tegwick
bc92f95e5f
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
81 lines
3.8 KiB
Go
81 lines
3.8 KiB
Go
package policy_test
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"github.com/netkingdom/access-engine/internal/policy"
|
|
"github.com/netkingdom/access-engine/pkg/api"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestTaskExecutionPackageClosedAdmission(t *testing.T) {
|
|
p, e := policy.LoadAndValidateFile(context.Background(), filepath.Join("..", "..", "examples", "secrets-engine-task-execution", "policy_package.md"))
|
|
if e != nil || !p.Valid {
|
|
t.Fatalf("package: %v %+v", e, p.Validation)
|
|
}
|
|
for _, action := range []string{"execute-ccr", "apply", "exec"} {
|
|
r := api.CheckRequest{Tenant: "tenant:platform", Subject: api.SubjectRef{ID: "secrets-engine", Type: "service"}, Action: action, Resource: api.ResourceRef{ID: "synthetic", Type: "secret-catalog-lane", System: "secrets-engine"}, Context: map[string]any{"owner_admission": true, "verified": true, "human_control": true, "task_execution_projection": map[string]any{"verified": true}}}
|
|
d, e := p.Evaluate(context.Background(), r)
|
|
if e != nil || d.Effect != api.DecisionEffectDeny {
|
|
t.Fatalf("unsigned caller opened admission: %v %+v", e, d)
|
|
}
|
|
}
|
|
}
|
|
func TestTaskExecutionSourceHasNoActivationSwitch(t *testing.T) {
|
|
raw, e := os.ReadFile(filepath.Join("..", "..", "examples", "secrets-engine-task-execution", "policy_package.md"))
|
|
if e != nil {
|
|
t.Fatal(e)
|
|
}
|
|
if !strings.Contains(string(raw), "owner_admission := false") {
|
|
t.Fatal("source refusal gate absent")
|
|
}
|
|
}
|
|
|
|
// The prior human projection contains epoch nanoseconds outside the exact
|
|
// cross-runtime integer profile. Preserve/refuse it; no identity schema change.
|
|
func TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection(t *testing.T) {
|
|
output, e := exec.Command("/home/worsch/secrets-engine/.venv/bin/python", "../../tools/task_execution_interop_fixture.py").Output()
|
|
if e != nil {
|
|
t.Fatal("actual descriptor/canonical generator failed:", e)
|
|
}
|
|
var f struct {
|
|
Request api.CheckRequest `json:"request"`
|
|
RequestDigest string `json:"request_digest"`
|
|
ApprovalDigest string `json:"approval_binding_digest"`
|
|
DescriptorDigest string `json:"descriptor_digest"`
|
|
OriginalProjection map[string]any `json:"original_nanosecond_projection"`
|
|
Refused bool `json:"original_projection_refused"`
|
|
IdentityChanged bool `json:"identity_contract_changed"`
|
|
}
|
|
if json.Unmarshal(output, &f) != nil {
|
|
t.Fatal("fixture JSON")
|
|
}
|
|
if !f.Refused || f.IdentityChanged || f.OriginalProjection["not_after_ns"].(float64) <= float64(1<<53) {
|
|
t.Fatal("unsupported original nanosecond projection was not explicitly preserved/refused")
|
|
}
|
|
if _, found := f.Request.Context["task_execution_projection"]; found {
|
|
t.Fatal("unsupported projection entered descriptor-only request")
|
|
}
|
|
if api.RequestDigest(f.Request) != f.RequestDigest || api.ApprovalBindingDigest(f.Request) != f.ApprovalDigest || api.CanonicalDigest(f.Request.Context["execution_contract"]) != f.DescriptorDigest {
|
|
t.Fatal("actual descriptor-only Python/Go mismatch")
|
|
}
|
|
p, e := policy.LoadAndValidateFile(context.Background(), filepath.Join("..", "..", "examples", "secrets-engine-task-execution", "policy_package.md"))
|
|
if e != nil || !p.Valid {
|
|
t.Fatal("unchanged human source package")
|
|
}
|
|
d, e := p.Evaluate(context.Background(), f.Request)
|
|
if e != nil || d.Effect != api.DecisionEffectDeny || d.Reason != "initiating_provider_unadmitted" {
|
|
t.Fatal("closed human package was enabled")
|
|
}
|
|
// No literal is flipped. Restoring the unsupported caller projection does
|
|
// not turn the unchanged package into a grant either.
|
|
f.Request.Context["task_execution_projection"] = f.OriginalProjection
|
|
d, e = p.Evaluate(context.Background(), f.Request)
|
|
if e != nil || d.Effect != api.DecisionEffectDeny {
|
|
t.Fatal("old caller projection opened package")
|
|
}
|
|
}
|