Fix selective logic.

Author: inelpandzic

sel/sel.go

@@ -22,38 +22,32 @@ func MakeFilter(include, exclude []string) NSFilter {
 
 	return func(db, coll string) bool {
 		_, dbIncluded := includeFilter[db]
-		_, dbExcluded := excludeFilter[db]
 
 		nsIncluded := len(includeFilter) > 0 && includeFilter.Has(db, coll)
 		nsExcluded := len(excludeFilter) > 0 && excludeFilter.Has(db, coll)
 
-		if nsIncluded && dbIncluded && !nsExcluded {
-			// If the namespace is included, it is allowed.
-			// Also make sure that the namespace is not excluded,
-			// because exclusion takes precedence.
-			return true
-		}
-
-		if dbIncluded && !nsExcluded {
-			// If the database is included in the filter,
-			// but the namespace is not included, it is not allowed.
-			// Also make sure that the namespace is not excluded,
-			// because exclusion takes precedence.
+		// Exclusion takes precedence - if explicitly excluded, deny immediately.
+		if nsExcluded {
 			return false
 		}
 
-		if nsExcluded && dbExcluded {
-			// If the namespace is excluded, it is not allowed.
+		// If include filter exists, use whitelist logic (deny by default).
+		if len(includeFilter) > 0 {
+			// Allow if namespace is explicitly included.
+			if nsIncluded {
+				return true
+			}
+			// DB is in include filter but collection is not - deny.
+			if dbIncluded {
+				return false
+			}
+			// DB not in include filter at all - deny.
 			return false
 		}
 
-		if dbExcluded {
-			// If the database is included in the filter,
-			// but the namespace is not excluded, it is allowed.
-			return true
-		}
+		// No include filter (exclude-only or no filters).
+		// Allow by default since exclusions are already handled above.
 
-		// If the namespace is not present in either filter, it is allowed by default.
 		return true
 	}
 }

sel/sel_test.go

@@ -285,9 +285,9 @@ func TestFilter(t *testing.T) {
 				"coll_2": false,
 			},
 			"db_3": {
-				"coll_0": true,
+				"coll_0": false,
 				"coll_1": false,
-				"coll_2": true,
+				"coll_2": false,
 			},
 		}