From 8c849230e68fc98c9cea6e4a762abe2c426885a9 Mon Sep 17 00:00:00 2001
From: 123yangxiong <117716942+123yangxiong@users.noreply.github.com>
Date: Mon, 5 Dec 2022 22:03:00 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8Dlabel=E5=80=BC=E4=B8=BA?=
 =?UTF-8?q?=E7=A9=BA=E6=97=B6=EF=BC=8C=E8=B7=B3=E8=BF=87=E9=AA=8C=E8=AF=81?=
 =?UTF-8?q?=20(#272)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/datasource/auth/decision.go          |  2 +-
 server/datasource/auth/filter_kvdoc.go      |  2 +-
 server/datasource/auth/filter_kvdoc_test.go | 29 +++++++++++++++++++++
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/server/datasource/auth/decision.go b/server/datasource/auth/decision.go
index f17fc88d..56caddaa 100644
--- a/server/datasource/auth/decision.go
+++ b/server/datasource/auth/decision.go
@@ -76,7 +76,7 @@ func FilterLabel(targetResourceLabel []map[string]string, permLabelList []map[st
 
 func LabelMatched(targetResourceLabel map[string]string, permLabel map[string]string) bool {
 	for k, v := range permLabel {
-		if vv := targetResourceLabel[k]; vv != v {
+		if vv, ok := targetResourceLabel[k]; !ok || vv != v {
 			return false
 		}
 	}
diff --git a/server/datasource/auth/filter_kvdoc.go b/server/datasource/auth/filter_kvdoc.go
index 87a410cf..582ff1f0 100644
--- a/server/datasource/auth/filter_kvdoc.go
+++ b/server/datasource/auth/filter_kvdoc.go
@@ -35,7 +35,7 @@ func FilterKVs(kvs []*model.KVDoc, labelsList []map[string]string) []*model.KVDo
 
 func matchOne(kv *model.KVDoc, labels map[string]string) bool {
 	for lk, lv := range labels {
-		if v := kv.Labels[lk]; v != lv {
+		if v, ok := kv.Labels[lk]; !ok || v != lv {
 			return false
 		}
 	}
diff --git a/server/datasource/auth/filter_kvdoc_test.go b/server/datasource/auth/filter_kvdoc_test.go
index 1dcdaf26..e87edccf 100644
--- a/server/datasource/auth/filter_kvdoc_test.go
+++ b/server/datasource/auth/filter_kvdoc_test.go
@@ -53,3 +53,32 @@ func TestFilterKVs(t *testing.T) {
 	r := FilterKVs(kvs, permResourceLabel)
 	assert.Equal(t, 1, len(r))
 }
+
+func TestFilterKVsNull(t *testing.T) {
+	permResourceLabel := []map[string]string{
+		{"environment": ""},
+	}
+
+	var kvs []*model.KVDoc
+
+	kv1 := new(model.KVDoc)
+	kv1.Key = "k1"
+	kv1.Value = "v1"
+	kv1.Labels = map[string]string{"environment": "production", "appId": "default", "service": "s1"}
+	kvs = append(kvs, kv1)
+
+	kv2 := new(model.KVDoc)
+	kv2.Key = "k2"
+	kv2.Value = "v2"
+	kv2.Labels = map[string]string{"environment": "", "appId": "default"}
+	kvs = append(kvs, kv2)
+
+	kv3 := new(model.KVDoc)
+	kv3.Key = "k3"
+	kv3.Value = "v3"
+	kv3.Labels = map[string]string{"version": "xxx"}
+	kvs = append(kvs, kv3)
+
+	r := FilterKVs(kvs, permResourceLabel)
+	assert.Equal(t, 1, len(r))
+}