From f758381cea9fbc0788ae6153e52e0a507a3501cf Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 15:29:00 +0200 Subject: [PATCH] FLEX-WP-0036: Go module is github.com/netkingdom/access-engine; T02 consumer inventory - module path renamed (no external importers); golangci local-prefixes - ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION replaces FLEX_AUTH_RUN_TOPAZ_INTEGRATION - README title and identity paragraph reflect the landed renames - docs/runtime-rename-inventory.md: per-consumer references by kind and order - chart name, image package and /opt paths deliberately left for T05 Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 735967@bnt-lap001 Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc --- .golangci.yml | 2 +- README.md | 16 +-- cmd/access-engine/main.go | 14 +-- cmd/access-engine/main_test.go | 4 +- cmd/access-engine/ops_warden_fetch_test.go | 4 +- cmd/access-engine/readback.go | 10 +- cmd/access-engine/readback_test.go | 10 +- cmd/flex-auth/main_test.go | 4 +- docs/runtime-rename-inventory.md | 108 ++++++++++++++++++ docs/topaz-adapter-operations.md | 2 +- go.mod | 2 +- internal/adapters/directory/enrichment.go | 2 +- internal/adapters/directory/resolvers.go | 2 +- internal/adapters/directory/resolvers_test.go | 4 +- internal/adapters/directory/types.go | 2 +- internal/adapters/keycloak/adapter.go | 2 +- internal/adapters/keycloak/adapter_test.go | 4 +- internal/adapters/keycloak/types.go | 2 +- internal/adapters/relationship/adapter.go | 4 +- .../adapters/relationship/adapter_test.go | 6 +- internal/adapters/relationship/translate.go | 4 +- internal/adapters/relationship/types.go | 2 +- internal/adapters/rule/adapter.go | 4 +- internal/adapters/rule/adapter_test.go | 6 +- internal/adapters/rule/policy_artifact.go | 4 +- internal/adapters/rule/types.go | 2 +- internal/adapters/topaz/adapter.go | 6 +- internal/adapters/topaz/adapter_test.go | 8 +- internal/adapters/topaz/http_client_test.go | 2 +- internal/adapters/topaz/integration_test.go | 7 +- internal/adapters/topaz/policy_bundle.go | 2 +- internal/adapters/topaz/translate.go | 4 +- internal/adapters/topaz/types.go | 2 +- internal/audit/log.go | 2 +- internal/audit/log_test.go | 4 +- internal/decision/attribute_context_test.go | 8 +- internal/decision/emission_atomicity_test.go | 4 +- internal/decision/engine.go | 8 +- internal/decision/engine_test.go | 12 +- .../decision/enrichment_precedence_test.go | 2 +- internal/emission/delivery_test.go | 4 +- internal/emission/outbox.go | 2 +- internal/emission/outbox_test.go | 4 +- internal/layer/conformance_test.go | 2 +- internal/layer/survey_test.go | 2 +- internal/markitect/actions.go | 2 +- internal/markitect/actions_test.go | 4 +- internal/markitect/check_fixtures_test.go | 4 +- internal/markitect/decision.go | 2 +- internal/markitect/decision_test.go | 4 +- internal/markitect/importer.go | 4 +- internal/markitect/importer_test.go | 6 +- internal/policy/attribute_reads.go | 4 +- .../informed_decision_attribute_test.go | 4 +- .../informed_decision_lifecycle_test.go | 4 +- .../policy/informed_decision_t03_act_test.go | 4 +- .../policy/informed_decision_wp0094_test.go | 4 +- internal/policy/package.go | 2 +- internal/policy/package_test.go | 4 +- internal/readback/readback.go | 8 +- internal/registry/manifest_test.go | 2 +- internal/registry/store.go | 2 +- internal/registry/store_test.go | 4 +- internal/sign/sign.go | 2 +- internal/sign/sign_test.go | 4 +- internal/sign/write_fixtures_test.go | 4 +- pkg/api/canonical_test.go | 2 +- pkg/api/resource_manifest_test.go | 2 +- tools/check_layer_conformance.go | 2 +- tools/survey_layer_declarations.go | 2 +- ...EX-WP-0036-runtime-rename-access-engine.md | 21 +++- 71 files changed, 272 insertions(+), 146 deletions(-) create mode 100644 docs/runtime-rename-inventory.md diff --git a/.golangci.yml b/.golangci.yml index 8a0ac7c..9b7c953 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -17,7 +17,7 @@ linters: linters-settings: goimports: - local-prefixes: github.com/netkingdom/flex-auth + local-prefixes: github.com/netkingdom/access-engine issues: exclude-rules: diff --git a/README.md b/README.md index 63307ee..294c06e 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,16 @@ -# flex-auth +# access-engine Policy-as-code authorization registry and control plane for NetKingdom-aligned systems. -The live Forge and State Hub coordinate is still `flex-auth` (repository UUID -`fda8ad85-a7d7-4055-8f21-902a533e59df`, Forge ID `42`). `FLEX-WP-0020` will -rename that coordinate to `access-engine` and keep the Go module, binary, -`FLEX_AUTH_*` variables, Helm releases, container package -`coulomb/flex-auth`, and policy/API vocabulary unchanged. Work-record -frontmatter stays `repo: flex-auth` until State Hub rebind. Planned clone: +The Forge and State Hub coordinate is `access-engine` (`FLEX-WP-0020`; +repository UUID `fda8ad85-a7d7-4055-8f21-902a533e59df`, Forge ID `42`; hub alias +`flex-auth`). The binary is `access-engine` (`FLEX-DEC-2026-020`; `flex-auth` +is now only a stub that prints the rename), and the Go module is +`github.com/netkingdom/access-engine`. The runtime still uses `flex-auth`: the +namespace, Helm releases, Services, caller audience and container package +`coulomb/flex-auth`. `FLEX-WP-0036` moves those to new pins that run alongside +the old ones while consumers switch. Clone: `https://forgejo.coulomb.social/coulomb/access-engine.git`. Start with [INTENT.md](INTENT.md) for