tegwick
7ad8dec85e
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
25 lines
1.6 KiB
Go
25 lines
1.6 KiB
Go
package policy_test
|
|
|
|
import (
|
|
"context"
|
|
"path/filepath"
|
|
"testing"
|
|
"github.com/netkingdom/access-engine/internal/policy"
|
|
"github.com/netkingdom/access-engine/pkg/api"
|
|
)
|
|
|
|
func TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal(t *testing.T) {
|
|
pkg,err:=policy.LoadAndValidateFile(context.Background(),filepath.Join("..","..","examples","secrets-engine","policy_package.md"))
|
|
if err!=nil || !pkg.Valid {t.Fatalf("policy load: %v",err)}
|
|
r:=api.CheckRequest{Tenant:"tenant:platform",Subject:api.SubjectRef{ID:"secrets-engine",Type:"service"},Action:"execute-ccr",Resource:api.ResourceRef{ID:"catalog:test",Type:"secret-catalog-lane",System:"secrets-engine"},Context:map[string]any{"execution_contract":map[string]any{"operation":"metadata-apply-ccr"}}}
|
|
result,err:=pkg.Evaluate(context.Background(),r)
|
|
if err!=nil || result.Effect!=api.DecisionEffectDeny || result.Reason!="unknown_action" {t.Fatalf("new action: %+v %v",result,err)}
|
|
// Existing apply ignores execution_contract content; its allow is not exact task authority.
|
|
r.Action="apply"
|
|
r.Context["execution_contract"]=map[string]any{"operation":"arbitrary-mutation","payload_sha256":"forged"}
|
|
result,err=pkg.Evaluate(context.Background(),r)
|
|
if err!=nil || result.Effect!=api.DecisionEffectAllow {t.Fatalf("existing apply gap characterization: %+v %v",result,err)}
|
|
r.Subject=api.SubjectRef{ID:"founder-unregistered",Type:"human"}
|
|
result,err=pkg.Evaluate(context.Background(),r)
|
|
if err!=nil || result.Effect!=api.DecisionEffectDeny || result.Reason!="wrong_subject_type" {t.Fatalf("human principal: %+v %v",result,err)}
|
|
}
|