From bb7038885502fabe8a8d1b08c3e48c9b237a037f Mon Sep 17 00:00:00 2001
From: Kory Draughn <korydraughn@renci.org>
Date: Tue, 15 Sep 2026 15:41:11 -0400
Subject: [PATCH 1/2] [#267] Do not allow other plugins to invoke
 register_regexes_from_array

This commit moves the register_regexes_from_array function into a nearby
anonymous namespace.
---
 src/main.cpp | 63 +++++++++++++++++++++++++---------------------------
 1 file changed, 30 insertions(+), 33 deletions(-)

diff --git a/src/main.cpp b/src/main.cpp
index 8d4f8be..329a9ea 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -118,44 +118,41 @@ namespace
 		// Reference counter for nested python operations
 		static thread_local uint64_t ts_thread_refct = 0;
 	} //namespace python_state
-}
 
-void register_regexes_from_array(const nlohmann::json& _array, const std::string& _instance_name)
-{
-	try {
-		for (const auto& elem : _array) {
-			try {
-				const auto& tmp = elem.get_ref<const std::string&>();
-				RuleExistsHelper::Instance()->registerRuleRegex(tmp);
-				// clang-format off
-				log_re::debug({
-					{"rule_engine_plugin", rule_engine_name},
-					{"instance_name", _instance_name},
-					{"regex", tmp},
-				});
-				// clang-format on
-			}
-			catch (const boost::bad_any_cast&) {
-				// clang-format off
-				log_re::error({
-					{"rule_engine_plugin", rule_engine_name},
-					{"instance_name", _instance_name},
-					{"log_message", "failed to cast pep_regex_to_match to string"},
-				});
-				// clang-format on
-				continue;
+	void register_regexes_from_array(const nlohmann::json& _array, const std::string& _instance_name)
+	{
+		try {
+			for (const auto& elem : _array) {
+				try {
+					const auto& tmp = elem.get_ref<const std::string&>();
+					RuleExistsHelper::Instance()->registerRuleRegex(tmp);
+					// clang-format off
+					log_re::debug({
+						{"rule_engine_plugin", rule_engine_name},
+						{"instance_name", _instance_name},
+						{"regex", tmp},
+					});
+					// clang-format on
+				}
+				catch (const boost::bad_any_cast&) {
+					// clang-format off
+					log_re::error({
+						{"rule_engine_plugin", rule_engine_name},
+						{"instance_name", _instance_name},
+						{"log_message", "failed to cast pep_regex_to_match to string"},
+					});
+					// clang-format on
+					continue;
+				}
 			}
 		}
+		catch (const boost::bad_any_cast&) {
+			std::stringstream msg;
+			msg << "[" << _instance_name << "] failed to any_cast a std::vector<boost::any>&";
+			THROW(INVALID_ANY_CAST, msg.str());
+		}
 	}
-	catch (const boost::bad_any_cast&) {
-		std::stringstream msg;
-		msg << "[" << _instance_name << "] failed to any_cast a std::vector<boost::any>&";
-		THROW(INVALID_ANY_CAST, msg.str());
-	}
-}
 
-namespace
-{
 	irods::error to_irods_error_object(const bp::object& object)
 	{
 		if (bp::extract<int> result{object}; result.check()) {

From 36c6d1911773ba13b3f3b4c1dfb1c9e7c200db01 Mon Sep 17 00:00:00 2001
From: Kory Draughn <korydraughn@renci.org>
Date: Fri, 18 Sep 2026 14:17:07 -0400
Subject: [PATCH 2/2] [#272] Mirror NREP's clearing of the rError stack for
 dynamic PEPs

---
 src/main.cpp | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/main.cpp b/src/main.cpp
index 329a9ea..bc94a59 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -23,17 +23,18 @@
 #include <boost/filesystem/operations.hpp>
 #pragma GCC diagnostic pop
 
-#include <irods/rodsErrorTable.h>
 #include <irods/irods_default_paths.hpp>
 #include <irods/irods_error.hpp>
 #include <irods/irods_logger.hpp>
+#include <irods/irods_ms_plugin.hpp>
 #include <irods/irods_re_plugin.hpp>
-#include <irods/irods_re_structs.hpp>
 #include <irods/irods_re_ruleexistshelper.hpp>
 #include <irods/irods_re_serialization.hpp>
-#include <irods/irods_ms_plugin.hpp>
+#include <irods/irods_re_structs.hpp>
 #include <irods/irods_server_properties.hpp>
 #include <irods/msParam.h>
+#include <irods/rodsError.h>
+#include <irods/rodsErrorTable.h>
 #include <irods/rsExecMyRule.hpp>
 
 #include "irods/private/re/python.hpp"
@@ -607,6 +608,17 @@ static irods::error exec_rule(const irods::default_re_ctx&,
                               std::list<boost::any>& rule_arguments_cpp,
                               irods::callback effect_handler)
 {
+	// Clear client-side errors for dynamic PEPs as we expect failures from the pre-PEPs to control
+	// access to operations. This comment and behavior come directly from the NREP.
+	irods::at_scope_exit clear_rerror_stack_for_dynamic_peps{[&rule_name, &effect_handler] {
+		if (rule_name.starts_with("pep_")) {
+			auto* rei = get_rei_from_effect_handler(effect_handler);
+			if (rei && rei->rsComm) {
+				freeRErrorContent(&rei->rsComm->rError);
+			}
+		}
+	}};
+
 	try {
 		std::lock_guard<std::recursive_mutex> lock{python_mutex};
 		python_thread_state_scope tstate;