Internal error when evaluating resource with a disabled scope hierarchy

[scraymondjr]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Internal Server Error returned when evaluating a resource policy with a scope defined where one resource policy in the scope hierarchy is disabled. Example response from CheckResources:

{
  "code": 13,
  "message": "Policy check failed"
}

Expected Behavior

If this setup is invalid, then I expect to see a 400-like error with an error message indicating that the resource access could not be evaluated due to disabled scope policy.

Steps To Reproduce

1. Add scoped policies such that one policy is disabled (I observed that the level of the hierarchy does not matter). Example with default policy being disabled:

{
  "policies": [
    {
      "apiVersion": "api.cerbos.dev/v1",
      "disabled": true,
      "resourcePolicy": {
        "resource": "test:resource",
        "scope": "",
        "version": "default",
        "rules": [
          {
            "actions": [
              "read"
            ],
            "roles": [
              "TestRole"
            ],
            "effect": "EFFECT_DENY"
          }
        ]
      }
    },
    {
      "apiVersion": "api.cerbos.dev/v1",
      "resourcePolicy": {
        "resource": "test:resource",
        "scope": "a",
        "version": "default",
        "rules": [
          {
            "actions": [
              "read"
            ],
            "roles": [
              "TestRole"
            ],
            "effect": "EFFECT_ALLOW"
          }
        ]
      }
    }
  ]
}

2. CheckResources call to see internal error:

{
  "requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",
  "includeMeta": true,
  "principal": {
    "id": "bugs_bunny",
    "policyVersion": "default",
    "roles": [
      "TestRole"
    ]
  },
  "resources": [
    {
      "actions": [
        "read"
      ],
      "resource": {
        "kind": "test:resource",
        "policyVersion": "default",
        "scope": "a",
        "id": "XX125"
      }
    }
  ]
}

Environment

- OS:
- Cerbos version: github.com/cerbos/cerbos v0.26.0
- Docker version: Docker version 20.10.11, build dea9396
- Go version: go version go1.19 darwin/amd64

Anything else?

No response