[TT-12897] Merge path based permissions when combining policies (#6597)

<details open>
<summary><a href="https://tyktech.atlassian.net/browse/TT-12897"
title="TT-12897" target="_blank">TT-12897</a></summary>
  <br />
  <table>
    <tr>
      <th>Summary</th>
<td>[Security]Path-Based Permissions permissions in policies are not
preserved when policies are combined</td>
    </tr>
    <tr>
      <th>Type</th>
      <td>
<img alt="Bug"
src="https://tyktech.atlassian.net/rest/api/2/universal_avatar/view/type/issuetype/avatar/10303?size=medium"
/>
        Bug
      </td>
    </tr>
    <tr>
      <th>Status</th>
      <td>In Dev</td>
    </tr>
    <tr>
      <th>Points</th>
      <td>N/A</td>
    </tr>
    <tr>
      <th>Labels</th>
<td><a
href="https://tyktech.atlassian.net/issues?jql=project%20%3D%20TT%20AND%20labels%20%3D%20customer_bug%20ORDER%20BY%20created%20DESC"
title="customer_bug">customer_bug</a>, <a
href="https://tyktech.atlassian.net/issues?jql=project%20%3D%20TT%20AND%20labels%20%3D%20jira_escalated%20ORDER%20BY%20created%20DESC"
title="jira_escalated">jira_escalated</a></td>
    </tr>
  </table>
</details>
<!--
  do not remove this marker as it will break jira-lint's functionality.
  added_by_jira_lint
-->

---

PR uses custom policies to combine several policies with access rights
set.

Since a `map` was in the path, user API for custom policies needed an
extension to preserve policy ID order. The existing function returning a
map didn't handle json decode errors properly and go semantics when
looping over maps don't preserve this order, but it's random so tests
would fail. Verified with `task stress`.

Issue: https://tyktech.atlassian.net/browse/TT-12897

___

Bug fix, Enhancement, Tests

___

- Enhanced policy application logic by introducing `MergeAllowedURLs` to
merge allowed URLs efficiently.
- Refactored `Store` to use a slice for policies, and introduced
`StoreMap` for unordered policy storage.
- Improved custom policy handling by adding `GetCustomPolicies` to
preserve policy order.
- Updated tests to ensure proper application of policies and added new
tests for `MergeAllowedURLs`.
- Updated Taskfile to include a new `stress` task for running stress
tests.

___

<table><thead><tr><th></th><th align="left">Relevant
files</th></tr></thead><tbody><tr><td><strong>Enhancement</strong></td><td><table>
<tr>
  <td>
    <details>
<summary><strong>apply.go</strong><dd><code>Enhance policy application
logic and logging</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

internal/policy/apply.go

<li>Introduced <code>MergeAllowedURLs</code> function to merge allowed
URLs.<br> <li> Updated <code>Logger</code> function to return a
<code>logrus.Entry</code>.<br> <li> Changed
<code>session.CustomPolicies()</code> to
<code>session.GetCustomPolicies()</code>.

</details>

  </td>
<td><a
href="https://github.com/TykTechnologies/tyk/pull/6597/files#diff-59b92e9d31f142f1d99b746eb3ff7db4e26bf6c3044c9b87b58034a947ee04d1">+9/-17</a>&nbsp;
&nbsp; </td>

</tr>

<tr>
  <td>
    <details>
<summary><strong>store.go</strong><dd><code>Refactor Store to use slice
for policies</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
</dd></summary>
<hr>

internal/policy/store.go

<li>Changed <code>Store</code> to use a slice for policies.<br> <li>
Updated methods to accommodate slice-based storage.

</details>

  </td>
<td><a
href="https://github.com/TykTechnologies/tyk/pull/6597/files#diff-13dec7bc453c9ff99550c83d2f86a017bbf7fb863584dc30603af15d29ef9d3d">+20/-7</a>&nbsp;
&nbsp; </td>

</tr>

<tr>
  <td>
    <details>
<summary><strong>store_map.go</strong><dd><code>Add StoreMap for
unordered policy storage</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
</dd></summary>
<hr>

internal/policy/store_map.go

<li>Introduced <code>StoreMap</code> for unordered policy storage.<br>
<li> Implemented methods for <code>StoreMap</code>.

