hsluoyz commented on issue #10: URL: https://github.com/apache/casbin-lua-apisix-authz/issues/10#issuecomment-5207283850
@shanvesh Thanks for the report — this was a real bug, not just a limitation. The plugin held a single Casbin Enforcer in a file-local variable, so whichever route received the first request created it and every route after that silently reused it, ignoring its own `model_path` / `policy_path`. Which policy ended up in effect depended on request ordering, so a restart could change it. Fixed in [[734ee43](https://github.com/apache/casbin-lua-apisix-authz/commit/734ee43a17c5ef7b12b771748fafda4dc340141d)](https://github.com/apache/casbin-lua-apisix-authz/commit/734ee43a17c5ef7b12b771748fafda4dc340141d): the plugin now keeps one Enforcer per `model_path` + `policy_path` pair, so each route is enforced against the policy it was configured with. Routes sharing the same paths still share an Enforcer, so runtime policy changes stay visible across them. The policy management APIs now pick their target Enforcer from the `model_path` and `policy_path` headers — the README has an example. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
