Skip to content

Commit

Permalink
Do not allow the space policy to be pruned
Browse files Browse the repository at this point in the history
It is necessary for certain recalculations we do
  • Loading branch information
jaym committed Nov 21, 2024
1 parent bd96245 commit 8308f3b
Showing 1 changed file with 7 additions and 1 deletion.
8 changes: 7 additions & 1 deletion policy/resolved_policy_builder.go
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"context"
"fmt"
"slices"
"strings"
"time"

"github.com/pkg/errors"
Expand Down Expand Up @@ -272,7 +273,12 @@ func (n *rpBuilderPolicyNode) getId() string {
func (n *rpBuilderPolicyNode) isPrunable() bool {
// We do not allow pruning the root node. This covers cases where the policy matches the asset filters,
// but we have no active checks or queries. This will end up reporting a U for the score
return !n.isRoot

// The space policy is not prunable because its score is the one that is actually used to determine an
// asset score. This is because the asset score is dropped and recomputed to become a combination of
// the security and vulnerability scores
isSpace := strings.HasPrefix(n.policy.Mrn, "//captain.api.mondoo.app/spaces/")
return !n.isRoot && !isSpace
}

func (n *rpBuilderPolicyNode) build(rp *ResolvedPolicy, data *rpBuilderData) error {
Expand Down

0 comments on commit 8308f3b

Please sign in to comment.