</details>

  </td>
<td><a
href="https://github.com/TykTechnologies/tyk/pull/6597/files#diff-24a7a95a1cf4f14b59a3475127dc45541357638d6949323255faeeb2ed657d27">+46/-0</a>&nbsp;
&nbsp; </td>

</tr>

<tr>
  <td>
    <details>
<summary><strong>util.go</strong><dd><code>Introduce MergeAllowedURLs
and remove unused functions</code>&nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

internal/policy/util.go

<li>Added <code>MergeAllowedURLs</code> function for merging URL access
specs.<br> <li> Removed <code>copyAllowedURLs</code> and
<code>contains</code> functions.

</details>

  </td>
<td><a
href="https://github.com/TykTechnologies/tyk/pull/6597/files#diff-0323c3da13f08a9ccd340ac04208d680856354fd566dffcad925fa6645639955">+46/-70</a>&nbsp;
</td>

</tr>

<tr>
  <td>
    <details>
<summary><strong>custom_policies.go</strong><dd><code>Enhance custom
policies handling with order preservation</code>&nbsp; </dd></summary>
<hr>

user/custom_policies.go

<li>Added <code>GetCustomPolicies</code> to preserve policy order.<br>
<li> Updated <code>CustomPolicies</code> to use
<code>GetCustomPolicies</code>.

</details>

  </td>
<td><a
href="https://github.com/TykTechnologies/tyk/pull/6597/files#diff-911674993eef6c43a04edc0e90ea1f2e6d595792eef840d23b2e3deb1c8265c5">+21/-7</a>&nbsp;
&nbsp; </td>

</tr>
</table></td></tr><tr><td><strong>Tests</strong></td><td><table>
<tr>
  <td>
    <details>
<summary><strong>apply_test.go</strong><dd><code>Update tests for policy
application</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

internal/policy/apply_test.go

<li>Added initialization of <code>policy.Service</code> in tests.<br>
<li> Ensured <code>Apply</code> method is tested with
<code>assert.NoError</code>.

</details>

  </td>
<td><a
href="https://github.com/TykTechnologies/tyk/pull/6597/files#diff-5af7e299a6b0ce11e22f8aa4a01854b1151f4b54dccc68f0cd1cbedee5aed7c8">+29/-28</a>&nbsp;
</td>

</tr>

<tr>
  <td>
    <details>
<summary><strong>util_test.go</strong><dd><code>Add tests for
MergeAllowedURLs function</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

internal/policy/util_test.go

- Added tests for `MergeAllowedURLs` function.

</details>

  </td>
<td><a
href="https://github.com/TykTechnologies/tyk/pull/6597/files#diff-c750a1b8a01d19dacf02ba7512b8e2b987bf8147cf3345a4374504d9d5b3840e">+64/-0</a>&nbsp;
&nbsp; </td>

</tr>
</table></td></tr><tr><td><strong>Configuration
changes</strong></td><td><table>
<tr>
  <td>
    <details>
<summary><strong>Taskfile.yml</strong><dd><code>Update Taskfile with
stress test task</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

internal/policy/Taskfile.yml

<li>Added <code>stress</code> task for running stress tests.<br> <li>
Updated <code>default</code> task to include <code>test</code>.

</details>

  </td>
<td><a
href="https://github.com/TykTechnologies/tyk/pull/6597/files#diff-e0f19d4dd27acb397e19ccb080f3142a09f5978699da5843bfc71e7ffa4bb775">+16/-0</a>&nbsp;
&nbsp; </td>

</tr>
</table></td></tr></tr></tbody></table>

___

> 💡 **PR-Agent usage**: Comment `/help "your question"` on any pull
request to receive relevant information

---------

Co-authored-by: Tit Petric <tit@tyk.io>

(cherry picked from commit e31a08f)

gateway/api_definition.go

@@ -47,6 +47,7 @@ import (
 	"github.com/TykTechnologies/tyk/apidef"
 	"github.com/TykTechnologies/tyk/config"
 	"github.com/TykTechnologies/tyk/header"
+	"github.com/TykTechnologies/tyk/internal/model"
 	"github.com/TykTechnologies/tyk/regexp"
 	"github.com/TykTechnologies/tyk/rpc"
 	"github.com/TykTechnologies/tyk/storage"
@@ -522,7 +523,11 @@ func (a APIDefinitionLoader) FromDashboardService(endpoint string) ([]*APISpec,
 	}
 
