Add an offline attribute-admission branch beside exact-record review.
Compact-sitting v8 can admit a new memo from carried class, submitter, and approval attributes, but shipped sets are empty and exact-record decisions stay on their pins. The sitting image pin is unchanged. Assistant: grok Assistant-Session: 01a10329-31cb-78d3-b7a3-788c2f91d6d4
This commit is contained in:
parent
d014453a1a
commit
e85f511c4f
8 changed files with 1237 additions and 10 deletions
303
examples/informed-decision-sitting/attribute_admission_v8.json
Normal file
303
examples/informed-decision-sitting/attribute_admission_v8.json
Normal file
|
|
@ -0,0 +1,303 @@
|
|||
{
|
||||
"policy_id": "informed-decision.compact-sitting",
|
||||
"policy_version": "v8",
|
||||
"note": "Offline request/response fixtures. Shipped admitted sets are empty, so attribute_eligible is not in this file. An allow here is an exact-record pin, not proof of a live approval.",
|
||||
"cases": [
|
||||
{
|
||||
"id": "exact-record-allow",
|
||||
"kind": "exact",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "allow", "reason": "operator_admitted_compact_sitting"},
|
||||
"request": {
|
||||
"id": "exact-record-allow",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {"id": "memo:infd-20260927-b02", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"memo_version": 1,
|
||||
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
|
||||
"approval_binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "exact-record-wrong-digest",
|
||||
"kind": "exact",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"},
|
||||
"request": {
|
||||
"id": "exact-record-wrong-digest",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {"id": "memo:infd-20260927-b02", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"memo_version": 1,
|
||||
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
|
||||
"approval_binding_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "exact-record-with-attribute-context",
|
||||
"kind": "attribute",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "allow", "reason": "operator_admitted_compact_sitting"},
|
||||
"request": {
|
||||
"id": "exact-record-with-attribute-context",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "read",
|
||||
"resource": {"id": "memo:infd-20260927-b02", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
|
||||
"approval_binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "exact-pin-mismatch-not-rescued",
|
||||
"kind": "attribute",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"},
|
||||
"request": {
|
||||
"id": "exact-pin-mismatch-not-rescued",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {"id": "memo:infd-20260927-b02", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
|
||||
"approval_binding_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-unknown-class",
|
||||
"kind": "attribute",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "deny", "reason": "unknown_class"},
|
||||
"request": {
|
||||
"id": "attribute-unknown-class",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "decline",
|
||||
"resource": {"id": "memo:intake-new-memo", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-stale-mfa",
|
||||
"kind": "attribute",
|
||||
"assurance": "stale",
|
||||
"expect": {"effect": "deny", "reason": "stale_mfa"},
|
||||
"request": {
|
||||
"id": "attribute-stale-mfa",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {"id": "memo:intake-new-memo", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": false,
|
||||
"memo_version": 1,
|
||||
"approval_id": "not-a-uuid",
|
||||
"approval_binding_digest": "sha256:wrong"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-review-group",
|
||||
"kind": "attribute",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "deny", "reason": "review_group_not_verified"},
|
||||
"request": {
|
||||
"id": "attribute-review-group",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["other-group"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "discuss",
|
||||
"resource": {"id": "memo:intake-new-memo", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 2,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-bad-memo-id",
|
||||
"kind": "attribute",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "deny", "reason": "resource_refused"},
|
||||
"request": {
|
||||
"id": "attribute-bad-memo-id",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "return",
|
||||
"resource": {"id": "memo:NO", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-list-stays-exact",
|
||||
"kind": "attribute",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"},
|
||||
"request": {
|
||||
