301 lines
7.6 KiB
YAML
301 lines
7.6 KiB
YAML
|
- id: fixture:ops-warden-fetch-allow-forgejo-admin-api-token
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-forgejo-admin-api-token
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:forgejo-admin-api-token
|
||
|
|
type: secret
|
||
|
|
system: railiance-platform
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: forgejo-admin-api-token
|
||
|
|
owner_repo: railiance-platform
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: allow
|
||
|
|
reason: secret_read_lane_matched
|
||
|
|
- id: fixture:ops-warden-fetch-allow-openrouter-llm-connect
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-openrouter-llm-connect
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:openrouter-llm-connect
|
||
|
|
type: secret
|
||
|
|
system: railiance-platform
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: openrouter-llm-connect
|
||
|
|
owner_repo: railiance-platform
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: allow
|
||
|
|
reason: secret_read_lane_matched
|
||
|
|
- id: fixture:ops-warden-fetch-allow-rapp-qonto-keycape-client
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-rapp-qonto-keycape-client
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:rapp-qonto-keycape-client
|
||
|
|
type: secret
|
||
|
|
system: key-cape
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: rapp-qonto-keycape-client
|
||
|
|
owner_repo: key-cape
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: allow
|
||
|
|
reason: secret_read_lane_matched
|
||
|
|
- id: fixture:ops-warden-fetch-allow-domain-suffix
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-forgejo-admin-api-token
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:forgejo-admin-api-token/infotech
|
||
|
|
type: secret
|
||
|
|
system: railiance-platform
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: forgejo-admin-api-token
|
||
|
|
owner_repo: railiance-platform
|
||
|
|
domain: infotech
|
||
|
|
expect:
|
||
|
|
effect: allow
|
||
|
|
reason: secret_read_lane_matched
|
||
|
|
- id: fixture:ops-warden-fetch-deny-unknown-need
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-no-such-need
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:no-such-need
|
||
|
|
type: secret
|
||
|
|
system: railiance-platform
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: no-such-need
|
||
|
|
owner_repo: railiance-platform
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: deny
|
||
|
|
reason: unknown_need
|
||
|
|
- id: fixture:ops-warden-fetch-deny-not-exec-capable-need
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-net-kingdom-lldap-bind-credential
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:net-kingdom-lldap-bind-credential
|
||
|
|
type: secret
|
||
|
|
system: railiance-platform
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: net-kingdom-lldap-bind-credential
|
||
|
|
owner_repo: railiance-platform
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: deny
|
||
|
|
reason: unknown_need
|
||
|
|
- id: fixture:ops-warden-fetch-deny-login-lane-need
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-openbao-platform-admin-login
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:openbao-platform-admin-login
|
||
|
|
type: secret
|
||
|
|
system: railiance-platform
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: openbao-platform-admin-login
|
||
|
|
owner_repo: railiance-platform
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: deny
|
||
|
|
reason: unknown_need
|
||
|
|
- id: fixture:ops-warden-fetch-deny-wrong-system
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-forgejo-admin-api-token
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:forgejo-admin-api-token
|
||
|
|
type: secret
|
||
|
|
system: key-cape
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: forgejo-admin-api-token
|
||
|
|
owner_repo: key-cape
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: deny
|
||
|
|
reason: wrong_system
|
||
|
|
- id: fixture:ops-warden-fetch-deny-unknown-system
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-forgejo-admin-api-token
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:forgejo-admin-api-token
|
||
|
|
type: secret
|
||
|
|
system: secrets-engine
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: forgejo-admin-api-token
|
||
|
|
owner_repo: secrets-engine
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: deny
|
||
|
|
reason: unknown_system
|
||
|
|
- id: fixture:ops-warden-fetch-deny-non-secret-type
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-forgejo-admin-api-token
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:forgejo-admin-api-token
|
||
|
|
type: ssh-certificate
|
||
|
|
system: railiance-platform
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: forgejo-admin-api-token
|
||
|
|
owner_repo: railiance-platform
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: deny
|
||
|
|
reason: wrong_resource_type
|
||
|
|
- id: fixture:ops-warden-fetch-deny-wrong-action
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-forgejo-admin-api-token
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: write
|
||
|
|
resource:
|
||
|
|
id: secret:forgejo-admin-api-token
|
||
|
|
type: secret
|
||
|
|
system: railiance-platform
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: forgejo-admin-api-token
|
||
|
|
owner_repo: railiance-platform
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: deny
|
||
|
|
reason: wrong_action
|
||
|
|
- id: fixture:ops-warden-fetch-deny-wrong-tenant
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-forgejo-admin-api-token
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:acme
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:forgejo-admin-api-token
|
||
|
|
type: secret
|
||
|
|
system: railiance-platform
|
||
|
|
tenant: tenant:acme
|
||
|
|
context:
|
||
|
|
need_id: forgejo-admin-api-token
|
||
|
|
owner_repo: railiance-platform
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: deny
|
||
|
|
reason: wrong_tenant
|
||
|
|
- id: fixture:ops-warden-fetch-deny-wrong-subject-type
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-forgejo-admin-api-token
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: agt
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:forgejo-admin-api-token
|
||
|
|
type: secret
|
||
|
|
system: railiance-platform
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: forgejo-admin-api-token
|
||
|
|
owner_repo: railiance-platform
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: deny
|
||
|
|
reason: wrong_subject_type
|
||
|
|
- id: fixture:ops-warden-fetch-deny-resource-need-mismatch
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-forgejo-admin-api-token
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:openrouter-llm-connect
|
||
|
|
type: secret
|
||
|
|
system: railiance-platform
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: forgejo-admin-api-token
|
||
|
|
owner_repo: railiance-platform
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: deny
|
||
|
|
reason: resource_need_mismatch
|
||
|
|
- id: fixture:ops-warden-fetch-deny-owner-repo-mismatch
|
||
|
|
request:
|
||
|
|
id: check:ops-warden-fetch-forgejo-admin-api-token
|
||
|
|
subject:
|
||
|
|
id: operator
|
||
|
|
type: operator
|
||
|
|
tenant: tenant:platform
|
||
|
|
action: read
|
||
|
|
resource:
|
||
|
|
id: secret:forgejo-admin-api-token
|
||
|
|
type: secret
|
||
|
|
system: railiance-platform
|
||
|
|
tenant: tenant:platform
|
||
|
|
context:
|
||
|
|
need_id: forgejo-admin-api-token
|
||
|
|
owner_repo: key-cape
|
||
|
|
domain: null
|
||
|
|
expect:
|
||
|
|
effect: deny
|
||
|
|
reason: owner_repo_mismatch
|