 	// Extract tagged APIs#
+<<<<<<< HEAD
 	list := &nestedApiDefinitionList{}
+=======
+	list := model.NewMergedAPIList()
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 	inBytes, err := io.ReadAll(resp.Body)
 	if err != nil {
 		log.Error("Couldn't read api definition list")
@@ -680,15 +685,23 @@ func (a APIDefinitionLoader) FromRPC(store RPCDataLoader, orgId string, gw *Gate
 }
 
 func (a APIDefinitionLoader) processRPCDefinitions(apiCollection string, gw *Gateway) ([]*APISpec, error) {
+<<<<<<< HEAD
 
 	var payload []nestedApiDefinition
+=======
+	var payload []model.MergedAPI
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 	if err := json.Unmarshal([]byte(apiCollection), &payload); err != nil {
 		return nil, err
 	}
 
+<<<<<<< HEAD
 	list := &nestedApiDefinitionList{
 		Message: payload,
 	}
+=======
+	list := model.NewMergedAPIList(payload...)
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 
 	gwConfig := a.Gw.GetConfig()
 

gateway/api_definition_test.go

@@ -21,6 +21,11 @@ import (
 	"github.com/TykTechnologies/tyk/apidef"
 	"github.com/TykTechnologies/tyk/apidef/oas"
 	"github.com/TykTechnologies/tyk/config"
+<<<<<<< HEAD
+=======
+	"github.com/TykTechnologies/tyk/internal/model"
+	"github.com/TykTechnologies/tyk/internal/policy"
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 	"github.com/TykTechnologies/tyk/rpc"
 	"github.com/TykTechnologies/tyk/test"
 	"github.com/TykTechnologies/tyk/user"
@@ -1448,7 +1453,7 @@ func Test_LoadAPIsFromRPC(t *testing.T) {
 	loader := APIDefinitionLoader{Gw: ts.Gw}
 
 	t.Run("load APIs from RPC - success", func(t *testing.T) {
-		mockedStorage := &RPCDataLoaderMock{
+		mockedStorage := &policy.RPCDataLoaderMock{
 			ShouldConnect: true,
 			Apis: []nestedApiDefinition{
 				{APIDefinition: &apidef.APIDefinition{Id: objectID, OrgID: "org1", APIID: "api1"}},
@@ -1462,7 +1467,7 @@ func Test_LoadAPIsFromRPC(t *testing.T) {
 	})
 
 	t.Run("load APIs from RPC - success - then fail", func(t *testing.T) {
-		mockedStorage := &RPCDataLoaderMock{
+		mockedStorage := &policy.RPCDataLoaderMock{
 			ShouldConnect: true,
 			Apis: []nestedApiDefinition{
 				{APIDefinition: &apidef.APIDefinition{Id: objectID, OrgID: "org1", APIID: "api1"}},

gateway/gateway.go

@@ -0,0 +1,62 @@
+package gateway
+
+import (
+	"github.com/TykTechnologies/tyk/internal/policy"
+	"github.com/TykTechnologies/tyk/user"
+)
+
+// Repository is a description of our Gateway API promises.
+type Repository interface {
+	policy.Repository
+}
+
+// Gateway implements the Repository interface.
+var _ Repository = &Gateway{}
+
+// PolicyIDs returns a list of IDs for each policy loaded in the gateway.
+func (gw *Gateway) PolicyIDs() []string {
+	gw.policiesMu.RLock()
+	defer gw.policiesMu.RUnlock()
+
+	result := make([]string, 0, len(gw.policiesByID))
+	for id := range gw.policiesByID {
+		result = append(result, id)
+	}
+	return result
+}
+
+// PolicyByID will return a Policy matching the passed Policy ID.
+func (gw *Gateway) PolicyByID(id string) (user.Policy, bool) {
+	gw.policiesMu.RLock()
+	defer gw.policiesMu.RUnlock()
+
+	pol, ok := gw.policiesByID[id]
+	return pol, ok
+}
+
+// PolicyCount will return the number of policies loaded in the gateway.
+func (gw *Gateway) PolicyCount() int {
+	gw.policiesMu.RLock()
+	defer gw.policiesMu.RUnlock()
+
+	return len(gw.policiesByID)
+}
+
+// SetPolicies updates the internal policy map with a new policy map.
+func (gw *Gateway) SetPolicies(pols map[string]user.Policy) {
+	gw.policiesMu.Lock()
+	defer gw.policiesMu.Unlock()
+
+	gw.policiesByID = pols
+}
+
+// SetPoliciesByID will update the internal policiesByID map with new policies.
+// The key used will be the policy ID.
+func (gw *Gateway) SetPoliciesByID(pols ...user.Policy) {
+	gw.policiesMu.Lock()
+	defer gw.policiesMu.Unlock()
+
+	for _, pol := range pols {
+		gw.policiesByID[pol.ID] = pol
+	}
+}

gateway/health_check.go

@@ -8,15 +8,21 @@ import (
 	"sync"
 	"time"
 
