flex-auth/tools/exercise_t03_review_policy.py

import json,time,copy,subprocess,tempfile
from pathlib import Path
import argparse
p=argparse.ArgumentParser();p.add_argument('--binary',required=True);p.add_argument('--receipt',type=Path,required=True);args=p.parse_args()
r=Path(__file__).resolve().parents[1]/'examples/informed-decision-t03'
records=json.loads((r/'records.json').read_text())
results=[]
with tempfile.TemporaryDirectory() as temp:
    request_path=Path(temp)/'request.json'
    def check(name,request,expected):
        request_path.write_text(json.dumps(request))
        result=subprocess.run([args.binary,'check','--registry',str(r/'registry.json'),'--policy',str(r/'policy.md'),'--request',str(request_path)],capture_output=True,text=True,check=True)
        d=json.loads(result.stdout)
        assert d['effect']==expected,(name,d)
        results.append({'check':name,'effect':d['effect']})
        return d
    for memo,record in records.items():
        request={'id':'local-regression','tenant':'tenant:platform','subject':{'id':'synthetic-reviewer','type':'human','tenant':'tenant:platform','attributes':{'groups':['net-kingdom-admins'],'roles':[],'tenant_source':'registration-supplied','principal_type_source':'authentication-derived','assurance':{'level':'aal2','mfa':True,'methods':['pwd','otp'],'source':'key-cape','at':int(time.time())}}},'resource':{'id':memo,'type':'decision-memo','system':'informed-decision','tenant':'tenant:platform'},'action':'accept','context':{'memo_version':record['memo_version'],'approval_id':record['approval_id'],'approval_binding_digest':record['binding_digest']},'policy_version':'v1'}
        for action in ['read','acknowledge','accept','return','discuss','decline']:
            d=check(record['action']+':'+action,request|{'action':action},'allow')
        for name,path,value in [('wrong-group',['subject','attributes','groups'],['net-kingdom-users']),('no-group',['subject','attributes','groups'],[]),('service',['subject','type'],'service'),('stale-mfa',['subject','attributes','assurance','at'],int(time.time())-901),('future-mfa',['subject','attributes','assurance','at'],int(time.time())+300),('no-mfa',['subject','attributes','assurance','mfa'],False),('forged-human-route',['subject','attributes','principal_type_source'],'registration-supplied'),('wrong-tenant',['subject','tenant'],'tenant:other'),('other-memo',['resource','id'],'memo:other'),('changed-version',['context','memo_version'],record['memo_version']+1),('changed-approval',['context','approval_id'],'other'),('changed-digest',['context','approval_binding_digest'],'sha256:'+'0'*64),('consume',['action'],'consume')]:
            candidate=copy.deepcopy(request); target=candidate
            for key in path[:-1]:target=target[key]
            target[path[-1]]=value
            check(record['action']+':'+name,candidate,'deny')
args.receipt.write_text(json.dumps({'scope':'local actual evaluator with synthetic identity; no live human approvals','checks':results},indent=2)+'\n')
print(len(results),'policy checks passed')