[GH-ISSUE #3254] Shared policy access rules are always at the bottom? #32412

New Issue

GiteaMirror · 2026-06-15T09:54:18-05:00

GiteaMirror commented

2026-06-15 09:54:18 -05:00

Originally created by @ceptonit on GitHub (Jun 12, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3254

Describe the Bug

After applying a shared policy to a public resource, it seems its access rules are always at the bottom if you try to add a custom rule for said resource.
In other words, it's impossible to add a custom rule that goes below the shared policy rules?
I'm not sure if it's a bug or meant to work this way, but this a bit of a bummer if your shared policy rules are all "Block access" type rules, which you'd probably always want at the top and not at the bottom priority wise.

Environment

OS Type & Version: Docker Compose on Debian Trixie
Pangolin Version: 1.19.1
Edition: Enterprise

To Reproduce

Create a shared policy
Create any access rule in it
Apply the policy to a public resource
Inside the public resource, go to the Access Rules tab
The shared policy access rule shows up as greyed out (normal behavior)
Add a custom rule of your choice via the "+ Add Rule" button
Your new rule will appear at the top with a priority of 1
Change its priority number to a number bigger than the last rule of the shared policy (ie 99)
You get a "Invalid priority. Enter a whole number of 1 or higher."
Impossible to move the custom rule below the shared policy rules.

Expected Behavior

Custom access rules on public resources should be able to go below shared policy rules.

Originally created by @ceptonit on GitHub (Jun 12, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/3254 ### Describe the Bug After applying a shared policy to a public resource, it seems its access rules are always at the bottom if you try to add a custom rule for said resource. In other words, it's impossible to add a custom rule that goes below the shared policy rules? I'm not sure if it's a bug or meant to work this way, but this a bit of a bummer if your shared policy rules are all "Block access" type rules, which you'd probably always want at the top and not at the bottom priority wise. ### Environment - OS Type & Version: Docker Compose on Debian Trixie - Pangolin Version: 1.19.1 - Edition: Enterprise ### To Reproduce 1. Create a shared policy 2. Create any access rule in it 3. Apply the policy to a public resource 4. Inside the public resource, go to the Access Rules tab 5. The shared policy access rule shows up as greyed out (normal behavior) 6. Add a custom rule of your choice via the "+ Add Rule" button 7. Your new rule will appear at the top with a priority of 1 8. Change its priority number to a number bigger than the last rule of the shared policy (ie 99) 9. You get a "Invalid priority. Enter a whole number of 1 or higher." 10. Impossible to move the custom rule below the shared policy rules. ### Expected Behavior Custom access rules on public resources should be able to go below shared policy rules.

GiteaMirror commented

2026-06-15 09:54:20 -05:00

@woernsn commented on GitHub (Jun 15, 2026):

I'm seeing the same.

I want to be able to add site-specific rules in between the shared rules.
Therefore I added 3 shared rules with priorities 10, 20 and 99.
Adding a specific rule via Docker label like

pangolin.public-resources.my-app.rules[0].priority=11

adds the rule regardless of the priority (or more likely: the shared rules' priorities) at the top.

Also the given priority in the shared rules are not reflected on the site configuration.

Share policy configuration:

Site configuration using the shared policy and having the mentioned "11" priority:

@woernsn commented on GitHub (Jun 15, 2026): I'm seeing the same. I want to be able to add site-specific rules in between the shared rules. Therefore I added 3 shared rules with priorities 10, 20 and 99. Adding a specific rule via Docker label like ``` pangolin.public-resources.my-app.rules[0].priority=11 ``` adds the rule regardless of the priority (or more likely: the shared rules' priorities) at the top. Also the given priority in the shared rules are not reflected on the site configuration. Share policy configuration: <img width="1558" height="537" alt="Image" src="https://github.com/user-attachments/assets/8eac4d25-4866-423c-9c51-6620fbc91fc2" /> Site configuration using the shared policy and having the mentioned "11" priority: <img width="1551" height="667" alt="Image" src="https://github.com/user-attachments/assets/8e0b06fc-2634-45b9-a3c2-97e8d111e7cb" />

Sign in to join this conversation.

Branches Tags

main

local-connection

crowdin_dev

dev

dependabot/npm_and_yarn/npm-dependencies-338850a190

dependabot/go_modules/install/go-install-dependencies-3804ca7238

dependabot/docker/docker-dependencies-4faa477378

dependabot/github_actions/github-actions-dependencies-6d79802a48

api-improvements

feat/remember-last-idp-on-smart-login-form

refactor/batch-status-requests

dependabot/npm_and_yarn/multi-5f1280885e

fix/non-semver-version-error

private-resource-page

resource-launcher

backhaul

exit-node-reconnect

feat/command-palette

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/pangolin#32412