- id: fixture:ops-warden-fetch-allow-forgejo-admin-api-token
  request:
    id: check:ops-warden-fetch-forgejo-admin-api-token
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: read
    resource:
      id: secret:forgejo-admin-api-token
      type: secret
      system: railiance-platform
      tenant: tenant:platform
    context:
      need_id: forgejo-admin-api-token
      owner_repo: railiance-platform
      domain: null
  expect:
    effect: allow
    reason: secret_read_lane_matched
- id: fixture:ops-warden-fetch-allow-openrouter-llm-connect
  request:
    id: check:ops-warden-fetch-openrouter-llm-connect
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: read
    resource:
      id: secret:openrouter-llm-connect
      type: secret
      system: railiance-platform
      tenant: tenant:platform
    context:
      need_id: openrouter-llm-connect
      owner_repo: railiance-platform
      domain: null
  expect:
    effect: allow
    reason: secret_read_lane_matched
- id: fixture:ops-warden-fetch-allow-rapp-qonto-keycape-client
  request:
    id: check:ops-warden-fetch-rapp-qonto-keycape-client
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: read
    resource:
      id: secret:rapp-qonto-keycape-client
      type: secret
      system: key-cape
      tenant: tenant:platform
    context:
      need_id: rapp-qonto-keycape-client
      owner_repo: key-cape
      domain: null
  expect:
    effect: allow
    reason: secret_read_lane_matched
- id: fixture:ops-warden-fetch-allow-domain-suffix
  request:
    id: check:ops-warden-fetch-forgejo-admin-api-token
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: read
    resource:
      id: secret:forgejo-admin-api-token/infotech
      type: secret
      system: railiance-platform
      tenant: tenant:platform
    context:
      need_id: forgejo-admin-api-token
      owner_repo: railiance-platform
      domain: infotech
  expect:
    effect: allow
    reason: secret_read_lane_matched
- id: fixture:ops-warden-fetch-deny-unknown-need
  request:
    id: check:ops-warden-fetch-no-such-need
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: read
    resource:
      id: secret:no-such-need
      type: secret
      system: railiance-platform
      tenant: tenant:platform
    context:
      need_id: no-such-need
      owner_repo: railiance-platform
      domain: null
  expect:
    effect: deny
    reason: unknown_need
- id: fixture:ops-warden-fetch-deny-not-exec-capable-need
  request:
    id: check:ops-warden-fetch-net-kingdom-lldap-bind-credential
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: read
    resource:
      id: secret:net-kingdom-lldap-bind-credential
      type: secret
      system: railiance-platform
      tenant: tenant:platform
    context:
      need_id: net-kingdom-lldap-bind-credential
      owner_repo: railiance-platform
      domain: null
  expect:
    effect: deny
    reason: unknown_need
- id: fixture:ops-warden-fetch-deny-login-lane-need
  request:
    id: check:ops-warden-fetch-openbao-platform-admin-login
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: read
    resource:
      id: secret:openbao-platform-admin-login
      type: secret
      system: railiance-platform
      tenant: tenant:platform
    context:
      need_id: openbao-platform-admin-login
      owner_repo: railiance-platform
      domain: null
  expect:
    effect: deny
    reason: unknown_need
- id: fixture:ops-warden-fetch-deny-wrong-system
  request:
    id: check:ops-warden-fetch-forgejo-admin-api-token
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: read
    resource:
      id: secret:forgejo-admin-api-token
      type: secret
      system: key-cape
      tenant: tenant:platform
    context:
      need_id: forgejo-admin-api-token
      owner_repo: key-cape
      domain: null
  expect:
    effect: deny
    reason: wrong_system
- id: fixture:ops-warden-fetch-deny-unknown-system
  request:
    id: check:ops-warden-fetch-forgejo-admin-api-token
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: read
    resource:
      id: secret:forgejo-admin-api-token
      type: secret
      system: secrets-engine
      tenant: tenant:platform
    context:
      need_id: forgejo-admin-api-token
      owner_repo: secrets-engine
      domain: null
  expect:
    effect: deny
    reason: unknown_system
- id: fixture:ops-warden-fetch-deny-non-secret-type
  request:
    id: check:ops-warden-fetch-forgejo-admin-api-token
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: read
    resource:
      id: secret:forgejo-admin-api-token
      type: ssh-certificate
      system: railiance-platform
      tenant: tenant:platform
    context:
      need_id: forgejo-admin-api-token
      owner_repo: railiance-platform
      domain: null
  expect:
    effect: deny
    reason: wrong_resource_type
- id: fixture:ops-warden-fetch-deny-wrong-action
  request:
    id: check:ops-warden-fetch-forgejo-admin-api-token
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: write
    resource:
      id: secret:forgejo-admin-api-token
      type: secret
      system: railiance-platform
      tenant: tenant:platform
    context:
      need_id: forgejo-admin-api-token
      owner_repo: railiance-platform
      domain: null
  expect:
    effect: deny
    reason: wrong_action
- id: fixture:ops-warden-fetch-deny-wrong-tenant
  request:
    id: check:ops-warden-fetch-forgejo-admin-api-token
    subject:
      id: operator
      type: operator
      tenant: tenant:acme
    action: read
    resource:
      id: secret:forgejo-admin-api-token
      type: secret
      system: railiance-platform
      tenant: tenant:acme
    context:
      need_id: forgejo-admin-api-token
      owner_repo: railiance-platform
      domain: null
  expect:
    effect: deny
    reason: wrong_tenant
- id: fixture:ops-warden-fetch-deny-wrong-subject-type
  request:
    id: check:ops-warden-fetch-forgejo-admin-api-token
    subject:
      id: operator
      type: agt
      tenant: tenant:platform
    action: read
    resource:
      id: secret:forgejo-admin-api-token
      type: secret
      system: railiance-platform
      tenant: tenant:platform
    context:
      need_id: forgejo-admin-api-token
      owner_repo: railiance-platform
      domain: null
  expect:
    effect: deny
    reason: wrong_subject_type
- id: fixture:ops-warden-fetch-deny-resource-need-mismatch
  request:
    id: check:ops-warden-fetch-forgejo-admin-api-token
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: read
    resource:
      id: secret:openrouter-llm-connect
      type: secret
      system: railiance-platform
      tenant: tenant:platform
    context:
      need_id: forgejo-admin-api-token
      owner_repo: railiance-platform
      domain: null
  expect:
    effect: deny
    reason: resource_need_mismatch
- id: fixture:ops-warden-fetch-deny-owner-repo-mismatch
  request:
    id: check:ops-warden-fetch-forgejo-admin-api-token
    subject:
      id: operator
      type: operator
      tenant: tenant:platform
    action: read
    resource:
      id: secret:forgejo-admin-api-token
      type: secret
      system: railiance-platform
      tenant: tenant:platform
    context:
      need_id: forgejo-admin-api-token
      owner_repo: key-cape
      domain: null
  expect:
    effect: deny
    reason: owner_repo_mismatch