coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Publish reviewed exact task execution PDP binding contract
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m33s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 15:03:03 +02:00
parent f30e08cc96
commit 7ad8dec85e
5 changed files with 286 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

25
internal/policy/secrets_execution_gap_test.go Normal file
View file

@ -0,0 +1,25 @@
package policy_test
import (
"context"
"path/filepath"
"testing"
"github.com/netkingdom/access-engine/internal/policy"
"github.com/netkingdom/access-engine/pkg/api"
)
func TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal(t *testing.T) {
pkg,err:=policy.LoadAndValidateFile(context.Background(),filepath.Join("..","..","examples","secrets-engine","policy_package.md"))
if err!=nil || !pkg.Valid {t.Fatalf("policy load: %v",err)}
r:=api.CheckRequest{Tenant:"tenant:platform",Subject:api.SubjectRef{ID:"secrets-engine",Type:"service"},Action:"execute-ccr",Resource:api.ResourceRef{ID:"catalog:test",Type:"secret-catalog-lane",System:"secrets-engine"},Context:map[string]any{"execution_contract":map[string]any{"operation":"metadata-apply-ccr"}}}
result,err:=pkg.Evaluate(context.Background(),r)
if err!=nil || result.Effect!=api.DecisionEffectDeny || result.Reason!="unknown_action" {t.Fatalf("new action: %+v %v",result,err)}
// Existing apply ignores execution_contract content; its allow is not exact task authority.
r.Action="apply"
r.Context["execution_contract"]=map[string]any{"operation":"arbitrary-mutation","payload_sha256":"forged"}
result,err=pkg.Evaluate(context.Background(),r)
if err!=nil || result.Effect!=api.DecisionEffectAllow {t.Fatalf("existing apply gap characterization: %+v %v",result,err)}
r.Subject=api.SubjectRef{ID:"founder-unregistered",Type:"human"}
result,err=pkg.Evaluate(context.Background(),r)
if err!=nil || result.Effect!=api.DecisionEffectDeny || result.Reason!="wrong_subject_type" {t.Fatalf("human principal: %+v %v",result,err)}
}