Prepare closed service task execution input and policy contract

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

internal/policy/service_task_execution_test.go

@@ -0,0 +1,69 @@
+package policy_test
+
+import (
+	"context"
+	"encoding/json"
+	"github.com/netkingdom/access-engine/internal/policy"
+	"github.com/netkingdom/access-engine/pkg/api"
+	"github.com/open-policy-agent/opa/rego"
+	"os/exec"
+	"path/filepath"
+	"testing"
+)
+
+func TestServiceTaskExecutionSourcePredicateAndHardRefusal(t *testing.T) {
+	p, e := policy.LoadAndValidateFile(context.Background(), filepath.Join("..", "..", "examples", "secrets-engine-service-task-execution", "policy_package.md"))
+	if e != nil || !p.Valid {
+		t.Fatalf("package %v %+v", e, p.Validation)
+	}
+	out, e := exec.Command("/home/worsch/secrets-engine/.venv/bin/python", "../../tools/service_task_execution_fixture.py").Output()
+	if e != nil {
+		t.Fatal("actual Secrets descriptor generator", e)
+	}
+	var f struct {
+		Request api.CheckRequest `json:"request"`
+	}
+	if json.Unmarshal(out, &f) != nil {
+		t.Fatal("fixture")
+	}
+	candidate := func(r api.CheckRequest) bool {
+		b, _ := json.Marshal(r)
+		var input map[string]any
+		json.Unmarshal(b, &input)
+		result, e := rego.New(rego.Query("data.flexauth.secrets_engine.service_task_execution.candidate_matches"), rego.Module("candidate.rego", p.RegoModule), rego.Input(input)).Eval(context.Background())
+		if e != nil {
+			t.Fatal(e)
+		}
+		return len(result) > 0
+	}
+	if !candidate(f.Request) {
+		t.Fatal("supported synthetic service contract failed predicate")
+	}
+	d, e := p.Evaluate(context.Background(), f.Request)
+	if e != nil || d.Effect != api.DecisionEffectDeny || d.Reason != "service_execution_integration_unadmitted" {
+		t.Fatal("unintegrated source package opened")
+	}
+	cases := map[string]func(*api.CheckRequest){"human": func(r *api.CheckRequest) { r.Subject.Type = "human" }, "foreigntenant": func(r *api.CheckRequest) { r.Tenant = "tenant:coulomb" }, "apply": func(r *api.CheckRequest) { r.Action = "apply" }, "servicecaller": func(r *api.CheckRequest) {
+		r.Context["service_actor_binding"].(map[string]any)["transport_principal"] = "another"
+	}, "missing human control": func(r *api.CheckRequest) {
+		r.Context["approval"].(map[string]any)["binding"].(map[string]any)["human_control"] = false
+	}, "consumed": func(r *api.CheckRequest) { r.Context["approval"].(map[string]any)["consumed"] = true }, "PDP digest": func(r *api.CheckRequest) {
+		r.Context["approval"].(map[string]any)["binding"].(map[string]any)["pdp_digest"] = ""
+	}, "expired observation": func(r *api.CheckRequest) {
+		r.Context["approval"].(map[string]any)["freshness"].(map[string]any)["not_after"] = "2000-01-01T00:00:00Z"
+	}, "wrong operation": func(r *api.CheckRequest) {
+		r.Context["execution_contract"].(map[string]any)["operation"] = "generic-apply"
+	}}
+	for name, mutate := range cases {
+		t.Run(name, func(t *testing.T) {
+			var f struct {
+				Request api.CheckRequest `json:"request"`
+			}
+			json.Unmarshal(out, &f)
+			mutate(&f.Request)
+			if candidate(f.Request) {
+				t.Fatal("unsupported source contract matched")
+			}
+		})
+	}
+}