flex-auth/examples/tenant-engine/policy_fixtures.yaml

[
  {
    "id": "fixture:tenant-engine-create-allow",
    "request": {
      "id": "check:tenant-engine-create-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.create",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-role-grant-allow",
    "request": {
      "id": "check:tenant-engine-role-grant-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.role.grant",
      "resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-role-revoke-allow",
    "request": {
      "id": "check:tenant-engine-role-revoke-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.role.revoke",
      "resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-plan-assign-allow",
    "request": {
      "id": "check:tenant-engine-plan-assign-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.plan.assign",
      "resource": {"id": "t-1", "type": "plan-assignment", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-create-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "some-other-service", "type": "service"},
      "action": "tenant.create",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-wrong-system-deny",
    "request": {
      "id": "check:tenant-engine-create-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.create",
      "resource": {"id": "t-1", "type": "tenant", "system": "some-other-system"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "wrong_system"}
  },
  {
    "id": "fixture:tenant-engine-unknown-action-deny",
    "request": {
      "id": "check:tenant-engine-delete-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.delete",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_action"}
  },
  {
    "id": "fixture:tenant-engine-wrong-subject-type-deny",
    "request": {
      "id": "check:tenant-engine-create-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "human"},
      "action": "tenant.create",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "wrong_subject_type"}
  }
]