inverse
• 0.21
• CVE-2025-22870
• add-safe-assert
• add_diff_validate
• allow-dots-in-permissions
• available-permissions
• azm
• azmcmd
• bugfix/checks-nil-default
• bugfix/expand-permission-term
• bugfix/invert-arrows
• bugfix/jobpool-panic
• bugfix/negation-type-subset
• bugfix/search-objects
• bugfix/validation
• bugfix/wildcard-only-relations
• cache-metadata
• cache-query
• check-cycles
• check-reason
• checks
• chore/cleanup-generics
• deps-250123
• error-messages
• errors
• expand
• fix-CVE-2024-21664
• fix-check-trace
• fix-inverted-negation-and-intersection
• fix-load-empty-manifest
• fix/diff-mutex
• fix/errlistener
• fix/parser-warnings
• fix/upd-deps
• fix_panic
• get-graph
• go-aserto
• go-aserto-upd
• go-directory
• identifier
• implement_graph
• implement_model_diffing
• import-status
• inversion-fix
• invert-unions
• load-v2-manifest
• main
• model-v2
• modelcache
• more-tests
• paging
• parser-errors
• relpool
• relpool-rid
• rm-mage
• type-casing
• upd-migrate
• update-deps
• version-agnostic-paging

Build # 10658163919

Build Type

Pull #54

github

Committed by ronenh

Commit Message

Fix GetGraph bug

This fixes a model-inversion bug. Given:
```yaml
folder:
  relations:
    owner: user
  permissions:
    is_owner: owner | parent->is_owner

doc:
  relations:
    parent: folder
    viewer: user | user:* | group#member
  permissions:
    can_view: viewer | parent->owner
```

The `can_view` premission isn't inverted correctly.
A `group#member` can have the `can_view` permission, but only
through the first term (`viewer`) because `parent-owner` can only
be a `user`.
The problem is that the inversion logic attempts to create the inversion
of `parent->owner` on `group`
(i.e. `group#doc^can_view#member: doc_viewer#member | doc_owner#doc_parent`)
But `group` has no `doc_owner` relation because `group#member` isn't assignable
to`folder#owner`.

Pull Request Pull Request #54: Fix GetGraph bug

Run Details

4 of 6 new or added lines in 2 files covered. (66.67%)

2808 of 4617 relevant lines covered (60.82%)

0.68 hits per line