314 lines
11 KiB
YAML
314 lines
11 KiB
YAML
[
|
|
{
|
|
"id": "fixture:user-engine-tenant-read-allow",
|
|
"request": {
|
|
"id": "check:user-engine-tenant-read-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "user-engine", "type": "service"},
|
|
"action": "tenant.read",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:flex-auth-live-role-read-allow",
|
|
"request": {
|
|
"id": "check:flex-auth-live-role-read-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "flex-auth", "type": "service"},
|
|
"action": "tenant.role.read.live",
|
|
"resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:user-engine-live-role-read-deny",
|
|
"request": {
|
|
"id": "check:user-engine-live-role-read-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "user-engine", "type": "service"},
|
|
"action": "tenant.role.read.live",
|
|
"resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "action_not_granted"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-create-allow",
|
|
"request": {
|
|
"id": "check:tenant-engine-create-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant.create",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-role-grant-allow",
|
|
"request": {
|
|
"id": "check:tenant-engine-role-grant-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant.role.grant",
|
|
"resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-role-revoke-allow",
|
|
"request": {
|
|
"id": "check:tenant-engine-role-revoke-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant.role.revoke",
|
|
"resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-plan-assign-allow",
|
|
"request": {
|
|
"id": "check:tenant-engine-plan-assign-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant.plan.assign",
|
|
"resource": {"id": "t-1", "type": "plan-assignment", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-update-allow",
|
|
"request": {
|
|
"id": "check:tenant-engine-update-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant.update",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-retire-allow",
|
|
"request": {
|
|
"id": "check:tenant-engine-retire-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant.retire",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-reactivate-allow",
|
|
"request": {
|
|
"id": "check:tenant-engine-reactivate-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant.reactivate",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-update-unknown-subject-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-update-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "some-other-service", "type": "service"},
|
|
"action": "tenant.update",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-retire-unknown-subject-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-retire-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "some-other-service", "type": "service"},
|
|
"action": "tenant.retire",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-reactivate-unknown-subject-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-reactivate-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "some-other-service", "type": "service"},
|
|
"action": "tenant.reactivate",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-misspelled-lifecycle-action-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-retired-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant.retired",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "unknown_action"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-lifecycle-underscore-action-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-underscore-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant_update",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "unknown_action"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-unknown-subject-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-create-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "some-other-service", "type": "service"},
|
|
"action": "tenant.create",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-wrong-system-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-create-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant.create",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "some-other-system"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "wrong_system"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-unknown-action-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-delete-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant.delete",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "unknown_action"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-wrong-subject-type-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-create-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "human"},
|
|
"action": "tenant.create",
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "wrong_subject_type"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-guardrail-read-pdp-allow",
|
|
"request": {
|
|
"id": "check:tenant-engine-guardrail-read-pdp",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "flex-auth", "type": "service"},
|
|
"action": "tenant.guardrail.read",
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-guardrail-read-writer-allow",
|
|
"request": {
|
|
"id": "check:tenant-engine-guardrail-read-writer",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant.guardrail.read",
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-guardrail-set-writer-allow",
|
|
"request": {
|
|
"id": "check:tenant-engine-guardrail-set-writer",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
"action": "tenant.guardrail.set",
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-guardrail-set-pdp-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-guardrail-set-pdp",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "flex-auth", "type": "service"},
|
|
"action": "tenant.guardrail.set",
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "action_not_granted"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-guardrail-read-unknown-subject-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-guardrail-read-ops",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "ops", "type": "service"},
|
|
"action": "tenant.guardrail.read",
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-guardrail-set-unknown-subject-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-guardrail-set-ops",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "ops", "type": "service"},
|
|
"action": "tenant.guardrail.set",
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
|
},
|
|
{
|
|
"id": "fixture:tenant-engine-misspelled-guardrail-action-deny",
|
|
"request": {
|
|
"id": "check:tenant-engine-guardrail-get",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "flex-auth", "type": "service"},
|
|
"action": "tenant.guardrail.get",
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "unknown_action"}
|
|
}
|
|
]
|