[codex] Preserve the first action callback error#85
Conversation
🎉 All green!🧪 All tests passed 🎯 Code Coverage (details) 🔗 Commit SHA: d91dbce | Docs | Datadog PR Page | Give us feedback! |
|
@codex review |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
| dd_wls_Action_create(&builder, dd_wls_ActionId_INJECT_DENY, first_description, values), | ||
| dd_wls_Action_create(&builder, dd_wls_ActionId_INJECT_ALLOW, second_description, values), |
There was a problem hiding this comment.
This fixture constructs a policy containing both INJECT_DENY and INJECT_ALLOW, which appears contradictory and makes the scenario difficult to understand.
|
|
||
| static inline plcs_errors perform_actions(plcs_evaluation_result eval_res, dd_ns(Action_vec_t) actions_vec) { | ||
| plcs_errors res = PLCS_ESUCCESS; | ||
| plcs_errors first_error = PLCS_ESUCCESS; |
There was a problem hiding this comment.
we switch from retaining the last callback result to retaining only the first error. maybe it's best if switch to some errno like behavior where we register all the failures and consumers can use an get_actions_errno() to consume an array or a linked list of 'action, result' key value pairs?
typedef struct {
plcs_actions action;
plcs_errors result;
size_t action_index;
} plcs_action_result;
size_t plcs_get_action_results(
plcs_action_result *results,
size_t capacity
);
because anyway i think these are being ignored now.
I talked to @annacai21 about doing something similar for the evaluation...
…eservation # Conflicts: # c/src/test/CMakeLists.txt
2 participants
What
Keeps the first failing action callback result while continuing to invoke later actions. Adds a self-contained C regression with a failing action followed by a successful action.
Why
perform_actions overwrote its accumulated result after every callback, so a later success could mask an earlier enforcement failure.
Impact
Policy evaluation now reports the original action failure instead of incorrectly returning success.
Validation
Part of #82