tegwick
8f2ba75e4a
Contract accepted by user-engine; FLEX-DEC-2026-019 accepted. - serve-readback: dedicated pin, no enforcement routes, own caller binding - CheckRequest.purpose hashed into every digest when set; /v1/check refuses it - POST /v1/readback/application_access and GET /v1/readback/systems - optional client_binding on protected systems; readback schemas - schemaguard implements maxItems - T05 added: informed-decision needs an application.access rule over realm-level claims (its lifecycle rules read authentication_audience) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 609675@bnt-lap001 Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212
25 lines
1,012 B
Go
25 lines
1,012 B
Go
package api
|
|
|
|
import "testing"
|
|
|
|
// FLEX-DEC-2026-019: purpose is hashed when set and absent when empty, so an
|
|
// enforcement digest is unchanged and a readback digest can never equal one.
|
|
func TestPurposeEntersDigestsOnlyWhenSet(t *testing.T) {
|
|
request := CheckRequest{
|
|
Subject: SubjectRef{ID: "user:alice"},
|
|
Action: "application.access",
|
|
Resource: ResourceRef{ID: "demo-app", System: "demo-app"},
|
|
}
|
|
legacy := CanonicalDigest(requestDigestMaterial{Subject: request.Subject, Action: request.Action, Resource: request.Resource})
|
|
if RequestDigest(request) != legacy {
|
|
t.Fatal("an empty purpose changed the enforcement digest")
|
|
}
|
|
readback := request
|
|
readback.Purpose = PurposeReadback
|
|
if RequestDigest(readback) == RequestDigest(request) || ApprovalBindingDigest(readback) == ApprovalBindingDigest(request) {
|
|
t.Fatal("purpose did not enter the digests")
|
|
}
|
|
if binding := NewDecisionBinding(readback); binding.Purpose != PurposeReadback {
|
|
t.Fatalf("binding purpose = %q", binding.Purpose)
|
|
}
|
|
}
|