the project boundary and direction. diff --git a/cmd/access-engine/main.go b/cmd/access-engine/main.go index 1b18906..7e94d8e 100644 --- a/cmd/access-engine/main.go +++ b/cmd/access-engine/main.go @@ -16,13 +16,13 @@ import ( "gopkg.in/yaml.v3" - "github.com/netkingdom/flex-auth/internal/audit" - "github.com/netkingdom/flex-auth/internal/callerauth" - decisioncore "github.com/netkingdom/flex-auth/internal/decision" - "github.com/netkingdom/flex-auth/internal/emission" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/audit" + "github.com/netkingdom/access-engine/internal/callerauth" + decisioncore "github.com/netkingdom/access-engine/internal/decision" + "github.com/netkingdom/access-engine/internal/emission" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) // version is set at build time via -ldflags "-X main.version=...". diff --git a/cmd/access-engine/main_test.go b/cmd/access-engine/main_test.go index 1dbf5e4..f2db0ef 100644 --- a/cmd/access-engine/main_test.go +++ b/cmd/access-engine/main_test.go @@ -11,8 +11,8 @@ import ( "strings" "testing" - "github.com/netkingdom/flex-auth/internal/callerauth" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/callerauth" + "github.com/netkingdom/access-engine/pkg/api" ) func TestRunVersion(t *testing.T) { diff --git a/cmd/access-engine/ops_warden_fetch_test.go b/cmd/access-engine/ops_warden_fetch_test.go index fb96dce..b3346f2 100644 --- a/cmd/access-engine/ops_warden_fetch_test.go +++ b/cmd/access-engine/ops_warden_fetch_test.go @@ -15,8 +15,8 @@ import ( "gopkg.in/yaml.v3" - "github.com/netkingdom/flex-auth/internal/callerauth" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/callerauth" + "github.com/netkingdom/access-engine/pkg/api" ) // The ops-warden secret-read pin (CUST-WP-0075, bug b792c5d0): warden's diff --git a/cmd/access-engine/readback.go b/cmd/access-engine/readback.go index 00139c9..7f346b7 100644 --- a/cmd/access-engine/readback.go +++ b/cmd/access-engine/readback.go @@ -9,11 +9,11 @@ import ( "net/http" "strings" - "github.com/netkingdom/flex-auth/internal/audit" - "github.com/netkingdom/flex-auth/internal/callerauth" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/internal/readback" - "github.com/netkingdom/flex-auth/internal/registry" + "github.com/netkingdom/access-engine/internal/audit" + "github.com/netkingdom/access-engine/internal/callerauth" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/internal/readback" + "github.com/netkingdom/access-engine/internal/registry" ) // readbackBinding is the caller-binding key the readback routes authorize diff --git a/cmd/access-engine/readback_test.go b/cmd/access-engine/readback_test.go index 60bebce..92a2b57 100644 --- a/cmd/access-engine/readback_test.go +++ b/cmd/access-engine/readback_test.go @@ -14,11 +14,11 @@ import ( "testing" "time" - "github.com/netkingdom/flex-auth/internal/audit" - "github.com/netkingdom/flex-auth/internal/callerauth" - "github.com/netkingdom/flex-auth/internal/readback" - "github.com/netkingdom/flex-auth/internal/schemaguard" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/audit" + "github.com/netkingdom/access-engine/internal/callerauth" + "github.com/netkingdom/access-engine/internal/readback" + "github.com/netkingdom/access-engine/internal/schemaguard" + "github.com/netkingdom/access-engine/pkg/api" ) // FLEX-WP-0035: application access readback. diff --git a/cmd/flex-auth/main_test.go b/cmd/flex-auth/main_test.go index fcd0d06..483f919 100644 --- a/cmd/flex-auth/main_test.go +++ b/cmd/flex-auth/main_test.go @@ -9,12 +9,12 @@ import ( // The retired binary must fail and name its replacement, whatever it is asked. func TestRetiredBinaryNamesReplacement(t *testing.T) { - if os.Getenv("FLEX_AUTH_STUB_CHILD") == "1" { + if os.Getenv("ACCESS_ENGINE_STUB_CHILD") == "1" { main() return } cmd := exec.Command(os.Args[0], "-test.run=TestRetiredBinaryNamesReplacement", "serve", "--addr", "x") - cmd.Env = append(os.Environ(), "FLEX_AUTH_STUB_CHILD=1") + cmd.Env = append(os.Environ(), "ACCESS_ENGINE_STUB_CHILD=1") out, err := cmd.CombinedOutput() exit, ok := err.(*exec.ExitError) if !ok || exit.ExitCode() != 2 { diff --git a/docs/runtime-rename-inventory.md b/docs/runtime-rename-inventory.md new file mode 100644 index 0000000..7ca4dd7 --- /dev/null +++ b/docs/runtime-rename-inventory.md @@ -0,0 +1,108 @@ +# Runtime rename inventory (FLEX-WP-0036-T02) + +Derived 2026-10-10 by searching each consumer checkout for `flex-auth` and +`FLEX_AUTH` in code and config (`.py .go .yaml .yml .toml .json .sh .ts`). +Git, venv, history and archived paths are excluded. Tests are listed only where +they run the binary. Historical evidence and batch files under `docs/` are +counted but are not to be rewritten: they record what was live at the time. + +Re-derive before T06 with the same search. This is a snapshot, not a register. + +## What a consumer has to change, by kind + +| Kind | Breaks if changed before the PDP accepts it? | Order | +| --- | --- | --- | +| Service URL `flex-auth-.flex-auth.svc…` | Yes: the new name resolves only once T05 has run | T05, then the consumer | +| Egress NetworkPolicy naming namespace `flex-auth` | Yes: drops traffic to the old pin | Add `access-engine`, switch, then remove `flex-auth` | +| Projected-token audience `flex-auth` | Yes: 401 until T03 accepts `access-engine` | T03, then the consumer | +| `resource.system` / `owner_repo` = `flex-auth` | Yes: `not_applicable`, i.e. deny (`FLEX-DEC-2026-015`) | T03, then the consumer | +| Consumer-owned env var names (`_FLEX_AUTH_URL` …) | No: the consumer's own vocabulary | Consumer's choice; not required | +| Builds or runs our binary | Already changed (`FLEX-DEC-2026-020`): the stub exits 2 | Consumer builds `./cmd/access-engine` | + +## Per consumer + +### ops-warden + +Live pins: `flex-auth-ops-warden` (sign), `flex-auth-ops-warden-fetch`. + +- URLs: `examples/warden.production.example.yaml` (sign and fetch); live + config under the operator. Workstation tunnels + `flex-auth-ops-warden-railiance01` (:19090) and + `flex-auth-ops-warden-fetch-railiance01` (:19091) in ops-bridge + `tunnels.yaml` point at ClusterIPs, which change with the new Services. +- Audience: `examples/warden.production.example.yaml`. +- `resource.system`: lane `flex-auth-policy-check`, `owner_repo: flex-auth` + in `registry/routing/catalog.yaml`. +- Binary: `scripts/policy_gate_production_smoke.sh` (`FLEX_AUTH_BIN`, + default `/tmp/flex-auth`). +- Also: `scripts/build_flex_auth_registry.py`, + `scripts/check_flex_auth_manifest_coverage.py`, `pep-stance.yaml`, + `layer.yaml`, `tenancy.yaml`, and `src/warden/{policy,access,caller_identity}.py`. + These are names, not runtime addresses. + +### secrets-engine + +Live pin: `flex-auth-secrets-engine`. + +- URLs appear in docs and tests only. secrets-engine is a CLI, and its + operator access path is still open (`FLEX-WP-0023`). +- Binary: `tools/exercise_approval_identity.py` builds `./cmd/flex-auth` + (notified 2026-10-10, message `ad4b1b3e`). +- `pep-stance.yaml` names the PDP. + +### user-engine (deployment sources in net-kingdom) + +Live pins: `flex-auth-user-engine` (check), `flex-auth-application-readback`. + +- URL, audience and egress: `net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml` + (`USER_ENGINE_FLEX_AUTH_URL`, token audience `flex-auth`, egress namespace + `flex-auth`), plus the readback URL promised on 2026-10-10 (message + `5460cee2`). +- Env vars: `USER_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT}` and + `USER_ENGINE_READBACK_TOKEN_FILE` in `src/user_engine/runtime.py` and + `adapters/local.py`. These are the consumer's own names. + +### tenant-engine + +Live pin: `flex-auth-tenant-engine`. + +- URL, audience and egress: `deploy/base/tenant-engine.yaml`, `railiance/app.toml`. +- Env vars: `TENANT_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT_SECONDS}` in + `src/tenant_engine/config.py`; `pep-stance.yaml`. + +### informed-decision + +Live pins: `flex-auth-informed-decision-lifecycle`, `-sitting`, `-t03`. + +- URLs and audience: `deploy/sitting-admission.json`, `deploy/t03-admission.json`, + `deploy/lifecycle/{admission,service}.candidate.json`, and + `tools/render_deployment.py`. The live egress policy `informed-decision-review` + names namespace `flex-auth`. +- Binary: `tests/browser_fixture.py`, `tests/test_lifecycle_policy_component.py`, + `tests/test_review_component.py` and `tests/test_lifecycle_review.py` take + `INFD_FLEX_AUTH_BINARY` / `INFD_FLEX_AUTH_SOURCE`. A binary built from current + source must come from `./cmd/access-engine`. Doc + `docs/protected-browser-review.md` notified (message `9b15c762`). +- `docs/batches/**` and `docs/evidence/**` are historical. Leave them. + +### net-kingdom + +- Owns user-engine's deployment source (above). +- `runbooks/protected-system-flex-auth/pack.yaml` and + `docs/tutorials/protected-system-flex-auth.md` run `go run ./cmd/flex-auth` + (notified, message `e2f1aac9`). + +### Others with references, not consumers of a pin + +- `state-hub/repository_rename_workplan.py`: tooling from `FLEX-WP-0020`. +- `railiance-platform/scripts/credential.py`: `FLEX_AUTH_{URL,PATH,SUBJECT_TYPES}`. + Check whether it calls a live pin before T06. +- `the-custodian`: docs only. +- Hub repo record `local_path` is `/home/worsch/flex-auth`, but the checkout is + `/home/worsch/access-engine` (`FLEX-WP-0020-T11` residual). + +## Owner handoffs + +Requested after T01 fixes the target names, so each owner gets one message +with the exact new URL and audience: `ops-warden`, `secrets-engine`, +`user-engine` with `net-kingdom`, `tenant-engine`, and `informed-decision`. diff --git a/docs/topaz-adapter-operations.md b/docs/topaz-adapter-operations.md index 69de47b..e79292e 100644 --- a/docs/topaz-adapter-operations.md +++ b/docs/topaz-adapter-operations.md @@ -50,7 +50,7 @@ docker compose up --abort-on-container-exit --exit-code-from probe The Go integration test is present but skipped by default. Run it with: ```sh -FLEX_AUTH_RUN_TOPAZ_INTEGRATION=1 go test ./internal/adapters/topaz +ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION=1 go test ./internal/adapters/topaz ``` ## Directory Consistency diff --git a/go.mod b/go.mod index bf11465..227d417 100644 --- a/go.mod +++ b/go.mod @@ -1,4 +1,4 @@ -module github.com/netkingdom/flex-auth +module github.com/netkingdom/access-engine go 1.26.7 diff --git a/internal/adapters/directory/enrichment.go b/internal/adapters/directory/enrichment.go index 93f6e15..d5cbacc 100644 --- a/internal/adapters/directory/enrichment.go +++ b/internal/adapters/directory/enrichment.go @@ -3,7 +3,7 @@ package directory import ( "sort" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) // MergeResults combines resolver results while keeping source metadata. diff --git a/internal/adapters/directory/resolvers.go b/internal/adapters/directory/resolvers.go index b041a07..d2cafb4 100644 --- a/internal/adapters/directory/resolvers.go +++ b/internal/adapters/directory/resolvers.go @@ -5,7 +5,7 @@ import ( "fmt" "time" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) // GraphClient is the Microsoft Graph group lookup boundary. diff --git a/internal/adapters/directory/resolvers_test.go b/internal/adapters/directory/resolvers_test.go index 2860128..6385ccd 100644 --- a/internal/adapters/directory/resolvers_test.go +++ b/internal/adapters/directory/resolvers_test.go @@ -5,8 +5,8 @@ import ( "testing" "time" - "github.com/netkingdom/flex-auth/internal/adapters/directory" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/adapters/directory" + "github.com/netkingdom/access-engine/pkg/api" ) func TestGraphResolverDetectsTokenOverage(t *testing.T) { diff --git a/internal/adapters/directory/types.go b/internal/adapters/directory/types.go index e7fdf0a..d6c322c 100644 --- a/internal/adapters/directory/types.go +++ b/internal/adapters/directory/types.go @@ -4,7 +4,7 @@ import ( "context" "time" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) // Source identifies the external directory source. diff --git a/internal/adapters/keycloak/adapter.go b/internal/adapters/keycloak/adapter.go index 5b517f7..195b64b 100644 --- a/internal/adapters/keycloak/adapter.go +++ b/internal/adapters/keycloak/adapter.go @@ -7,7 +7,7 @@ import ( "encoding/json" "fmt" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) // Adapter maps flex-auth checks and resources to Keycloak Authorization diff --git a/internal/adapters/keycloak/adapter_test.go b/internal/adapters/keycloak/adapter_test.go index c80c244..78e550f 100644 --- a/internal/adapters/keycloak/adapter_test.go +++ b/internal/adapters/keycloak/adapter_test.go @@ -5,8 +5,8 @@ import ( "errors" "testing" - "github.com/netkingdom/flex-auth/internal/adapters/keycloak" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/adapters/keycloak" + "github.com/netkingdom/access-engine/pkg/api" ) func TestBuildAuthorizationRequestUsesUMAPermissionShape(t *testing.T) { diff --git a/internal/adapters/keycloak/types.go b/internal/adapters/keycloak/types.go index 1172901..7a79e79 100644 --- a/internal/adapters/keycloak/types.go +++ b/internal/adapters/keycloak/types.go @@ -5,7 +5,7 @@ import ( "errors" "fmt" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) const ( diff --git a/internal/adapters/relationship/adapter.go b/internal/adapters/relationship/adapter.go index 67061aa..dc66810 100644 --- a/internal/adapters/relationship/adapter.go +++ b/internal/adapters/relationship/adapter.go @@ -8,8 +8,8 @@ import ( "fmt" "strings" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) // Adapter wraps tuple-oriented PDP results into flex-auth decision envelopes. diff --git a/internal/adapters/relationship/adapter_test.go b/internal/adapters/relationship/adapter_test.go index 040575d..a5a9d17 100644 --- a/internal/adapters/relationship/adapter_test.go +++ b/internal/adapters/relationship/adapter_test.go @@ -6,9 +6,9 @@ import ( "path/filepath" "testing" - "github.com/netkingdom/flex-auth/internal/adapters/relationship" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/adapters/relationship" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) func TestSnapshotToTuplesMapsCanonicalRegistry(t *testing.T) { diff --git a/internal/adapters/relationship/translate.go b/internal/adapters/relationship/translate.go index 8637faa..13c559b 100644 --- a/internal/adapters/relationship/translate.go +++ b/internal/adapters/relationship/translate.go @@ -5,8 +5,8 @@ import ( "sort" "strings" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) // SnapshotToTuples maps flex-auth registry data to relationship tuples. diff --git a/internal/adapters/relationship/types.go b/internal/adapters/relationship/types.go index 94bb075..ed26184 100644 --- a/internal/adapters/relationship/types.go +++ b/internal/adapters/relationship/types.go @@ -5,7 +5,7 @@ import ( "errors" "fmt" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) const ( diff --git a/internal/adapters/rule/adapter.go b/internal/adapters/rule/adapter.go index 64216ee..105eb37 100644 --- a/internal/adapters/rule/adapter.go +++ b/internal/adapters/rule/adapter.go @@ -8,8 +8,8 @@ import ( "fmt" "reflect" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/pkg/api" ) // Adapter wraps rule-PDP responses into flex-auth decision envelopes. diff --git a/internal/adapters/rule/adapter_test.go b/internal/adapters/rule/adapter_test.go index eb6f661..b3782a3 100644 --- a/internal/adapters/rule/adapter_test.go +++ b/internal/adapters/rule/adapter_test.go @@ -6,9 +6,9 @@ import ( "path/filepath" "testing" - "github.com/netkingdom/flex-auth/internal/adapters/rule" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/adapters/rule" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/pkg/api" ) func TestCanonicalInputFromCheck(t *testing.T) { diff --git a/internal/adapters/rule/policy_artifact.go b/internal/adapters/rule/policy_artifact.go index faef352..b40f74b 100644 --- a/internal/adapters/rule/policy_artifact.go +++ b/internal/adapters/rule/policy_artifact.go @@ -1,8 +1,8 @@ package rule import ( - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/pkg/api" ) // PolicyArtifactFromPackage preserves the extracted Rego module and metadata diff --git a/internal/adapters/rule/types.go b/internal/adapters/rule/types.go index 3cf6630..803959a 100644 --- a/internal/adapters/rule/types.go +++ b/internal/adapters/rule/types.go @@ -5,7 +5,7 @@ import ( "errors" "fmt" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) const ( diff --git a/internal/adapters/topaz/adapter.go b/internal/adapters/topaz/adapter.go index d336dae..fd6bbad 100644 --- a/internal/adapters/topaz/adapter.go +++ b/internal/adapters/topaz/adapter.go @@ -8,9 +8,9 @@ import ( "fmt" "strings" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) // Adapter delegates checks, directory writes, and policy bundle publication to diff --git a/internal/adapters/topaz/adapter_test.go b/internal/adapters/topaz/adapter_test.go index 29a6643..2841f7b 100644 --- a/internal/adapters/topaz/adapter_test.go +++ b/internal/adapters/topaz/adapter_test.go @@ -7,10 +7,10 @@ import ( "path/filepath" "testing" - "github.com/netkingdom/flex-auth/internal/adapters/topaz" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/adapters/topaz" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) func TestSnapshotToDirectoryMapsCanonicalRegistry(t *testing.T) { diff --git a/internal/adapters/topaz/http_client_test.go b/internal/adapters/topaz/http_client_test.go index 37ca2cc..c439596 100644 --- a/internal/adapters/topaz/http_client_test.go +++ b/internal/adapters/topaz/http_client_test.go @@ -7,7 +7,7 @@ import ( "net/http/httptest" "testing" - "github.com/netkingdom/flex-auth/internal/adapters/topaz" + "github.com/netkingdom/access-engine/internal/adapters/topaz" ) func TestHTTPClientUsesTopazDirectoryRESTShape(t *testing.T) { diff --git a/internal/adapters/topaz/integration_test.go b/internal/adapters/topaz/integration_test.go index 78bc1be..26da344 100644 --- a/internal/adapters/topaz/integration_test.go +++ b/internal/adapters/topaz/integration_test.go @@ -8,8 +8,11 @@ import ( ) func TestTopazDockerComposeExample(t *testing.T) { - if os.Getenv("FLEX_AUTH_RUN_TOPAZ_INTEGRATION") != "1" { - t.Skip("set FLEX_AUTH_RUN_TOPAZ_INTEGRATION=1 to run the examples/topaz docker-compose integration") + if os.Getenv("FLEX_AUTH_RUN_TOPAZ_INTEGRATION") == "1" { + t.Skip("FLEX_AUTH_RUN_TOPAZ_INTEGRATION was renamed: set ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION=1 (FLEX-WP-0036)") + } + if os.Getenv("ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION") != "1" { + t.Skip("set ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION=1 to run the examples/topaz docker-compose integration") } dir := filepath.Join("..", "..", "..", "examples", "topaz") diff --git a/internal/adapters/topaz/policy_bundle.go b/internal/adapters/topaz/policy_bundle.go index 2afa2f7..98a39f8 100644 --- a/internal/adapters/topaz/policy_bundle.go +++ b/internal/adapters/topaz/policy_bundle.go @@ -8,7 +8,7 @@ import ( "path/filepath" "strings" - "github.com/netkingdom/flex-auth/internal/policy" + "github.com/netkingdom/access-engine/internal/policy" ) // PolicyBundleFromPackage extracts the Rego module from a flex-auth diff --git a/internal/adapters/topaz/translate.go b/internal/adapters/topaz/translate.go index 2b43bdf..4e525e2 100644 --- a/internal/adapters/topaz/translate.go +++ b/internal/adapters/topaz/translate.go @@ -5,8 +5,8 @@ import ( "sort" "strings" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) // SnapshotToDirectory converts flex-auth's canonical registry snapshot into diff --git a/internal/adapters/topaz/types.go b/internal/adapters/topaz/types.go index f490573..fd27c12 100644 --- a/internal/adapters/topaz/types.go +++ b/internal/adapters/topaz/types.go @@ -5,7 +5,7 @@ import ( "errors" "fmt" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) const ( diff --git a/internal/audit/log.go b/internal/audit/log.go index 3c325c5..7ee82e9 100644 --- a/internal/audit/log.go +++ b/internal/audit/log.go @@ -8,7 +8,7 @@ import ( "path/filepath" "sync" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) // JSONLDecisionLog persists compact decision envelopes for local development. diff --git a/internal/audit/log_test.go b/internal/audit/log_test.go index 086a03f..418acd0 100644 --- a/internal/audit/log_test.go +++ b/internal/audit/log_test.go @@ -4,8 +4,8 @@ import ( "path/filepath" "testing" - "github.com/netkingdom/flex-auth/internal/audit" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/audit" + "github.com/netkingdom/access-engine/pkg/api" ) func TestJSONLDecisionLogRoundTripsDecisions(t *testing.T) { diff --git a/internal/decision/attribute_context_test.go b/internal/decision/attribute_context_test.go index f9d2e77..f8b259b 100644 --- a/internal/decision/attribute_context_test.go +++ b/internal/decision/attribute_context_test.go @@ -6,10 +6,10 @@ import ( "testing" "time" - "github.com/netkingdom/flex-auth/internal/decision" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/decision" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) func TestAttributeContextCarriedWithoutViewHash(t *testing.T) { diff --git a/internal/decision/emission_atomicity_test.go b/internal/decision/emission_atomicity_test.go index e5080a1..e400892 100644 --- a/internal/decision/emission_atomicity_test.go +++ b/internal/decision/emission_atomicity_test.go @@ -5,8 +5,8 @@ import ( "errors" "testing" - "github.com/netkingdom/flex-auth/internal/decision" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/decision" + "github.com/netkingdom/access-engine/pkg/api" ) // failingRecorder is an outbox whose commit always fails. diff --git a/internal/decision/engine.go b/internal/decision/engine.go index 9c75411..30192b5 100644 --- a/internal/decision/engine.go +++ b/internal/decision/engine.go @@ -15,10 +15,10 @@ import ( "sync" "time" - "github.com/netkingdom/flex-auth/internal/callerauth" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/callerauth" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) // Engine evaluates deterministic standalone authorization checks against a diff --git a/internal/decision/engine_test.go b/internal/decision/engine_test.go index 75dbb95..bd177cb 100644 --- a/internal/decision/engine_test.go +++ b/internal/decision/engine_test.go @@ -10,12 +10,12 @@ import ( "gopkg.in/yaml.v3" - "github.com/netkingdom/flex-auth/internal/audit" - "github.com/netkingdom/flex-auth/internal/callerauth" - "github.com/netkingdom/flex-auth/internal/decision" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/audit" + "github.com/netkingdom/access-engine/internal/callerauth" + "github.com/netkingdom/access-engine/internal/decision" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) func TestCheckUsesExplicitCaringContext(t *testing.T) { diff --git a/internal/decision/enrichment_precedence_test.go b/internal/decision/enrichment_precedence_test.go index 3110206..ea5dfb2 100644 --- a/internal/decision/enrichment_precedence_test.go +++ b/internal/decision/enrichment_precedence_test.go @@ -6,7 +6,7 @@ import ( "encoding/json" "testing" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) // A registry fact is an authority statement; the same key on the request is the diff --git a/internal/emission/delivery_test.go b/internal/emission/delivery_test.go index a38f9ea..094c49a 100644 --- a/internal/emission/delivery_test.go +++ b/internal/emission/delivery_test.go @@ -11,8 +11,8 @@ import ( "testing" "time" - "github.com/netkingdom/flex-auth/internal/emission" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/emission" + "github.com/netkingdom/access-engine/pkg/api" ) func TestHeartbeatScheduleSurvivesRestart(t *testing.T) { diff --git a/internal/emission/outbox.go b/internal/emission/outbox.go index 57061eb..f4c15c9 100644 --- a/internal/emission/outbox.go +++ b/internal/emission/outbox.go @@ -16,7 +16,7 @@ import ( "sync" "time" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) // ClassPrefix prefixes every decision event class; the suffix is the effect. diff --git a/internal/emission/outbox_test.go b/internal/emission/outbox_test.go index 229fc66..930c5e4 100644 --- a/internal/emission/outbox_test.go +++ b/internal/emission/outbox_test.go @@ -9,8 +9,8 @@ import ( "gopkg.in/yaml.v3" - "github.com/netkingdom/flex-auth/internal/emission" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/emission" + "github.com/netkingdom/access-engine/pkg/api" ) func deny(id, tenant string) api.DecisionEnvelope { diff --git a/internal/layer/conformance_test.go b/internal/layer/conformance_test.go index f7ddba9..80dee38 100644 --- a/internal/layer/conformance_test.go +++ b/internal/layer/conformance_test.go @@ -7,7 +7,7 @@ import ( "strings" "testing" - "github.com/netkingdom/flex-auth/internal/layer" + "github.com/netkingdom/access-engine/internal/layer" "gopkg.in/yaml.v3" ) diff --git a/internal/layer/survey_test.go b/internal/layer/survey_test.go index 41105ff..5ceb6a3 100644 --- a/internal/layer/survey_test.go +++ b/internal/layer/survey_test.go @@ -6,7 +6,7 @@ import ( "strings" "testing" - "github.com/netkingdom/flex-auth/internal/layer" + "github.com/netkingdom/access-engine/internal/layer" ) func writeRepo(t *testing.T, root, name, intent, declFile string) { diff --git a/internal/markitect/actions.go b/internal/markitect/actions.go index e8ce959..7028af4 100644 --- a/internal/markitect/actions.go +++ b/internal/markitect/actions.go @@ -1,6 +1,6 @@ package markitect -import "github.com/netkingdom/flex-auth/pkg/api" +import "github.com/netkingdom/access-engine/pkg/api" const ( ActionRead = "read" diff --git a/internal/markitect/actions_test.go b/internal/markitect/actions_test.go index ecee770..ba0caca 100644 --- a/internal/markitect/actions_test.go +++ b/internal/markitect/actions_test.go @@ -4,8 +4,8 @@ import ( "slices" "testing" - "github.com/netkingdom/flex-auth/internal/markitect" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/markitect" + "github.com/netkingdom/access-engine/pkg/api" ) func TestActionVocabularySeparatesReadFromExport(t *testing.T) { diff --git a/internal/markitect/check_fixtures_test.go b/internal/markitect/check_fixtures_test.go index 61d7a02..c0e1b5a 100644 --- a/internal/markitect/check_fixtures_test.go +++ b/internal/markitect/check_fixtures_test.go @@ -5,8 +5,8 @@ import ( "path/filepath" "testing" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/pkg/api" ) func TestMarkitectCheckFixturePackageValidates(t *testing.T) { diff --git a/internal/markitect/decision.go b/internal/markitect/decision.go index 4a6f103..03d23e3 100644 --- a/internal/markitect/decision.go +++ b/internal/markitect/decision.go @@ -1,6 +1,6 @@ package markitect -import "github.com/netkingdom/flex-auth/pkg/api" +import "github.com/netkingdom/access-engine/pkg/api" const ( GatewayEffectAllow = "allow" diff --git a/internal/markitect/decision_test.go b/internal/markitect/decision_test.go index ec99698..7b0db69 100644 --- a/internal/markitect/decision_test.go +++ b/internal/markitect/decision_test.go @@ -3,8 +3,8 @@ package markitect_test import ( "testing" - "github.com/netkingdom/flex-auth/internal/markitect" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/markitect" + "github.com/netkingdom/access-engine/pkg/api" ) func