mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-23 08:01:29 +02:00
530b6aa5ec
The listing was narrowed by the provider record's enumerated models, which is the right bound only while one policy reaches a provider. Where two teams share a provider under different allowlists, every caller was offered the union: each model outside their own policy is a request the guardrail refuses a moment later, which is the empty-or-wrong picker this endpoint exists to avoid, moved one level up. A gateway record enumerating nothing was worse still — it offered the upstream's entire catalogue however narrow the policy. The synthesiser already knows which policies authorise a provider and which groups each binds, so the router can answer this at request time where it knows the caller's groups. Each route now carries one rule per authorising policy — its source groups and the models it permits — and the listing is bounded to the union across the rules matching the caller, intersected with what the provider serves. This is deliberately finer than the guardrail's own per-provider allowlist, which stays as it is: that list is a fail-closed backstop and cannot tell who is asking, so discovery is now narrower than the backstop rather than wider. A policy setting no allowlist lifts the restriction for the groups it binds, so nil and empty model lists stay distinct end to end — collapsing them would let a listing that should offer nothing fall open to everything.