sourcepolicy: make sure rule constraints are not used from selectorCache

SelectorCache only stores the identifier and type. Constraints need to
be passed directly outside of cache.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

sourcepolicy/engine.go

@@ -130,7 +130,7 @@ func (e *Engine) evaluatePolicy(ctx context.Context, pol *spb.Policy, srcOp *pb.
 	var deny bool
 	for _, rule := range pol.Rules {
 		selector := e.selectorCache(rule.Selector)
-		matched, err := match(selector, ident, srcOp.Attrs)
+		matched, err := match(selector, ident, rule.Selector.Constraints, srcOp.Attrs)
 		if err != nil {
 			return false, errors.Wrap(err, "error matching source policy")
 		}

sourcepolicy/matcher.go

@@ -7,8 +7,8 @@ import (
 	"github.com/pkg/errors"
 )
 
-func match(src *selectorCache, ref string, attrs map[string]string) (bool, error) {
-	for _, c := range src.Constraints {
+func match(src *selectorCache, ref string, constraints []*spb.AttrConstraint, attrs map[string]string) (bool, error) {
+	for _, c := range constraints {
 		if c == nil {
 			return false, errors.Errorf("invalid nil constraint for %v", src)
 		}

sourcepolicy/matcher_test.go

@@ -319,7 +319,7 @@ func TestMatch(t *testing.T) {
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			matches, err := match(&selectorCache{Selector: tc.src}, tc.ref, tc.attrs)
+			matches, err := match(&selectorCache{Selector: tc.src}, tc.ref, tc.src.Constraints, tc.attrs)
 			if !tc.xErr {
 				require.NoError(t, err)
 			} else {