TestGatewayDecisionAllowContract(t *testing.T) { diff --git a/internal/markitect/importer.go b/internal/markitect/importer.go index a66c070..daae8cc 100644 --- a/internal/markitect/importer.go +++ b/internal/markitect/importer.go @@ -4,8 +4,8 @@ import ( "fmt" "slices" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) const ( diff --git a/internal/markitect/importer_test.go b/internal/markitect/importer_test.go index 938852f..ca5528a 100644 --- a/internal/markitect/importer_test.go +++ b/internal/markitect/importer_test.go @@ -7,9 +7,9 @@ import ( "gopkg.in/yaml.v3" - "github.com/netkingdom/flex-auth/internal/markitect" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/markitect" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) func TestImportResourceManifestLoadsPinnedMarkitectShape(t *testing.T) { diff --git a/internal/policy/attribute_reads.go b/internal/policy/attribute_reads.go index a860008..d920112 100644 --- a/internal/policy/attribute_reads.go +++ b/internal/policy/attribute_reads.go @@ -19,8 +19,8 @@ import ( const undeclaredAttributeCode = "POLICY-ATTRIBUTE-UNDECLARED" var ( - attrDot = regexp.MustCompile(`input\.(resource|subject)\.attributes\.([A-Za-z_][A-Za-z0-9_]*)`) - attrGet = regexp.MustCompile(`object\.get\(\s*input\.(resource|subject)\.attributes\s*,\s*"([A-Za-z_][A-Za-z0-9_]*)"`) + attrDot = regexp.MustCompile(`input\.(resource|subject)\.attributes\.([A-Za-z_][A-Za-z0-9_]*)`) + attrGet = regexp.MustCompile(`object\.get\(\s*input\.(resource|subject)\.attributes\s*,\s*"([A-Za-z_][A-Za-z0-9_]*)"`) attrNestedGet = regexp.MustCompile(`object\.get\(\s*object\.get\(\s*input\.(resource|subject)\s*,\s*"attributes"\s*,\s*\{\}\s*\)\s*,\s*"([A-Za-z_][A-Za-z0-9_]*)"`) ) diff --git a/internal/policy/informed_decision_attribute_test.go b/internal/policy/informed_decision_attribute_test.go index d21a50f..9346f6c 100644 --- a/internal/policy/informed_decision_attribute_test.go +++ b/internal/policy/informed_decision_attribute_test.go @@ -11,8 +11,8 @@ import ( "testing" "time" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/pkg/api" ) func TestInformedDecisionAttributeAdmission(t *testing.T) { diff --git a/internal/policy/informed_decision_lifecycle_test.go b/internal/policy/informed_decision_lifecycle_test.go index 90512e6..cd13e44 100644 --- a/internal/policy/informed_decision_lifecycle_test.go +++ b/internal/policy/informed_decision_lifecycle_test.go @@ -8,8 +8,8 @@ import ( "testing" "time" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/pkg/api" ) func TestInformedDecisionLifecycle(t *testing.T) { diff --git a/internal/policy/informed_decision_t03_act_test.go b/internal/policy/informed_decision_t03_act_test.go index 81ce60c..3a28f52 100644 --- a/internal/policy/informed_decision_t03_act_test.go +++ b/internal/policy/informed_decision_t03_act_test.go @@ -7,8 +7,8 @@ import ( "path/filepath" "testing" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/pkg/api" ) // v11 allows review acts on the three list-only T03 records at memo version 3. diff --git a/internal/policy/informed_decision_wp0094_test.go b/internal/policy/informed_decision_wp0094_test.go index 3def27c..cf9b214 100644 --- a/internal/policy/informed_decision_wp0094_test.go +++ b/internal/policy/informed_decision_wp0094_test.go @@ -7,8 +7,8 @@ import ( "path/filepath" "testing" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/pkg/api" ) // v10 admits exactly the four STATE-WP-0094 sitting memos. Pins come from diff --git a/internal/policy/package.go b/internal/policy/package.go index aea1be1..82e5ffe 100644 --- a/internal/policy/package.go +++ b/internal/policy/package.go @@ -14,7 +14,7 @@ import ( "github.com/open-policy-agent/opa/rego" "gopkg.in/yaml.v3" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) // Diagnostic is a validation message emitted while loading or evaluating a diff --git a/internal/policy/package_test.go b/internal/policy/package_test.go index edd1f13..9f6a6df 100644 --- a/internal/policy/package_test.go +++ b/internal/policy/package_test.go @@ -10,8 +10,8 @@ import ( "gopkg.in/yaml.v3" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/pkg/api" ) func TestLoadPolicyPackageMarkdownValidates(t *testing.T) { diff --git a/internal/readback/readback.go b/internal/readback/readback.go index 292884e..12edeed 100644 --- a/internal/readback/readback.go +++ b/internal/readback/readback.go @@ -14,10 +14,10 @@ import ( "slices" "strings" - decisioncore "github.com/netkingdom/flex-auth/internal/decision" - "github.com/netkingdom/flex-auth/internal/policy" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + decisioncore "github.com/netkingdom/access-engine/internal/decision" + "github.com/netkingdom/access-engine/internal/policy" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) // ApplicationAccess is the only action the readback evaluates. A package takes diff --git a/internal/registry/manifest_test.go b/internal/registry/manifest_test.go index f6667f3..56cdc8a 100644 --- a/internal/registry/manifest_test.go +++ b/internal/registry/manifest_test.go @@ -7,7 +7,7 @@ import ( "gopkg.in/yaml.v3" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) func TestRegistryManifestsParse(t *testing.T) { diff --git a/internal/registry/store.go b/internal/registry/store.go index ad873aa..6ea9de8 100644 --- a/internal/registry/store.go +++ b/internal/registry/store.go @@ -7,7 +7,7 @@ import ( "path/filepath" "sort" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) // Store