Use the correct Permit API Instead of CloudPDP API

pkg/api/api.go

@@ -175,9 +175,18 @@ func NewFactsClientConfig(config *config.PermitConfig) *openapi.Configuration {
 
 func NewPermitApiClient(config *config.PermitConfig) *PermitApiClient {
 	baseClientConfig := NewClientConfig(config)
-	factsClientConfig := NewFactsClientConfig(config)
 	client := openapi.NewAPIClient(baseClientConfig)
-	factsClient := openapi.NewAPIClient(factsClientConfig)
+
+	// Deprecated: factsClient was previously always using PDP URL for facts APIs,
+	// which caused issues when proxyFactsViaPDP was false (the default).
+	// Now factsClient defaults to the regular client (API URL) and only uses
+	// PDP URL when proxyFactsViaPDP is explicitly enabled.
+	factsClient := client
+	if config.GetProxyFactsViaPDP() {
+		factsClientConfig := NewFactsClientConfig(config)
+		factsClient = openapi.NewAPIClient(factsClientConfig)
+	}
+
 	return &PermitApiClient{
 		config:               config,
 		logger:               config.Logger,

pkg/config/config.go

@@ -39,6 +39,7 @@ type IPermitConfig interface {
 	GetDebug() bool
 	GetContext() *PermitContext
 	GetLogger() *zap.Logger
+	// Deprecated: GetProxyFactsViaPDP will be removed in future versions.
 	GetProxyFactsViaPDP() bool
 	GetFactsSyncTimeout() *time.Duration
 	GetFactsSyncTimeoutPolicy() FactsSyncTimeoutPolicy