From 1b74a9c6a0d858119af3869dcc64ffa8bb7ece72 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= <qu_xuan@icloud.com>
Date: Fri, 13 Oct 2023 07:41:12 +0800
Subject: [PATCH] fix(keystone): policy result (#18285)

---
 pkg/util/rbacutils/results.go | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/pkg/util/rbacutils/results.go b/pkg/util/rbacutils/results.go
index f40557609b..618a8a702a 100644
--- a/pkg/util/rbacutils/results.go
+++ b/pkg/util/rbacutils/results.go
@@ -51,14 +51,33 @@ func (matches TPolicyMatches) GetResult() SPolicyResult {
 	result := SPolicyResult{
 		Result: Deny,
 	}
+	isWideDomainTag, isWideProjectTag, isWideObjectTag := false, false, false
 	for _, match := range matches {
 		if match.Rule.Result == Allow {
 			result.Result = Allow
-			result.DomainTags = result.DomainTags.Append(match.DomainTags)
-			result.ProjectTags = result.ProjectTags.Append(match.ProjectTags)
-			result.ObjectTags = result.ObjectTags.Append(match.ObjectTags)
+			result.DomainTags = append(result.DomainTags, match.DomainTags)
+			result.ProjectTags = append(result.ProjectTags, match.ProjectTags)
+			result.ObjectTags = append(result.ObjectTags, match.ObjectTags)
+			if len(match.DomainTags) == 0 {
+				isWideDomainTag = true
+			}
+			if len(match.ProjectTags) == 0 {
+				isWideProjectTag = true
+			}
+			if len(match.ObjectTags) == 0 {
+				isWideObjectTag = true
+			}
 		}
 	}
+	if isWideDomainTag {
+		result.DomainTags = tagutils.TTagSetList{}
+	}
+	if isWideProjectTag {
+		result.ProjectTags = tagutils.TTagSetList{}
+	}
+	if isWideObjectTag {
+		result.ObjectTags = tagutils.TTagSetList{}
+	}
 	return result
 }