access-engine/internal/policy/informed_decision_t03_act_test.go

package policy_test

import (
	"context"
	"encoding/json"
	"os"
	"path/filepath"
	"testing"

	"github.com/netkingdom/access-engine/internal/policy"
	"github.com/netkingdom/access-engine/pkg/api"
)

// v11 allows review acts on the three list-only T03 records at memo version 3.
var t03ActRecords = map[string][2]string{
	"memo:SECRETS-WP-0010-T03-apply":  {"b5fcbfcc-ad56-456f-bc36-c823052e9917", "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5"},
	"memo:SECRETS-WP-0010-T03-verify": {"4e9ff881-d59f-4143-9155-929afbe8dd43", "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2"},
	"memo:SECRETS-WP-0010-T03-exec":   {"a24e0898-b3c5-4e50-85a8-18a2c2aa229e", "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8"},
}

func TestT03ReviewActs(t *testing.T) {
	pkg, err := policy.LoadAndValidateFile(context.Background(), sittingPolicyPath(t))
	if err != nil || !pkg.Valid {
		t.Fatalf("load: %v %+v", err, pkg)
	}
	if pkg.Metadata.Version != "v11" {
		t.Fatalf("version = %s", pkg.Metadata.Version)
	}

	var doc struct {
		Cases []struct {
			ID        string           `json:"id"`
			Assurance string           `json:"assurance"`
			Request   api.CheckRequest `json:"request"`
		} `json:"cases"`
	}
	raw, err := os.ReadFile(filepath.Join(sittingDir(t), "attribute_admission_v8.json"))
	if err != nil {
		t.Fatal(err)
	}
	if err := json.Unmarshal(raw, &doc); err != nil {
		t.Fatal(err)
	}
	var exact api.CheckRequest
	found := false
	for _, c := range doc.Cases {
		if c.ID == "exact-record-allow" {
			exact = c.Request
			stampAssurance(t, &exact, c.Assurance)
			found = true
		}
	}
	if !found {
		t.Fatal("exact-record-allow template missing")
	}

	var shipped map[string]struct {
		ApprovalID    string `json:"approval_id"`
		BindingDigest string `json:"binding_digest"`
		MemoVersion   int    `json:"memo_version"`
	}
	if err := json.Unmarshal(mustRead(t, filepath.Join(sittingDir(t), "list_only_records.json")), &shipped); err != nil {
		t.Fatal(err)
	}

	eval := func(name string, req api.CheckRequest, effect, reason string) {
		t.Helper()
		got, err := pkg.Evaluate(context.Background(), req)
		if err != nil {
			t.Fatalf("%s: %v", name, err)
		}
		if string(got.Effect) != effect || got.Reason != reason {
			t.Fatalf("%s: got %s %s; want %s %s", name, got.Effect, got.Reason, effect, reason)
		}
	}

	for memo, pin := range t03ActRecords {
		row := shipped[memo]
		if row.ApprovalID != pin[0] || row.BindingDigest != pin[1] || row.MemoVersion != 3 {
			t.Fatalf("list_only pin for %s = %+v", memo, row)
		}
		for _, action := range []string{"read", "acknowledge", "accept", "return", "discuss", "decline"} {
			req := exact
			req.Action = action
			req.Resource.ID = memo
			req.Context = copyContext(exact.Context)
			req.Context["memo_version"] = float64(3)
			req.Context["approval_id"] = pin[0]
			req.Context["approval_binding_digest"] = pin[1]
			eval(memo+" "+action, req, "allow", "operator_admitted_t03_review_act")
		}

		listed := exact
		listed.Action = "list"
		listed.Resource.ID = memo
		listed.Context = copyContext(exact.Context)
		listed.Context["memo_version"] = float64(3)
		listed.Context["approval_id"] = pin[0]
		listed.Context["approval_binding_digest"] = pin[1]
		eval(memo+" list", listed, "allow", "operator_admitted_overview_list")

		old := exact
		old.Action = "read"
		old.Resource.ID = memo
		old.Context = copyContext(exact.Context)
		old.Context["memo_version"] = float64(2)
		old.Context["approval_id"] = pin[0]
		old.Context["approval_binding_digest"] = pin[1]
		eval(memo+" version 2", old, "deny", "compact_sitting_scope_or_identity_refused")

		wrong := exact
		wrong.Action = "accept"
		wrong.Resource.ID = memo
		wrong.Context = copyContext(exact.Context)
		wrong.Context["memo_version"] = float64(3)
		wrong.Context["approval_id"] = pin[0]
		wrong.Context["approval_binding_digest"] = "sha256:0000000000000000000000000000000000000000000000000000000000000000"
		eval(memo+" wrong digest", wrong, "deny", "compact_sitting_scope_or_identity_refused")
	}

	// A version-1 sitting record still uses the original act rule.
	kept := exact
	kept.Action = "read"
	kept.Resource.ID = "memo:emergent-profile-adoption-0-2-6"
	kept.Context = copyContext(exact.Context)
	kept.Context["memo_version"] = float64(1)
	kept.Context["approval_id"] = "05751e09-3a5b-4a41-a4e8-b79e96de6484"
	kept.Context["approval_binding_digest"] = "sha256:7843e660694dcd7c806dc02ee0cca05dd3a96488f614b1946291496259a02001"
	eval("v9 record", kept, "allow", "operator_admitted_compact_sitting")
}