"id": "attribute-list-stays-exact",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "list",
|
||||
"resource": {"id": "memo:intake-new-memo", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
140
examples/informed-decision-sitting/attribute_fixtures.json
Normal file
140
examples/informed-decision-sitting/attribute_fixtures.json
Normal file
|
|
@ -0,0 +1,140 @@
|
|||
[
|
||||
{
|
||||
"id": "attribute-non-human-refused",
|
||||
"request": {
|
||||
"id": "attribute-non-human",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "not-a-person",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {
|
||||
"level": "aal2",
|
||||
"mfa": true,
|
||||
"source": "key-cape",
|
||||
"methods": ["pwd", "otp"],
|
||||
"at": 1
|
||||
}
|
||||
}
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {
|
||||
"id": "memo:intake-new-memo",
|
||||
"type": "decision-memo",
|
||||
"system": "informed-decision",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
},
|
||||
"expect": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-stale-mfa",
|
||||
"request": {
|
||||
"id": "attribute-stale-mfa",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "test-human",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {
|
||||
"level": "aal2",
|
||||
"mfa": true,
|
||||
"source": "key-cape",
|
||||
"methods": ["pwd", "otp"],
|
||||
"at": 1
|
||||
}
|
||||
}
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {
|
||||
"id": "memo:intake-new-memo",
|
||||
"type": "decision-memo",
|
||||
"system": "informed-decision",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
},
|
||||
"expect": {
|
||||
"effect": "deny",
|
||||
"reason": "stale_mfa"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-future-mfa",
|
||||
"request": {
|
||||
"id": "attribute-future-mfa",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "test-human",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {
|
||||
"level": "aal2",
|
||||
"mfa": true,
|
||||
"source": "key-cape",
|
||||
"methods": ["pwd", "otp"],
|
||||
"at": 9999999999
|
||||
}
|
||||
}
|
||||
},
|
||||
"action": "read",
|
||||
"resource": {
|
||||
"id": "memo:intake-new-memo",
|
||||
"type": "decision-memo",
|
||||
"system": "informed-decision",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
},
|
||||
"expect": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
}
|
||||
}
|
||||
]
|
||||
|
|
@ -2,13 +2,13 @@
|
|||
id: informed-decision.compact-sitting
|
||||
name: Compact sitting exact-record human review
|
||||
namespace: informed-decision:decision-memo
|
||||
version: v7
|
||||
version: v8
|
||||
status: ready
|
||||
package: flexauth.informed_decision.compact_sitting
|
||||
allow_ttl: 30s
|
||||
actions: [read, acknowledge, accept, return, discuss, decline, list]
|
||||
owner: flex-auth
|
||||
fixtures: [fixtures.json]
|
||||
fixtures: [fixtures.json, attribute_fixtures.json]
|
||||
caring:
|
||||
profile: caring-0.4.0-rc2
|
||||
enforce: false
|
||||
|
|
@ -64,6 +64,28 @@ v7 (2026-10-03, INFD-WP-ADHOC-2026-10-03-T02) adds the exact
|
|||
from informed-decision `docs/evidence/2026-10-03-provisioning-window-approval-create.json`.
|
||||
Existing records and identity requirements are preserved.
|
||||
|
||||
v8 (2026-10-03, offline attribute admission) adds one branch beside those
|
||||
exact-record rules. It is not the deployed sitting pin. Requests whose
|
||||
resource id is in `records` or `listable` still take only the exact-record
|
||||
rules, including when they also carry attribute fields, so an exact-record
|
||||
decision does not change. `list` stays on the exact-record rule.
|
||||
|
||||
The attribute branch may allow `read`, `acknowledge`, `accept`, `return`,
|
||||
`discuss` and `decline` for any other memo id. `attribute_eligible` is
|
||||
eligibility only. It checks that the carried approval id is a UUID and the
|
||||
carried digest matches `sha256:` plus 64 lowercase hex digits. It does not
|
||||
read an approval and it does not prove the memo pin. The effect owner still
|
||||
reads the approval live and compares that id and the engine's native digest
|
||||
with the memo. `approval_human_control` must be boolean true. No presentation
|
||||
hash is read. Context fields are `review_group`, `memo_class`,
|
||||
`intake_submitter`, `approval_requester`, `approval_human_control`,
|
||||
`memo_version`, `approval_id` and `approval_binding_digest`.
|
||||
|
||||
`admitted_submitters` and `admitted_classes` are generated from
|
||||
informed-decision `deploy/intake-submitters.json`. The shipped registry is
|
||||
empty, so both sets are empty and this branch admits nobody. Regenerate with
|
||||
`python3 tools/gen_informed_decision_admission.py`; `--check` reports drift.
