fix(authz): respect `max_rules` when updating rules of an client/user

apps/emqx_auth_mnesia/src/emqx_authz_api_mnesia.erl

@@ -555,8 +555,20 @@ user(put, #{
     bindings := #{username := Username},
     body := #{<<"username">> := Username, <<"rules">> := Rules}
 }) ->
-    emqx_authz_mnesia:store_rules({username, Username}, Rules),
-    {204};
+    case ensure_rules_len(Rules) of
+        ok ->
+            emqx_authz_mnesia:store_rules({username, Username}, Rules),
+            {204};
+        {error, too_many_rules} ->
+            {400, #{
+                code => <<"BAD_REQUEST">>,
+                message =>
+                    binfmt(
+                        <<"The rules length exceeds the maximum limit.">>,
+                        []
+                    )
+            }}
+    end;
 user(delete, #{bindings := #{username := Username}}) ->
     case emqx_authz_mnesia:get_rules({username, Username}) of
         not_found ->
@@ -580,8 +592,20 @@ client(put, #{
     bindings := #{clientid := ClientID},
     body := #{<<"clientid">> := ClientID, <<"rules">> := Rules}
 }) ->
-    emqx_authz_mnesia:store_rules({clientid, ClientID}, Rules),
-    {204};
+    case ensure_rules_len(Rules) of
+        ok ->
+            emqx_authz_mnesia:store_rules({clientid, ClientID}, Rules),
+            {204};
+        {error, too_many_rules} ->
+            {400, #{
+                code => <<"BAD_REQUEST">>,
+                message =>
+                    binfmt(
+                        <<"The rules length exceeds the maximum limit.">>,
+                        []
+                    )
+            }}
+    end;
 client(delete, #{bindings := #{clientid := ClientID}}) ->
     case emqx_authz_mnesia:get_rules({clientid, ClientID}) of
         not_found ->

apps/emqx_auth_mnesia/test/emqx_authz_api_mnesia_SUITE.erl

@@ -136,6 +136,16 @@ t_api(_) ->
             uri(["authorization", "sources", "built_in_database", "rules", "users", "user1"]),
             ?USERNAME_RULES_EXAMPLE#{rules => []}
         ),
+
+    %% check length limit
+
+    {ok, 400, _} =
+        request(
+            put,
+            uri(["authorization", "sources", "built_in_database", "rules", "users", "user1"]),
+            dup_rules_example2(?USERNAME_RULES_EXAMPLE)
+        ),
+
     {ok, 200, Request3} =
         request(
             get,
@@ -219,6 +229,16 @@ t_api(_) ->
             uri(["authorization", "sources", "built_in_database", "rules", "clients", "client1"]),
             ?CLIENTID_RULES_EXAMPLE#{rules => []}
         ),
+
+    {ok, 400, _} =
+        request(
+            put,
+            uri(["authorization", "sources", "built_in_database", "rules", "clients", "client1"]),
+            dup_rules_example2(
+                ?CLIENTID_RULES_EXAMPLE
+            )
+        ),
+
     {ok, 200, Request6} =
         request(
             get,
@@ -521,3 +541,6 @@ dup_rules_example(#{clientid := _, rules := Rules}) ->
     #{clientid => client2, rules => Rules ++ Rules};
 dup_rules_example(#{rules := Rules}) ->
     #{rules => Rules ++ Rules}.
+
+dup_rules_example2(#{rules := Rules} = Example) ->
+    Example#{rules := Rules ++ Rules}.

changes/ce/fix-13624.en.md

@@ -0,0 +1,2 @@
+Fixed an issue that when updating rules in the built-in authorizer for a client/user, the rules could exceed the `max_rules`.
+