search

biscuit-auth / biscuit-rust

Rust implementation of the Biscuit authorization token
https://www.biscuitsec.org
206 stars 28 forks source link

Non-deterministic output of `Authorizer.dump_code()` #193

Open divarvel opened 10 months ago

divarvel commented 10 months ago

Facts are stored as a HashMap internally, so their order is not defined.

The Display impl for Authorizer does sort everything, so it has a stable output. It also adds more information in comments (namely the facts and rules origins, which is extremely important).

I guess we could just call .to_string() in dump_code() to keep backwards compatibility. However, the Display implementation for Authorizer only uses facts and rules from the Datalog::World value, so it may discard facts and rules added to the authorizer before calling authorize. I guess that overlaps with #192

divarvel commented 10 months ago

I am working on a fix for missing facts and rules in Authorizer.to_string()