Accept both PDP token audiences while preserving caller bindings

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

cmd/access-engine/runtime_rename_test.go

@@ -0,0 +1,131 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/netkingdom/access-engine/internal/callerauth"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/pkg/api"
+	"gopkg.in/yaml.v3"
+)
+
+// The packages name their protected consumer, not the PDP. Authenticate both
+// PDP audiences against exactly the installed mapping, then compare real engine
+// outcomes and canonical request bindings with the unchanged package baseline.
+func TestRuntimeRenamePinPackagesPreserveDecisionMaterial(t *testing.T) {
+	for _, pin := range []string{"ops-warden", "ops-warden-fetch", "secrets-engine", "user-engine", "tenant-engine", "informed-decision-lifecycle", "informed-decision-sitting", "informed-decision-t03"} {
+		t.Run(pin, func(t *testing.T) {
+			raw, err := os.ReadFile(filepath.Join("..", "..", "values", pin+".yaml"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var values struct {
+				Args       []string `yaml:"args"`
+				CallerAuth struct {
+					Binding string   `yaml:"binding"`
+					Extra   []string `yaml:"extraBindings"`
+				} `yaml:"callerAuth"`
+			}
+			if err := yaml.Unmarshal(raw, &values); err != nil {
+				t.Fatal(err)
+			}
+			bindings := map[string]string{}
+			for _, entry := range append([]string{values.CallerAuth.Binding}, values.CallerAuth.Extra...) {
+				system, principal, ok := strings.Cut(entry, "=")
+				if !ok {
+					t.Fatalf("bad mapping: %s", entry)
+				}
+				bindings[system] = principal
+			}
+			paths := map[string]string{}
+			for i := 0; i+1 < len(values.Args); i++ {
+				if values.Args[i] == "--registry" || values.Args[i] == "--policy" {
+					paths[values.Args[i]] = filepath.Join("..", "..", strings.TrimPrefix(values.Args[i+1], "/opt/flex-auth/"))
+				}
+			}
+			pkg, err := policy.LoadFile(paths["--policy"])
+			if err != nil {
+				t.Fatal(err)
+			}
+			engine, err := buildEngine(context.Background(), paths["--registry"], paths["--policy"], "")
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(pkg.Fixtures) == 0 {
+				t.Fatal("package has no decision fixtures")
+			}
+			exercised := 0
+			for _, fixture := range pkg.Fixtures {
+				principal, installed := bindings[fixture.Request.Resource.System]
+				if !installed {
+					continue
+				}
+				baseline, err := engine.Check(context.Background(), fixture.Request)
+				if err != nil {
+					t.Fatalf("baseline %s: %v", fixture.ID, err)
+				}
+				original := api.CanonicalDigest(fixture.Request)
+				for _, audience := range []string{"flex-auth", "access-engine"} {
+					a, err := callerauth.New(callerauth.ModeEnforce, fixedTokenReviewer{identity: callerauth.Identity{Username: principal, Audiences: []string{audience}}}, "flex-auth", bindings, nil)
+					if err != nil {
+						t.Fatal(err)
+					}
+					identity, err := a.Authorize(context.Background(), "Bearer test-token", []string{fixture.Request.Resource.System})
+					if err != nil {
+						t.Fatal(err)
+					}
+					got, err := engine.Check(callerauth.WithRecord(context.Background(), a.Record(identity)), fixture.Request)
+					if err != nil {
+						t.Fatalf("%s/%s: %v", fixture.ID, audience, err)
+					}
+					if got.Effect != baseline.Effect || got.Reason != baseline.Reason || got.Binding.RequestDigest != baseline.Binding.RequestDigest {
+						t.Fatalf("%s/%s decision material changed", fixture.ID, audience)
+					}
+					if got.Provenance.Caller.Audience != audience {
+						t.Fatal("requested audience spelling lost")
+					}
+					if got.Resource.System != fixture.Request.Resource.System || got.Binding.Resource.System != fixture.Request.Resource.System {
+						t.Fatal("resource.system spelling changed")
+					}
+					if api.CanonicalDigest(fixture.Request) != original {
+						t.Fatal("original request silently rewritten")
+					}
+				}
+				exercised++
+			}
+			if exercised == 0 {
+				t.Fatal("no installed-system fixtures exercised")
+			}
+			t.Logf("%d owner-installed package fixtures preserved with both audiences", exercised)
+		})
+	}
+}
+
+func TestRuntimeRenameReadbackRoutesPreserveCallerBoundary(t *testing.T) {
+	for _, audience := range []string{"flex-auth", "access-engine"} {
+		for _, principal := range []string{readbackPrincipal, "system:serviceaccount:other:caller"} {
+			a, err := callerauth.New(callerauth.ModeEnforce, fixedTokenReviewer{identity: callerauth.Identity{Username: principal, Audiences: []string{audience}}}, "flex-auth", map[string]string{readbackBinding: readbackPrincipal}, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			server := httptest.NewServer(newReadbackMux(newTestReadback(t), a))
+			valid, _ := json.Marshal(subjectRequest("user:alice", true, "demo-app"))
+			got := postReadback(t, server.URL, string(valid)).StatusCode
+			server.Close()
+			want := http.StatusForbidden
+			if principal == readbackPrincipal {
+				want = http.StatusOK
+			}
+			if got != want {
+				t.Fatalf("%s/%s: status %d want %d", audience, principal, got, want)
+			}
+		}
+	}
+}