From 819f5fd7a06e90a6ee207114116ccf8613446d21 Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Fri, 23 Oct 2026 08:38:13 +0200 Subject: [PATCH] chore(googleworkspace): name the Policy API reducer the precedence rule implements (#13125) --- .../googleworkspace/lib/service/service.py | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/prowler/providers/googleworkspace/lib/service/service.py b/prowler/providers/googleworkspace/lib/service/service.py index 0c9449801c..fb1e210111 100644 --- a/prowler/providers/googleworkspace/lib/service/service.py +++ b/prowler/providers/googleworkspace/lib/service/service.py @@ -146,10 +146,17 @@ class GoogleWorkspaceService: The API returns every policy that exists for a setting: Google's SYSTEM defaults next to the ADMIN policy saved in the Admin console. - The value in force is the one with the greatest policyQuery.sortOrder - (Policy API concepts, Max and Merge reducers), not the last one - listed. Policies without a sort order keep the API order, so the last - one wins. Rules are not reduced: each policy is a distinct rule. + The value in force is the one with the greatest policyQuery.sortOrder, + which is the Policy API's Max reducer, not the last one listed. Rule + settings use the List reducer and are not reduced here: each policy is + a distinct rule. Settings resolved with the Merge, MaxMap or MergeMap + reducers combine several policies; this method keeps the greatest one + for them too, which is exact only when that policy supplies the whole + reduced value: every field, plus the array values Merge concatenates + and the keyed entries MaxMap and MergeMap keep from policies with a + lower sortOrder. Policies saved from the Admin console carry every + field of the setting. Policies without a sort order keep the API order, + so the last one wins. """ kept: list[dict] = [] position: dict[str, int] = {}