fix(policy): detect denies in directly constructed policies

Scan the statements when the cached Deny flag is unset. Keep the cached
true path and avoid mutating policies during inspection. Cover literal
policies, indexed policies and the built-in readonly definition.

Adapt the fallback from minio/pkg commit
911bb0d.

Co-authored-by: Klaus Post <klauspost@gmail.com>
Signed-off-by: Feng Ruohang <rh@vonng.com>

Author: Vonng

policy/policy.go

@@ -127,7 +127,16 @@ type Policy struct {
 
 // HasDenyStatement returns if the policy has a deny statement.
 func (iamp *Policy) HasDenyStatement() bool {
-	return iamp.hasDeny
+	if iamp.hasDeny {
+		return true
+	}
+	// Directly constructed policies have not populated the cached flag.
+	for i := range iamp.Statements {
+		if iamp.Statements[i].Effect == Deny {
+			return true
+		}
+	}
+	return false
 }
 
 // MatchResource matches resource with match resource patterns

policy/policy_regression_test.go

@@ -75,3 +75,42 @@ func TestMergePoliciesPreservesNotResourceDenies(t *testing.T) {
 		}
 	}
 }
+
+func TestHasDenyStatementWithoutParsing(t *testing.T) {
+	for _, tt := range []struct {
+		name    string
+		effects []Effect
+		want    bool
+	}{
+		{"empty", nil, false},
+		{"allow", []Effect{Allow}, false},
+		{"deny", []Effect{Deny}, true},
+		{"allow-then-deny", []Effect{Allow, Deny}, true},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			p := Policy{Version: DefaultVersion}
+			for _, effect := range tt.effects {
+				p.Statements = append(p.Statements, Statement{
+					Effect: effect, Actions: NewActionSet(GetObjectAction),
+					Resources: NewResourceSet(NewResource("*")),
+				})
+			}
+			if got := p.HasDenyStatement(); got != tt.want {
+				t.Errorf("HasDenyStatement() = %v, want %v", got, tt.want)
+			}
+			p.updateActionIndex()
+			if got := p.HasDenyStatement(); got != tt.want {
+				t.Errorf("indexed HasDenyStatement() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+	for _, p := range DefaultPolicies {
+		if p.Name == "readonly" {
+			if !p.Definition.HasDenyStatement() {
+				t.Error("readonly's explicit Deny must be reported before parsing")
+			}
+			return
+		}
+	}
+	t.Fatal("readonly policy not found")
+}