From a717711b11ee66ba93057e33d05daf7c920bd3a2 Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Thu, 5 Nov 2026 04:14:06 +0800 Subject: [PATCH] fix(iam): separate local policy evaluation from the plugin decision IsAllowed returns the authorization plugin's decision when a plugin is configured, and evaluates the local policies otherwise. Move the local evaluation into isAllowedLocally so that a caller can combine it with the plugin's decision. IsAllowed is unchanged. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Feng Ruohang --- cmd/iam.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/cmd/iam.go b/cmd/iam.go index 1566d81d0..3cd5fffc2 100644 --- a/cmd/iam.go +++ b/cmd/iam.go @@ -2549,7 +2549,12 @@ func (sys *IAMSys) IsAllowed(args policy.Args) bool { } return ok } + return sys.isAllowedLocally(args) +} +// isAllowedLocally evaluates args with the local policies only, as IsAllowed +// does when no authorization plugin is configured. +func (sys *IAMSys) isAllowedLocally(args policy.Args) bool { // Policies don't apply to the owner. if args.IsOwner { return true