prevent returning resource_instance on local role assignments for top…

… level roles
permitio · Jan 6, 2025 · eb0f7f7 · eb0f7f7
1 parent 6f68e53
commit eb0f7f7
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/horizon/local/schemas.py b/horizon/local/schemas.py
@@ -97,8 +97,11 @@ def tenant(self) -> str:
         return self.attributes.get("tenant", "")
 
     @property
-    def resource_instance(self) -> str:
-        return self.attributes.get("resource", "")
+    def resource_instance(self) -> str | None:
+        resource = self.attributes.get("resource", "")
+        if not resource or resource.startswith("__tenant:"):
+            return None
+        return resource
 
     def into_role_assignment(self) -> RoleAssignment:
         return RoleAssignment(