+<<<<<<< HEAD
 	"github.com/TykTechnologies/tyk/rpc"
 
+=======
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 	"github.com/sirupsen/logrus"
 
 	"github.com/TykTechnologies/tyk/apidef"
 	"github.com/TykTechnologies/tyk/header"
+	"github.com/TykTechnologies/tyk/internal/model"
+	"github.com/TykTechnologies/tyk/rpc"
 	"github.com/TykTechnologies/tyk/storage"
 )
 
+<<<<<<< HEAD
 func (gw *Gateway) setCurrentHealthCheckInfo(h map[string]apidef.HealthCheckItem) {
 	gw.healthCheckInfo.Store(h)
 }
@@ -25,12 +31,40 @@ func (gw *Gateway) getHealthCheckInfo() map[string]apidef.HealthCheckItem {
 	ret, ok := gw.healthCheckInfo.Load().(map[string]apidef.HealthCheckItem)
 	if !ok {
 		return make(map[string]apidef.HealthCheckItem, 0)
+=======
+type (
+	HealthCheckItem     = model.HealthCheckItem
+	HealthCheckStatus   = model.HealthCheckStatus
+	HealthCheckResponse = model.HealthCheckResponse
+)
+
+const (
+	Pass      = model.Pass
+	Fail      = model.Fail
+	Warn      = model.Warn
+	Datastore = model.Datastore
+	System    = model.System
+)
+
+func (gw *Gateway) setCurrentHealthCheckInfo(h map[string]model.HealthCheckItem) {
+	gw.healthCheckInfo.Store(h)
+}
+
+func (gw *Gateway) getHealthCheckInfo() map[string]HealthCheckItem {
+	ret, ok := gw.healthCheckInfo.Load().(map[string]HealthCheckItem)
+	if !ok {
+		return make(map[string]HealthCheckItem, 0)
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 	}
 	return ret
 }
 
 func (gw *Gateway) initHealthCheck(ctx context.Context) {
+<<<<<<< HEAD
 	gw.setCurrentHealthCheckInfo(make(map[string]apidef.HealthCheckItem, 3))
+=======
+	gw.setCurrentHealthCheckInfo(make(map[string]HealthCheckItem, 3))
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 
 	go func(ctx context.Context) {
 		var n = gw.GetConfig().LivenessCheck.CheckDuration
@@ -59,12 +93,20 @@ func (gw *Gateway) initHealthCheck(ctx context.Context) {
 }
 
 type SafeHealthCheck struct {
+<<<<<<< HEAD
 	info map[string]apidef.HealthCheckItem
+=======
+	info map[string]HealthCheckItem
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 	mux  sync.Mutex
 }
 
 func (gw *Gateway) gatherHealthChecks() {
+<<<<<<< HEAD
 	allInfos := SafeHealthCheck{info: make(map[string]apidef.HealthCheckItem, 3)}
+=======
+	allInfos := SafeHealthCheck{info: make(map[string]HealthCheckItem, 3)}
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 
 	redisStore := storage.RedisCluster{KeyPrefix: "livenesscheck-", ConnectionHandler: gw.StorageConnectionHandler}
 
@@ -76,17 +118,27 @@ func (gw *Gateway) gatherHealthChecks() {
 	go func() {
 		defer wg.Done()
 
+<<<<<<< HEAD
 		var checkItem = apidef.HealthCheckItem{
 			Status:        apidef.Pass,
 			ComponentType: apidef.Datastore,
+=======
+		var checkItem = HealthCheckItem{
+			Status:        Pass,
+			ComponentType: Datastore,
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 			Time:          time.Now().Format(time.RFC3339),
 		}
 
 		err := redisStore.SetRawKey(key, key, 10)
 		if err != nil {
 			mainLog.WithField("liveness-check", true).WithError(err).Error("Redis health check failed")
 			checkItem.Output = err.Error()
+<<<<<<< HEAD
 			checkItem.Status = apidef.Fail
+=======
+			checkItem.Status = Fail
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 		}
 
 		allInfos.mux.Lock()
@@ -100,16 +152,23 @@ func (gw *Gateway) gatherHealthChecks() {
 		go func() {
 			defer wg.Done()
 