is a deterministic local registry for standalone development and tests. diff --git a/internal/registry/store_test.go b/internal/registry/store_test.go index 60e6918..596e9ac 100644 --- a/internal/registry/store_test.go +++ b/internal/registry/store_test.go @@ -6,8 +6,8 @@ import ( "strings" "testing" - "github.com/netkingdom/flex-auth/internal/registry" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/registry" + "github.com/netkingdom/access-engine/pkg/api" ) func TestStoreImportsManifests(t *testing.T) { diff --git a/internal/sign/sign.go b/internal/sign/sign.go index 0d312ea..fc607f7 100644 --- a/internal/sign/sign.go +++ b/internal/sign/sign.go @@ -9,7 +9,7 @@ import ( "encoding/json" "fmt" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) const AlgorithmEd25519 = "ed25519" diff --git a/internal/sign/sign_test.go b/internal/sign/sign_test.go index 9befa30..e3ec2c4 100644 --- a/internal/sign/sign_test.go +++ b/internal/sign/sign_test.go @@ -7,8 +7,8 @@ import ( "path/filepath" "testing" - "github.com/netkingdom/flex-auth/internal/sign" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/sign" + "github.com/netkingdom/access-engine/pkg/api" ) // testdataSeed is a well-known non-production key. It exists so fixtures can diff --git a/internal/sign/write_fixtures_test.go b/internal/sign/write_fixtures_test.go index 239f39f..7915d72 100644 --- a/internal/sign/write_fixtures_test.go +++ b/internal/sign/write_fixtures_test.go @@ -6,8 +6,8 @@ import ( "path/filepath" "testing" - "github.com/netkingdom/flex-auth/internal/sign" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/internal/sign" + "github.com/netkingdom/access-engine/pkg/api" ) func TestWriteReplaySignatureFixtures(t *testing.T) { diff --git a/pkg/api/canonical_test.go b/pkg/api/canonical_test.go index 640794f..8cb2c9b 100644 --- a/pkg/api/canonical_test.go +++ b/pkg/api/canonical_test.go @@ -11,7 +11,7 @@ import ( "gopkg.in/yaml.v3" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) func TestCaringAccessDescriptorExampleParses(t *testing.T) { diff --git a/pkg/api/resource_manifest_test.go b/pkg/api/resource_manifest_test.go index a3e9973..36e0c03 100644 --- a/pkg/api/resource_manifest_test.go +++ b/pkg/api/resource_manifest_test.go @@ -7,7 +7,7 @@ import ( "gopkg.in/yaml.v3" - "github.com/netkingdom/flex-auth/pkg/api" + "github.com/netkingdom/access-engine/pkg/api" ) // TestResourceManifestExampleParses is the golden test for the pinned diff --git a/tools/check_layer_conformance.go b/tools/check_layer_conformance.go index 5749a65..3d74332 100644 --- a/tools/check_layer_conformance.go +++ b/tools/check_layer_conformance.go @@ -10,7 +10,7 @@ import ( "os" "path/filepath" - "github.com/netkingdom/flex-auth/internal/layer" + "github.com/netkingdom/access-engine/internal/layer" ) func main() { diff --git a/tools/survey_layer_declarations.go b/tools/survey_layer_declarations.go index c16b55c..4807740 100644 --- a/tools/survey_layer_declarations.go +++ b/tools/survey_layer_declarations.go @@ -32,7 +32,7 @@ import ( "sort" "strings" - "github.com/netkingdom/flex-auth/internal/layer" + "github.com/netkingdom/access-engine/internal/layer" ) // Security-relevant counterparts from docs/conformance/boundaries-review.md. diff --git a/workplans/FLEX-WP-0036-runtime-rename-access-engine.md b/workplans/FLEX-WP-0036-runtime-rename-access-engine.md index 9185603..ab962da 100644 --- a/workplans/FLEX-WP-0036-runtime-rename-access-engine.md +++ b/workplans/FLEX-WP-0036-runtime-rename-access-engine.md @@ -86,7 +86,7 @@ names in the table still need the founder's acceptance. ```task id: FLEX-WP-0036-T02 -status: todo +status: progress priority: high depends_on: [FLEX-WP-0036-T01] state_hub_task_id: "8f597899-677e-544b-ad58-26aab2614312" @@ -105,6 +105,12 @@ from each owner. Gate: `docs/runtime-rename-inventory.md` with one row per reference and an owner handoff id per consumer. +2026-10-10 inventory written. Handoff ids are not yet requested. They wait for +T01, so each owner gets the exact new URL and audience in one message. Found +that informed-decision's component tests and ops-warden's production smoke +script run a binary whose path comes from an env var. A binary built from +current source must now come from `./cmd/access-engine`. + ## Make the PDP accept both names ```task @@ -145,9 +151,16 @@ both resolve to the same digest. now `cmd/access-engine` and the image entrypoint is `/usr/local/bin/access-engine`. The image also ships the `flex-auth` stub. Updated: Makefile, CI, `tools/verify-posture.sh`, `tenancy.yaml` and the live -docs. Workplans, decisions and ADRs are left as written. Still to do: the Go -module, `FLEX_AUTH_*` env vars, the chart, the image package and the -`/opt/flex-auth` paths. +docs. Workplans, decisions and ADRs are left as written. + +2026-10-10 also done: Go module `github.com/netkingdom/access-engine`; no other +repo imports it. `ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION` replaces the only +`FLEX_AUTH_*` variable, and the old name skips the test with a message naming +the new one. README identity paragraph and title updated. Still to do, and +deliberately left for T05: the chart name, because it changes selector labels, +which are immutable on a `helm upgrade`, so it ships with the new releases. +Also the image package and the `/opt/flex-auth` paths, which every live pin's +args reference. ## Stand up the access-engine namespace next to flex-auth