Is this a support request?

• This is not a support request

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

This policy loads fine with Headscale 0.25 (user1 has to exist as user):

{
  "acls": [
    {
      "action": "accept",
      "src": [
        "user1"
      ],
      "dst": [
        "user1:*"
      ]
    },
    {
      "action": "accept",
      "src": [
        "user1"
      ],
      "dst": [
        "autogroup:internet:*"
      ]
    }
  ]
}

When loading the same policy with 586a20f and HEADSCALE_EXPERIMENTAL_POLICY_V2=1 it also loads without error/warning. The policy is no longer valid as user1 does no longer exist (and policy was not updated to user1@).

Expected Behavior

Error out on loading the policy as user1 can no longer be used to refer to a user and no entry in the hosts section exists that could match otherwise.

Steps To Reproduce

Load the above policy with policy v2 enabled (HEADSCALE_EXPERIMENTAL_POLICY_V2=1 )

Environment

- OS: Debian 12
- Headscale version: 586a20fbff4e97519d68a7fdd0d75e1c7decec30
- Tailscale version: -

Runtime environment

• Headscale is behind a (reverse) proxy
• Headscale runs in a container

Anything else?

No response