cli/policies: removing a policy subject adds the subject Instead

[jamesnicolas]

When I do hydra policies subject remove <policy> <subject>, it doesn't remove it, it adds it.

Steps to Reproduce:

Step 0, start from a fresh hydra instance, with migrations and hydra connect already done, and the connecting client has permissions to manage policies.

1. Create a new policy

$ hydra policies create --skip-tls-verify \
    --actions only,get,stronger \
    --allow \
    --description "eventually, everyone was given access" \
    --id unkillable \
    --resources the:whole:universe \
    --subjects justme

Created policy unkillable.

2. Try to remove justme

$ hydra policies subjects remove justme
Removed subjects from policy unkillable

3. Check if it was removed

$ hydra policies get unkillable

{
        "actions": [
                "stronger",
                "get",
                "only"
        ],
        "description": "eventually, everyone was given access",
        "effect": "allow",
        "id": "unkillable",
        "resources": [
                "the:whole:universe"
        ],
        "subjects": [
                "justme"
        ]
}

4. Try to remove the-solar-system (which didn't exist previously)

$ hydra policies subjects remove the-solar-system
Removed subjects from policy unkillable

5. See that non-existent the-solar-system subject is now existent.

$ hydra policies get unkillable
{
        "actions": [
                "stronger",
                "get",
                "only"
        ],
        "description": "eventually everyone was given access",
        "effect": "allow",
        "id": "unkillable",
        "resources": [
                "the:whole:universe"
        ],
        "subjects": [
                "justme",
                "the-solar-system"
        ]
}

Also, I noticed these two lines in hydra/cmd/cli/handler_policy.go:RemoveSubjectFromPolicy, as of tag: v0.10.0-alpha.18

186     p.Subjects = subjects
187     p.Subjects = append(p.Subjects, args[1:]...)

So maybe line 187 is causing this.

[aeneasr]

Indeed, nice catch! If you have the time, I would welcome a PR!

[jamesnicolas]

Cool, created #665, should fix it.

[aeneasr]

Merged