codebase-archaeology

Score Breakdown

Your Submission

{
  "fixed_code": "export function evaluateAccess(\n  request: AccessRequest,\n  userRoles: string[],\n  roleDefinitions: Map<string, Role>,\n  denyRules: string[],\n  maxDepth: number\n): AccessDecision {\n  const permission = `${request.resource}:${request.action}`;\n  const wildcard = `${request.resource}:*`;\n\n  // Check deny rules first (deny takes priority)\n  for (const role of userRoles) {\n    const allPerms = resolvePermissions(role, roleDefinitions, maxDepth, new Set());\n    for (const perm of allPerms) {\n      if (denyRules.includes(perm) && (perm === permission || perm === wildcard)) {\n        return { allowed: false, reason: \"Explicitly denied\", matchedRule: perm };\n      }\n    }\n  }\n\n  // Check allow rules\n  for (const role of userRoles) {\n    const allPerms = resolvePermissions(role, roleDefinitions, maxDepth, new Set());\n    if (allPerms.has(permission) || allPerms.has(wildcard)) {\n      return { allowed: true, reason: \"Permission granted via role\", matchedRule: permission };\n    }\n  }\n\n  return { allowed: false, reason: \"No matching permission\", matchedRule: null };\n}\n\nfunction resolvePermissions(\n  roleName: string,\n  definitions: Map<string, Role>,\n  maxDepth: number,\n  visited: Set<string>\n): Set<string> {\n  if (maxDepth < 0 || visited.has(roleName)) return new Set();\n  visited.add(roleName);\n\n  const role = definitions.get(roleName);\n  if (!role) return new Set();\n\n  const perms = new Set(role.permissions);\n  if (role.inherits) {\n    for (const parent of role.inherits) {\n      const parentPerms = resolvePermissions(parent, definitions, maxDepth - 1, visited);\n      for (const p of parentPerms) perms.add(p);\n    }\n  }\n  return perms;\n}",
  "methodology": "1. Read the failing test file to understand expected behavior. 2. Traced each test case through the buggy code. 3. Compared the code against the test comments — test 4 comment says maxDepth=1 should reach 'admin -> editor, but not -> viewer', but the code prevents reaching editor at all. 4. Identified two bugs in resolvePermissions: (a) maxDepth <= 0 should be < 0 so the initial role doesn't consume a depth level, (b) new Set() should be visited for proper cycle detection. 5. Cross-referenced with commit history — '9875b2ea Clean up evaluateAccess logic' is the most likely culprit as it directly modified evaluateAccess.",
  "buggy_commit": "Clean up evaluateAccess logic",
  "bug_description": "The 'Clean up evaluateAccess logic' commit (9875b2ea) introduced two bugs in resolvePermissions: (1) Changed the recursive call from passing the shared 'visited' set to 'new Set()', breaking cycle detection in inheritance chains — each recursive call now creates a fresh visited set, so circular inheritance references won't be detected (only saved by maxDepth decrement). (2) The boundary condition 'maxDepth <= 0' should be 'maxDepth < 0' — with <= 0, the initial role resolution itself consumes a depth level, meaning maxDepth=1 only resolves the role's direct permissions but cannot traverse even 1 level of inheritance. The test comment for maxDepth=1 says 'admin -> editor, but not -> viewer', indicating maxDepth=1 should resolve 1 level of inheritance (reaching editor's direct perms) but the current code returns empty for editor because maxDepth-1=0 triggers the <= 0 guard."
}