access-engine/internal/policy/task_execution_test.go

package policy_test

import (
	"context"
	"encoding/json"
	"github.com/netkingdom/access-engine/internal/policy"
	"github.com/netkingdom/access-engine/pkg/api"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"testing"
)

func TestTaskExecutionPackageClosedAdmission(t *testing.T) {
	p, e := policy.LoadAndValidateFile(context.Background(), filepath.Join("..", "..", "examples", "secrets-engine-task-execution", "policy_package.md"))
	if e != nil || !p.Valid {
		t.Fatalf("package: %v %+v", e, p.Validation)
	}
	for _, action := range []string{"execute-ccr", "apply", "exec"} {
		r := api.CheckRequest{Tenant: "tenant:platform", Subject: api.SubjectRef{ID: "secrets-engine", Type: "service"}, Action: action, Resource: api.ResourceRef{ID: "synthetic", Type: "secret-catalog-lane", System: "secrets-engine"}, Context: map[string]any{"owner_admission": true, "verified": true, "human_control": true, "task_execution_projection": map[string]any{"verified": true}}}
		d, e := p.Evaluate(context.Background(), r)
		if e != nil || d.Effect != api.DecisionEffectDeny {
			t.Fatalf("unsigned caller opened admission: %v %+v", e, d)
		}
	}
}
func TestTaskExecutionSourceHasNoActivationSwitch(t *testing.T) {
	raw, e := os.ReadFile(filepath.Join("..", "..", "examples", "secrets-engine-task-execution", "policy_package.md"))
	if e != nil {
		t.Fatal(e)
	}
	if !strings.Contains(string(raw), "owner_admission := false") {
		t.Fatal("source refusal gate absent")
	}
}

func TestTaskExecutionPythonDescriptorAndSyntheticFutureProjection(t *testing.T) {
	output, e := exec.Command("/home/worsch/secrets-engine/.venv/bin/python", "../../tools/task_execution_interop_fixture.py").Output()
	if e != nil {
		t.Fatal("Python actual descriptor/canonical generator failed:", e)
	}
	var fixture struct {
		Request          api.CheckRequest `json:"request"`
		RequestDigest    string           `json:"request_digest"`
		ApprovalDigest   string           `json:"approval_binding_digest"`
		DescriptorDigest string           `json:"descriptor_digest"`
	}
	if json.Unmarshal(output, &fixture) != nil {
		t.Fatal("fixture JSON")
	}
	r := fixture.Request
	if api.RequestDigest(r) != fixture.RequestDigest || api.ApprovalBindingDigest(r) != fixture.ApprovalDigest || api.CanonicalDigest(r.Context["execution_contract"]) != fixture.DescriptorDigest {
		t.Fatal("actual Python/Go canonical mismatch")
	}
	raw, e := os.ReadFile(filepath.Join("..", "..", "examples", "secrets-engine-task-execution", "policy_package.md"))
	if e != nil {
		t.Fatal(e)
	}
	// This source replacement is intentionally test-only; no caller/config flag
	// can change the production package's hard admission=false constant.
	raw = []byte(strings.Replace(string(raw), "owner_admission := false", "owner_admission := true", 1))
	p, e := policy.Load(raw, "synthetic-future-provider-test.md")
	if e != nil {
		t.Fatal(e)
	}
	d, e := p.Evaluate(context.Background(), r)
	if e != nil || d.Effect != api.DecisionEffectAllow {
		t.Fatalf("synthetic future projection did not match: %v %+v", e, d)
	}
	cases := map[string]func(*api.CheckRequest){
		"action": func(r *api.CheckRequest) { r.Action = "apply" }, "service subject": func(r *api.CheckRequest) { r.Subject.ID = "other" }, "foreign tenant": func(r *api.CheckRequest) { r.Tenant = "tenant:coulomb" },
		"plan hash": func(r *api.CheckRequest) {
			r.Context["execution_contract"].(map[string]any)["expected_after"] = "sha256:" + strings.Repeat("b", 64)
		},
		"unsigned human": func(r *api.CheckRequest) { delete(r.Context, "task_execution_projection") },
		"registered tenant": func(r *api.CheckRequest) {
			r.Context["task_execution_projection"].(map[string]any)["tenant_source"] = "registration"
		},
		"membership": func(r *api.CheckRequest) {
			r.Context["task_execution_projection"].(map[string]any)["member_active"] = false
		},
		"transport": func(r *api.CheckRequest) {
			r.Context["task_execution_projection"].(map[string]any)["transport_principal"] = "other"
		},
		"expiry": func(r *api.CheckRequest) {
			r.Context["task_execution_projection"].(map[string]any)["not_after_ns"] = float64(1)
		},
		"no human control": func(r *api.CheckRequest) { r.Context["human_control"] = false },
	}
	for name, mutate := range cases {
		t.Run(name, func(t *testing.T) {
			var f struct {
				Request api.CheckRequest `json:"request"`
			}
			json.Unmarshal(output, &f)
			mutate(&f.Request)
			d, e := p.Evaluate(context.Background(), f.Request)
			if e != nil || d.Effect != api.DecisionEffectDeny {
				t.Fatalf("mutation allowed: %v %+v", e, d)
			}
		})
	}
}