access-engine/cmd/access-engine/runtime_rename_test.go

package main

import (
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"github.com/netkingdom/access-engine/internal/callerauth"
	"github.com/netkingdom/access-engine/internal/policy"
	"github.com/netkingdom/access-engine/pkg/api"
	"gopkg.in/yaml.v3"
)

// The packages name their protected consumer, not the PDP. Authenticate both
// PDP audiences against exactly the installed mapping, then compare real engine
// outcomes and canonical request bindings with the unchanged package baseline.
func TestRuntimeRenamePinPackagesPreserveDecisionMaterial(t *testing.T) {
	for _, pin := range []string{"ops-warden", "ops-warden-fetch", "secrets-engine", "user-engine", "tenant-engine", "informed-decision-lifecycle", "informed-decision-sitting", "informed-decision-t03"} {
		t.Run(pin, func(t *testing.T) {
			raw, err := os.ReadFile(filepath.Join("..", "..", "values", pin+".yaml"))
			if err != nil {
				t.Fatal(err)
			}
			var values struct {
				Args       []string `yaml:"args"`
				CallerAuth struct {
					Binding string   `yaml:"binding"`
					Extra   []string `yaml:"extraBindings"`
				} `yaml:"callerAuth"`
			}
			if err := yaml.Unmarshal(raw, &values); err != nil {
				t.Fatal(err)
			}
			bindings := map[string]string{}
			for _, entry := range append([]string{values.CallerAuth.Binding}, values.CallerAuth.Extra...) {
				system, principal, ok := strings.Cut(entry, "=")
				if !ok {
					t.Fatalf("bad mapping: %s", entry)
				}
				bindings[system] = principal
			}
			paths := map[string]string{}
			for i := 0; i+1 < len(values.Args); i++ {
				if values.Args[i] == "--registry" || values.Args[i] == "--policy" {
					paths[values.Args[i]] = filepath.Join("..", "..", strings.TrimPrefix(values.Args[i+1], "/opt/flex-auth/"))
				}
			}
			pkg, err := policy.LoadFile(paths["--policy"])
			if err != nil {
				t.Fatal(err)
			}
			engine, err := buildEngine(context.Background(), paths["--registry"], paths["--policy"], "")
			if err != nil {
				t.Fatal(err)
			}
			if len(pkg.Fixtures) == 0 {
				t.Fatal("package has no decision fixtures")
			}
			exercised := 0
			for _, fixture := range pkg.Fixtures {
				principal, installed := bindings[fixture.Request.Resource.System]
				if !installed {
					continue
				}
				baseline, err := engine.Check(context.Background(), fixture.Request)
				if err != nil {
					t.Fatalf("baseline %s: %v", fixture.ID, err)
				}
				original := api.CanonicalDigest(fixture.Request)
				for _, audience := range []string{"flex-auth", "access-engine"} {
					a, err := callerauth.New(callerauth.ModeEnforce, fixedTokenReviewer{identity: callerauth.Identity{Username: principal, Audiences: []string{audience}}}, "flex-auth", bindings, nil)
					if err != nil {
						t.Fatal(err)
					}
					identity, err := a.Authorize(context.Background(), "Bearer test-token", []string{fixture.Request.Resource.System})
					if err != nil {
						t.Fatal(err)
					}
					got, err := engine.Check(callerauth.WithRecord(context.Background(), a.Record(identity)), fixture.Request)
					if err != nil {
						t.Fatalf("%s/%s: %v", fixture.ID, audience, err)
					}
					if got.Effect != baseline.Effect || got.Reason != baseline.Reason || got.Binding.RequestDigest != baseline.Binding.RequestDigest {
						t.Fatalf("%s/%s decision material changed", fixture.ID, audience)
					}
					if got.Provenance.Caller.Audience != audience {
						t.Fatal("requested audience spelling lost")
					}
					if got.Resource.System != fixture.Request.Resource.System || got.Binding.Resource.System != fixture.Request.Resource.System {
						t.Fatal("resource.system spelling changed")
					}
					if api.CanonicalDigest(fixture.Request) != original {
						t.Fatal("original request silently rewritten")
					}
				}
				exercised++
			}
			if exercised == 0 {
				t.Fatal("no installed-system fixtures exercised")
			}
			t.Logf("%d owner-installed package fixtures preserved with both audiences", exercised)
		})
	}
}

func TestRuntimeRenameReadbackRoutesPreserveCallerBoundary(t *testing.T) {
	for _, audience := range []string{"flex-auth", "access-engine"} {
		for _, principal := range []string{readbackPrincipal, "system:serviceaccount:other:caller"} {
			a, err := callerauth.New(callerauth.ModeEnforce, fixedTokenReviewer{identity: callerauth.Identity{Username: principal, Audiences: []string{audience}}}, "flex-auth", map[string]string{readbackBinding: readbackPrincipal}, nil)
			if err != nil {
				t.Fatal(err)
			}
			server := httptest.NewServer(newReadbackMux(newTestReadback(t), a))
			valid, _ := json.Marshal(subjectRequest("user:alice", true, "demo-app"))
			got := postReadback(t, server.URL, string(valid)).StatusCode
			server.Close()
			want := http.StatusForbidden
			if principal == readbackPrincipal {
				want = http.StatusOK
			}
			if got != want {
				t.Fatalf("%s/%s: status %d want %d", audience, principal, got, want)
			}
		}
	}
}