From f0539d037980adac4aef4be09dcc09de34eadaae Mon Sep 17 00:00:00 2001
From: Naveed <naveed@bugqore.com>
Date: Wed, 12 Aug 2026 20:26:02 +0530
Subject: [PATCH] authz: reject duplicate rule names in authorization policy

---
 authz/rbac_translator.go      |  3 +++
 authz/rbac_translator_test.go | 24 ++++++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/authz/rbac_translator.go b/authz/rbac_translator.go
index 730ec9dc426a..5efd37f83a4f 100644
--- a/authz/rbac_translator.go
+++ b/authz/rbac_translator.go
@@ -278,6 +278,9 @@ func parseRules(rules []rule, prefixName string) (map[string]*v3rbacpb.Policy, e
 			return nil, fmt.Errorf("%d: %v", i, err)
 		}
 		policyName := prefixName + "_" + rule.Name
+		if _, ok := policies[policyName]; ok {
+			return nil, fmt.Errorf(`%d: "name" %q is duplicated`, i, rule.Name)
+		}
 		policies[policyName] = &v3rbacpb.Policy{
 			Principals:  []*v3rbacpb.Principal{parsePeer(rule.Source)},
 			Permissions: []*v3rbacpb.Permission{permission},
diff --git a/authz/rbac_translator_test.go b/authz/rbac_translator_test.go
index 0de0d503252e..90d741d391dc 100644
--- a/authz/rbac_translator_test.go
+++ b/authz/rbac_translator_test.go
@@ -948,6 +948,30 @@ func TestTranslatePolicy(t *testing.T) {
 			}`,
 			wantErr: `"allow_rules" 0: "headers" 0: unsupported "key" :method`,
 		},
+		"duplicate deny rule name": {
+			authzPolicy: `{
+				"name": "authz",
+				"deny_rules": [
+					{"name": "block", "request": {"paths": ["/admin.Admin/*"]}},
+					{"name": "block", "request": {"paths": ["/debug.Debug/*"]}}
+				],
+				"allow_rules": [{
+					"name": "allow_policy_1",
+					"request": {"paths": ["*"]}
+				}]
+			}`,
+			wantErr: `"deny_rules" 1: "name" "block" is duplicated`,
+		},
+		"duplicate allow rule name": {
+			authzPolicy: `{
+				"name": "authz",
+				"allow_rules": [
+					{"name": "allow_policy_1", "request": {"paths": ["/foo.Foo/*"]}},
+					{"name": "allow_policy_1", "request": {"paths": ["/bar.Bar/*"]}}
+				]
+			}`,
+			wantErr: `"allow_rules" 1: "name" "allow_policy_1" is duplicated`,
+		},
 		"bad audit condition": {
 			authzPolicy: `{
 				"name": "authz",