fix: Use make() to initialise array of Policy and Role instead of leaving it uninitalised

[xlanor]

Fixes #217
This is an ongoing issue in encoding/json, whereby if an uninitialised array (such as policies, which is declared as var p Policies, or roles, which is declared as var p Roles) is attempted to be encoded using json.Marshal, it results in a nil value being returned instead of [].

Given that json doesn't appear to be merging the currently open PR to add an option to return nil as [] or {} in when json.Marshal is used anytime soon, this patch should fix that.

I've updated the tests in filter_test.go and filter_helper_test.go to replace the expected nil values with the relevant empty Role/Policy object.

Related issue

#217
golang/go#27589

Proposed changes

Checklist

• I have read the contributing guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security. vulnerability, I
  confirm that I got green light (please contact
  security@ory.sh) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

Further comments

Below is the tracing process that I posted on #217

I've been tracing this bug because it also affects us at work, and I've traced it to this
func (h *Handler) List(factory func(context.Context, *http.Request, httprouter.Params) (*ListRequest, error)) httprouter.Handle in storage/handler.go returns a h.h.Write(w, r, l.Filter(m).Value), and in this case, l.Filter(m).Value returns *storage.Policies, which is declared as a type of []Policy .

h, in this case, which is a type of herodot.Writer, an interface, in this particular function, is a herodot.JSONWriter, and Write in this case calls WriteCode here. This tells me that there's an issue with encoding/json's json.Marshal(e), where e refers to l.Filter(m).Value.

I believe this is due to golang/go#27589, and a proposal has been made to modify encoding/json that is still under going review here and awaiting a PR at golang/go#37711.

At this point, I'm wondering if I should submit a PR to ory/herodot, to do the checking in func WriteCode. If it is a shared library, do you think that this will affect other projects that ory has?

There's a quick fix, as can be seen from CosmWasm/wasmvm#75, to quickly check the value, and if it's nil, do not even proceed with JSON.Marshal. This might actually be the fastest way to fix this, but I'm unsure about the potential impact, given that herodot is a shared repository.

Ultimately, the issue lies in func ListByQuery in storage/handler.go, which declares var res Roles and var res Policies without explicitly initialising them, as well as func rolesList and func policiesList in engine/ladon/handler.go, which does the same.

[aeneasr]

Awesome, thank you for your contribution! This looks pretty good but I have some ideas how to improve it further :)

[aeneasr]

Revert the changes in this file :)

[xlanor]

Apart from reverting this, I have also changed the expected nil values to match the empty policies/roles that is returned now.

[xlanor]

Ah, I didn't know that! It's late here now, I will push the changes that you've suggested tomorrow

[xlanor]

@aeneasr , The requested changes have been made!

[aeneasr]

Awesome 🎉

Thank you for your contribution!