|
||||
|
||||
The identity bar matches T03: authenticated informed-decision caller,
|
||||
`net-kingdom-admins`, fresh KeyCape AAL2 MFA. No permission follows from
|
||||
memo content or presentation state. TokenReview must admit
|
||||
|
|
@ -172,6 +194,103 @@ listable := object.union(
|
|||
list_only_records,
|
||||
)
|
||||
|
||||
# BEGIN GENERATED admitted_sets (tools/gen_informed_decision_admission.py; do not edit by hand)
|
||||
admitted_submitters := set()
|
||||
|
||||
admitted_classes := set()
|
||||
# END GENERATED admitted_sets
|
||||
|
||||
exact_id if {
|
||||
id := object.get(object.get(input, "resource", {}), "id", "")
|
||||
listable[id]
|
||||
}
|
||||
|
||||
attribute_attempt if {
|
||||
not exact_id
|
||||
input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
|
||||
ctx := object.get(input, "context", {})
|
||||
some key in {"review_group", "memo_class", "intake_submitter", "approval_requester", "approval_human_control"}
|
||||
object.get(ctx, key, null) != null
|
||||
}
|
||||
|
||||
identity_core if {
|
||||
input.tenant == "tenant:platform"
|
||||
input.subject.tenant == "tenant:platform"
|
||||
input.subject.type == "human"
|
||||
is_string(input.subject.id)
|
||||
input.subject.id != ""
|
||||
input.subject.attributes.principal_type_source == "authentication-derived"
|
||||
input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"}
|
||||
assurance := input.subject.attributes.assurance
|
||||
assurance.level == "aal2"
|
||||
assurance.mfa == true
|
||||
assurance.source == "key-cape"
|
||||
assurance.methods == ["pwd", "otp"]
|
||||
is_number(assurance.at)
|
||||
assurance.at > 0
|
||||
}
|
||||
|
||||
mfa_fresh if {
|
||||
identity_core
|
||||
age := time.now_ns() / 1000000000 - input.subject.attributes.assurance.at
|
||||
age >= -30
|
||||
age <= 900
|
||||
}
|
||||
|
||||
stale_mfa if {
|
||||
identity_core
|
||||
age := time.now_ns() / 1000000000 - input.subject.attributes.assurance.at
|
||||
age > 900
|
||||
}
|
||||
|
||||
resource_ok if {
|
||||
input.resource.tenant == "tenant:platform"
|
||||
input.resource.system == "informed-decision"
|
||||
input.resource.type == "decision-memo"
|
||||
is_string(input.resource.id)
|
||||
regex.match(`^memo:[a-z0-9][a-z0-9-]{2,62}$`, input.resource.id)
|
||||
}
|
||||
|
||||
review_group_ok if {
|
||||
group := input.context.review_group
|
||||
is_string(group)
|
||||
group != ""
|
||||
group in input.subject.attributes.groups
|
||||
}
|
||||
|
||||
class_ok if {
|
||||
is_string(input.context.memo_class)
|
||||
input.context.memo_class in admitted_classes
|
||||
}
|
||||
|
||||
submitter_ok if {
|
||||
is_string(input.context.intake_submitter)
|
||||
input.context.intake_submitter in admitted_submitters
|
||||
}
|
||||
|
||||
requester_ok if {
|
||||
input.context.approval_requester == "informed-decision"
|
||||
}
|
||||
|
||||
human_control_ok if {
|
||||
input.context.approval_human_control == true
|
||||
}
|
||||
|
||||
approval_id_ok if {
|
||||
is_string(input.context.approval_id)
|
||||
regex.match(`^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`, input.context.approval_id)
|
||||
}
|
||||
|
||||
digest_ok if {
|
||||
is_string(input.context.approval_binding_digest)
|
||||
regex.match(`^sha256:[0-9a-f]{64}$`, input.context.approval_binding_digest)
|
||||
}
|
||||
|
||||
version_ok if {
|
||||
is_number(input.context.memo_version)
|
||||
input.context.memo_version >= 1
|
||||
}
|
||||
|
||||
decision := {"effect": "allow", "reason": "operator_admitted_compact_sitting"} if {
|
||||
input.tenant == "tenant:platform"
|
||||
input.subject.tenant == "tenant:platform"
|
||||
|
|
@ -226,6 +345,54 @@ decision := {"effect": "allow", "reason": "operator_admitted_compact_sitting"} i
|
|||
input.context.memo_version == record.memo_version
|
||||
input.context.approval_id == record.approval_id
|
||||
input.context.approval_binding_digest == record.binding_digest
|
||||
} else := {"effect": "allow", "reason": "attribute_eligible"} if {
|
||||
attribute_attempt
|
||||
mfa_fresh
|
||||
resource_ok
|
||||
review_group_ok
|
||||
class_ok
|
||||
