tegwick
bc92f95e5f
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
69 lines
2.9 KiB
Go
69 lines
2.9 KiB
Go
package policy_test
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"github.com/netkingdom/access-engine/internal/policy"
|
|
"github.com/netkingdom/access-engine/pkg/api"
|
|
"github.com/open-policy-agent/opa/rego"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestServiceTaskExecutionSourcePredicateAndHardRefusal(t *testing.T) {
|
|
p, e := policy.LoadAndValidateFile(context.Background(), filepath.Join("..", "..", "examples", "secrets-engine-service-task-execution", "policy_package.md"))
|
|
if e != nil || !p.Valid {
|
|
t.Fatalf("package %v %+v", e, p.Validation)
|
|
}
|
|
out, e := exec.Command("/home/worsch/secrets-engine/.venv/bin/python", "../../tools/service_task_execution_fixture.py").Output()
|
|
if e != nil {
|
|
t.Fatal("actual Secrets descriptor generator", e)
|
|
}
|
|
var f struct {
|
|
Request api.CheckRequest `json:"request"`
|
|
}
|
|
if json.Unmarshal(out, &f) != nil {
|
|
t.Fatal("fixture")
|
|
}
|
|
candidate := func(r api.CheckRequest) bool {
|
|
b, _ := json.Marshal(r)
|
|
var input map[string]any
|
|
json.Unmarshal(b, &input)
|
|
result, e := rego.New(rego.Query("data.flexauth.secrets_engine.service_task_execution.candidate_matches"), rego.Module("candidate.rego", p.RegoModule), rego.Input(input)).Eval(context.Background())
|
|
if e != nil {
|
|
t.Fatal(e)
|
|
}
|
|
return len(result) > 0
|
|
}
|
|
if !candidate(f.Request) {
|
|
t.Fatal("supported synthetic service contract failed predicate")
|
|
}
|
|
d, e := p.Evaluate(context.Background(), f.Request)
|
|
if e != nil || d.Effect != api.DecisionEffectDeny || d.Reason != "service_execution_integration_unadmitted" {
|
|
t.Fatal("unintegrated source package opened")
|
|
}
|
|
cases := map[string]func(*api.CheckRequest){"human": func(r *api.CheckRequest) { r.Subject.Type = "human" }, "foreigntenant": func(r *api.CheckRequest) { r.Tenant = "tenant:coulomb" }, "apply": func(r *api.CheckRequest) { r.Action = "apply" }, "servicecaller": func(r *api.CheckRequest) {
|
|
r.Context["service_actor_binding"].(map[string]any)["transport_principal"] = "another"
|
|
}, "missing human control": func(r *api.CheckRequest) {
|
|
r.Context["approval"].(map[string]any)["binding"].(map[string]any)["human_control"] = false
|
|
}, "consumed": func(r *api.CheckRequest) { r.Context["approval"].(map[string]any)["consumed"] = true }, "PDP digest": func(r *api.CheckRequest) {
|
|
r.Context["approval"].(map[string]any)["binding"].(map[string]any)["pdp_digest"] = ""
|
|
}, "expired observation": func(r *api.CheckRequest) {
|
|
r.Context["approval"].(map[string]any)["freshness"].(map[string]any)["not_after"] = "2000-01-01T00:00:00Z"
|
|
}, "wrong operation": func(r *api.CheckRequest) {
|
|
r.Context["execution_contract"].(map[string]any)["operation"] = "generic-apply"
|
|
}}
|
|
for name, mutate := range cases {
|
|
t.Run(name, func(t *testing.T) {
|
|
var f struct {
|
|
Request api.CheckRequest `json:"request"`
|
|
}
|
|
json.Unmarshal(out, &f)
|
|
mutate(&f.Request)
|
|
if candidate(f.Request) {
|
|
t.Fatal("unsupported source contract matched")
|
|
}
|
|
})
|
|
}
|
|
}
|