+<<<<<<< HEAD
 			var checkItem = apidef.HealthCheckItem{
 				Status:        apidef.Pass,
 				ComponentType: apidef.Datastore,
+=======
+			var checkItem = HealthCheckItem{
+				Status:        Pass,
+				ComponentType: Datastore,
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 				Time:          time.Now().Format(time.RFC3339),
 			}
 
 			if gw.DashService == nil {
 				err := errors.New("Dashboard service not initialized")
 				mainLog.WithField("liveness-check", true).Error(err)
 				checkItem.Output = err.Error()
+<<<<<<< HEAD
 				checkItem.Status = apidef.Fail
 			} else if err := gw.DashService.Ping(); err != nil {
 				mainLog.WithField("liveness-check", true).Error(err)
@@ -118,6 +177,16 @@ func (gw *Gateway) gatherHealthChecks() {
 			}
 
 			checkItem.ComponentType = apidef.System
+=======
+				checkItem.Status = Fail
+			} else if err := gw.DashService.Ping(); err != nil {
+				mainLog.WithField("liveness-check", true).Error(err)
+				checkItem.Output = err.Error()
+				checkItem.Status = Fail
+			}
+
+			checkItem.ComponentType = System
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 
 			allInfos.mux.Lock()
 			allInfos.info["dashboard"] = checkItem
@@ -132,18 +201,31 @@ func (gw *Gateway) gatherHealthChecks() {
 		go func() {
 			defer wg.Done()
 
+<<<<<<< HEAD
 			var checkItem = apidef.HealthCheckItem{
 				Status:        apidef.Pass,
 				ComponentType: apidef.Datastore,
+=======
+			var checkItem = HealthCheckItem{
+				Status:        Pass,
+				ComponentType: Datastore,
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 				Time:          time.Now().Format(time.RFC3339),
 			}
 
 			if !rpc.Login() {
 				checkItem.Output = "Could not connect to RPC"
+<<<<<<< HEAD
 				checkItem.Status = apidef.Fail
 			}
 
 			checkItem.ComponentType = apidef.System
+=======
+				checkItem.Status = Fail
+			}
+
+			checkItem.ComponentType = System
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 
 			allInfos.mux.Lock()
 			allInfos.info["rpc"] = checkItem
@@ -166,8 +248,13 @@ func (gw *Gateway) liveCheckHandler(w http.ResponseWriter, r *http.Request) {
 
 	checks := gw.getHealthCheckInfo()
 
+<<<<<<< HEAD
 	res := apidef.HealthCheckResponse{
 		Status:      apidef.Pass,
+=======
+	res := HealthCheckResponse{
+		Status:      Pass,
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 		Version:     VERSION,
 		Description: "Tyk GW",
 		Details:     checks,
@@ -176,11 +263,16 @@ func (gw *Gateway) liveCheckHandler(w http.ResponseWriter, r *http.Request) {
 	var failCount int
 
 	for _, v := range checks {
+<<<<<<< HEAD
 		if v.Status == apidef.Fail {
+=======
+		if v.Status == Fail {
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 			failCount++
 		}
 	}
 
+<<<<<<< HEAD
 	var status apidef.HealthCheckStatus
 
 	switch failCount {
@@ -192,6 +284,19 @@ func (gw *Gateway) liveCheckHandler(w http.ResponseWriter, r *http.Request) {
 
 	default:
 		status = apidef.Warn
+=======
+	var status HealthCheckStatus
+
+	switch failCount {
+	case 0:
+		status = Pass
+
+	case len(checks):
+		status = Fail
+
+	default:
+		status = Warn
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)
 	}
 
 	res.Status = status

gateway/policy_test.go

@@ -20,7 +20,6 @@ import (
 	"github.com/TykTechnologies/tyk/apidef"
 	"github.com/TykTechnologies/tyk/config"
 	"github.com/TykTechnologies/tyk/header"
-	"github.com/TykTechnologies/tyk/rpc"
 	"github.com/TykTechnologies/tyk/test"
 	"github.com/TykTechnologies/tyk/user"
 
@@ -1596,6 +1595,7 @@ func TestParsePoliciesFromRPC(t *testing.T) {
 	}
 
 }
+<<<<<<< HEAD
 
 type RPCDataLoaderMock struct {
 	ShouldConnect bool
@@ -1666,3 +1666,5 @@ func Test_LoadPoliciesFromRPC(t *testing.T) {
 		assert.Equal(t, 1, len(polMap), "expected 0 policies to be loaded from RPC")
 	})
 }
+=======
+>>>>>>> e31a08f08... [TT-12897] Merge path based permissions when combining policies (#6597)