submitter_ok
|
||||
requester_ok
|
||||
human_control_ok
|
||||
approval_id_ok
|
||||
digest_ok
|
||||
version_ok
|
||||
} else := {"effect": "deny", "reason": "identity_refused"} if {
|
||||
attribute_attempt
|
||||
not identity_core
|
||||
} else := {"effect": "deny", "reason": "stale_mfa"} if {
|
||||
attribute_attempt
|
||||
stale_mfa
|
||||
} else := {"effect": "deny", "reason": "identity_refused"} if {
|
||||
attribute_attempt
|
||||
not mfa_fresh
|
||||
} else := {"effect": "deny", "reason": "resource_refused"} if {
|
||||
attribute_attempt
|
||||
not resource_ok
|
||||
} else := {"effect": "deny", "reason": "review_group_not_verified"} if {
|
||||
attribute_attempt
|
||||
not review_group_ok
|
||||
} else := {"effect": "deny", "reason": "unknown_class"} if {
|
||||
attribute_attempt
|
||||
not class_ok
|
||||
} else := {"effect": "deny", "reason": "unknown_submitter"} if {
|
||||
attribute_attempt
|
||||
not submitter_ok
|
||||
} else := {"effect": "deny", "reason": "requester_mismatch"} if {
|
||||
attribute_attempt
|
||||
not requester_ok
|
||||
} else := {"effect": "deny", "reason": "human_control_false"} if {
|
||||
attribute_attempt
|
||||
not human_control_ok
|
||||
} else := {"effect": "deny", "reason": "approval_id_malformed"} if {
|
||||
attribute_attempt
|
||||
not approval_id_ok
|
||||
} else := {"effect": "deny", "reason": "digest_mismatch"} if {
|
||||
attribute_attempt
|
||||
not digest_ok
|
||||
} else := {"effect": "deny", "reason": "memo_version_refused"} if {
|
||||
attribute_attempt
|
||||
not version_ok
|
||||
} else := {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"} if {
|
||||
true
|
||||
}
|
||||
|
|
@ -297,4 +464,153 @@ test_six_exact_metered_memos_allow_human_review if {
|
|||
}
|
||||
}
|
||||
|
||||
attribute_input := {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {"id": "test-human", "type": "human", "tenant": "tenant:platform",
|
||||
"attributes": {"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied", "groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape",
|
||||
"methods": ["pwd", "otp"], "at": time.now_ns() / 1000000000}}},
|
||||
"resource": {"tenant": "tenant:platform", "system": "informed-decision",
|
||||
"type": "decision-memo", "id": "memo:intake-new-memo"},
|
||||
"action": "accept",
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
}
|
||||
|
||||
patched_context(req, patch) := object.union(req, {"context": object.union(req.context, patch)})
|
||||
|
||||
with_at(req, at) := object.union(req, {"subject": object.union(req.subject, {"attributes": object.union(req.subject.attributes, {"assurance": object.union(req.subject.attributes.assurance, {"at": at})})})})
|
||||
|
||||
eligible(req) := result if {
|
||||
result := compact_sitting.decision with input as req
|
||||
with data.flexauth.informed_decision.compact_sitting.admitted_classes as {"credential-lane"}
|
||||
with data.flexauth.informed_decision.compact_sitting.admitted_submitters as {"state-hub"}
|
||||
}
|
||||
|
||||
classes_only(req) := result if {
|
||||
result := compact_sitting.decision with input as req
|
||||
with data.flexauth.informed_decision.compact_sitting.admitted_classes as {"credential-lane"}
|
||||
}
|
||||
|
||||
test_shipped_sets_admit_nobody if {
|
||||
count(compact_sitting.admitted_classes) == 0
|
||||
count(compact_sitting.admitted_submitters) == 0
|
||||
compact_sitting.decision.reason == "unknown_class" with input as attribute_input
|
||||
}
|
||||
|
||||
test_attribute_acts_are_eligible_only_when_sets_admit if {
|
||||
every action in ["read", "acknowledge", "accept", "return", "discuss", "decline"] {
|
||||
eligible(object.union(attribute_input, {"action": action})).reason == "attribute_eligible"
|
||||
}
|
||||
}
|
||||
|
||||
test_allow_does_not_prove_the_pin if {
|
||||
other := "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
|
||||
attribute_input.context.approval_binding_digest != other
|
||||
eligible(attribute_input).reason == "attribute_eligible"
|
||||
eligible(patched_context(attribute_input, {"approval_binding_digest": other})).reason == "attribute_eligible"
