access-engine/internal/policy/informed_decision_wp0094_test.go

package policy_test

import (
	"context"
	"encoding/json"
	"os"
	"path/filepath"
	"testing"

	"github.com/netkingdom/access-engine/internal/policy"
	"github.com/netkingdom/access-engine/pkg/api"
)

// v10 admits exactly the four STATE-WP-0094 sitting memos. Pins come from
// informed-decision docs/evidence/2026-10-04-state-hub-wp0094-approval-create.json.
var wp0094Records = map[string][2]string{
	"memo:state-hub-edge-receiving-rollout-c287ed8": {"974eae4d-782d-41ed-93be-e34433b5fe59", "sha256:84735b88b2db20d9445af369e28a8d40bd495dd20c0303ff3a764666ec976dde"},
	"memo:owner-return-pickup-plan-b6222af":         {"77993081-1db2-4bba-99f2-74ca1f8652b1", "sha256:e745ef64658e77e41b2a5ef569ec0f6986e120d338656d75749425f5f29b7ca0"},
	"memo:freshness-runner-deploy-trial-e77f8b4":    {"4ae04c8e-d604-4d8b-b166-693eef855da8", "sha256:f8ff89dd353c1d2006622c45996c0f05f050865f8c203373dc74da1ba3f05e24"},
	"memo:freshness-schedule-enable-retire-sweep":   {"b75752d1-bab6-4cf3-9308-5368c1d5aa91", "sha256:cc3e8fe6ace5438f19d647d3de226407c8b009985c82ad9a993e81226e6f316f"},
}

func TestWP0094ExactRecords(t *testing.T) {
	pkg, err := policy.LoadAndValidateFile(context.Background(), sittingPolicyPath(t))
	if err != nil || !pkg.Valid {
		t.Fatalf("load: %v %+v", err, pkg)
	}
	var doc struct {
		Cases []struct {
			ID        string           `json:"id"`
			Assurance string           `json:"assurance"`
			Request   api.CheckRequest `json:"request"`
		} `json:"cases"`
	}
	raw, err := os.ReadFile(filepath.Join(sittingDir(t), "attribute_admission_v8.json"))
	if err != nil {
		t.Fatal(err)
	}
	if err := json.Unmarshal(raw, &doc); err != nil {
		t.Fatal(err)
	}
	templates := map[string]api.CheckRequest{}
	for _, c := range doc.Cases {
		req := c.Request
		stampAssurance(t, &req, c.Assurance)
		templates[c.ID] = req
	}
	exact, ok := templates["exact-record-allow"]
	if !ok {
		t.Fatal("exact-record-allow template missing")
	}
	attr, ok := templates["attribute-unknown-class"]
	if !ok {
		t.Fatal("attribute-unknown-class template missing")
	}

	var shipped map[string]struct {
		ApprovalID    string `json:"approval_id"`
		BindingDigest string `json:"binding_digest"`
	}
	if err := json.Unmarshal(mustRead(t, filepath.Join(sittingDir(t), "records.json")), &shipped); err != nil {
		t.Fatal(err)
	}

	eval := func(name string, req api.CheckRequest, effect, reason string) {
		t.Helper()
		got, err := pkg.Evaluate(context.Background(), req)
		if err != nil {
			t.Fatalf("%s: %v", name, err)
		}
		if string(got.Effect) != effect || got.Reason != reason {
			t.Fatalf("%s: got %s %s; want %s %s", name, got.Effect, got.Reason, effect, reason)
		}
	}

	for memo, pin := range wp0094Records {
		if r := shipped[memo]; r.ApprovalID != pin[0] || r.BindingDigest != pin[1] {
			t.Fatalf("records.json pin for %s = %+v", memo, r)
		}
		req := exact
		req.Resource.ID = memo
		req.Context = copyContext(exact.Context)
		req.Context["approval_id"] = pin[0]
		req.Context["approval_binding_digest"] = pin[1]
		eval(memo+" exact", req, "allow", "operator_admitted_compact_sitting")

		wrong := req
		wrong.Context = copyContext(req.Context)
		wrong.Context["approval_binding_digest"] = "sha256:0000000000000000000000000000000000000000000000000000000000000000"
		eval(memo+" wrong digest", wrong, "deny", "compact_sitting_scope_or_identity_refused")

		swapped := req
		swapped.Context = copyContext(req.Context)
		swapped.Context["approval_id"] = "05751e09-3a5b-4a41-a4e8-b79e96de6484"
		eval(memo+" foreign approval id", swapped, "deny", "compact_sitting_scope_or_identity_refused")
	}

	// v9's record stays admitted.
	v9 := exact
	v9.Resource.ID = "memo:emergent-profile-adoption-0-2-6"
	v9.Context = copyContext(exact.Context)
	v9.Context["approval_id"] = "05751e09-3a5b-4a41-a4e8-b79e96de6484"
	v9.Context["approval_binding_digest"] = "sha256:7843e660694dcd7c806dc02ee0cca05dd3a96488f614b1946291496259a02001"
	eval("v9 record", v9, "allow", "operator_admitted_compact_sitting")

	// An unlisted sibling memo in attribute shape is not admitted.
	unlisted := attr
	unlisted.Resource.ID = "memo:freshness-schedule-enable-retire-sweep-v2"
	unlisted.Context = copyContext(attr.Context)
	unlisted.Context["approval_id"] = "b75752d1-bab6-4cf3-9308-5368c1d5aa91"
	unlisted.Context["approval_binding_digest"] = "sha256:cc3e8fe6ace5438f19d647d3de226407c8b009985c82ad9a993e81226e6f316f"
	eval("unlisted memo", unlisted, "deny", "unknown_class")
}