Merge 2cbba97 into e4c3892

middleware.go

@@ -281,7 +281,7 @@ func (t BaseMiddleware) ApplyPolicies(key string, session *user.SessionState) er
 				}
 
 				// check if we already have limit on API level specified when policy was created
-				if accessRights.Limit == nil {
+				if accessRights.Limit == nil || *accessRights.Limit == (user.APILimit{}) {
 					// limit was not specified on API level so we will populate it from policy
 					accessRights.Limit = &user.APILimit{
 						QuotaMax:         policy.QuotaMax,
@@ -292,9 +292,6 @@ func (t BaseMiddleware) ApplyPolicies(key string, session *user.SessionState) er
 					}
 				}
 
-				// adjust policy access right with limit on API level
-				policy.AccessRights[apiID] = accessRights
-
 				// overwrite session access right for this API
 				rights[apiID] = accessRights