|
||||
}
|
||||
|
||||
test_unknown_class if {
|
||||
eligible(patched_context(attribute_input, {"memo_class": "not-a-class"})).reason == "unknown_class"
|
||||
}
|
||||
|
||||
test_unknown_submitter if {
|
||||
classes_only(attribute_input).reason == "unknown_submitter"
|
||||
}
|
||||
|
||||
test_requester_mismatch if {
|
||||
eligible(patched_context(attribute_input, {"approval_requester": "other-service"})).reason == "requester_mismatch"
|
||||
}
|
||||
|
||||
test_human_control_false if {
|
||||
eligible(patched_context(attribute_input, {"approval_human_control": false})).reason == "human_control_false"
|
||||
eligible(patched_context(attribute_input, {"approval_human_control": "true"})).reason == "human_control_false"
|
||||
}
|
||||
|
||||
test_digest_mismatch if {
|
||||
eligible(patched_context(attribute_input, {"approval_binding_digest": "sha256:wrong"})).reason == "digest_mismatch"
|
||||
eligible(patched_context(attribute_input, {"approval_binding_digest": "sha256:C8A1A9C8FB22616E3AACFB877BA7974FEB5EEDAED491F856A6C90719C502EBE4"})).reason == "digest_mismatch"
|
||||
}
|
||||
|
||||
test_approval_id_malformed if {
|
||||
eligible(patched_context(attribute_input, {"approval_id": "not-a-uuid"})).reason == "approval_id_malformed"
|
||||
}
|
||||
|
||||
test_memo_version_refused if {
|
||||
eligible(patched_context(attribute_input, {"memo_version": 0})).reason == "memo_version_refused"
|
||||
}
|
||||
|
||||
test_stale_mfa_on_attribute_branch if {
|
||||
eligible(with_at(attribute_input, time.now_ns() / 1000000000 - 901)).reason == "stale_mfa"
|
||||
}
|
||||
|
||||
test_future_mfa_is_identity_refused if {
|
||||
eligible(with_at(attribute_input, time.now_ns() / 1000000000 + 300)).reason == "identity_refused"
|
||||
}
|
||||
|
||||
test_service_subject_is_identity_refused if {
|
||||
eligible(object.union(attribute_input, {"subject": object.union(attribute_input.subject, {"type": "service"})})).reason == "identity_refused"
|
||||
}
|
||||
|
||||
test_review_group_must_be_verified if {
|
||||
req := object.union(attribute_input, {"subject": object.union(attribute_input.subject, {"attributes": object.union(attribute_input.subject.attributes, {"groups": ["other-group"]})})})
|
||||
eligible(req).reason == "review_group_not_verified"
|
||||
}
|
||||
|
||||
test_memo_review_group_is_not_hardcoded if {
|
||||
req := object.union(attribute_input, {
|
||||
"subject": object.union(attribute_input.subject, {"attributes": object.union(attribute_input.subject.attributes, {"groups": ["cabinet-reviewers"]})}),
|
||||
"context": object.union(attribute_input.context, {"review_group": "cabinet-reviewers"}),
|
||||
})
|
||||
eligible(req).reason == "attribute_eligible"
|
||||
}
|
||||
|
||||
test_bad_memo_id_refused if {
|
||||
eligible(object.union(attribute_input, {"resource": object.union(attribute_input.resource, {"id": "memo:NO"})})).reason == "resource_refused"
|
||||
}
|
||||
|
||||
test_list_does_not_use_attribute_admission if {
|
||||
got := eligible(object.union(attribute_input, {"action": "list"}))
|
||||
got.effect == "deny"
|
||||
got.reason == "compact_sitting_scope_or_identity_refused"
|
||||
}
|
||||
|
||||
test_exact_record_ignores_attribute_context if {
|
||||
req := object.union(tool_proof_input, {"context": object.union(tool_proof_input.context, {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"view_hash": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
|
||||
})})
|
||||
got := compact_sitting.decision with input as req
|
||||
got.effect == "allow"
|
||||
got.reason == "operator_admitted_compact_sitting"
|
||||
}
|
||||
|
||||
test_exact_pin_mismatch_is_not_rescued if {
|
||||
req := object.union(tool_proof_input, {"context": object.union(tool_proof_input.context, {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"approval_binding_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
})})
|
||||
got := eligible(req)
|
||||
got.effect == "deny"
|
||||
got.reason == "compact_sitting_scope_or_identity_refused"
|
||||
}
|
||||
|
||||
```
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue