28 lines
2.9 KiB
Python
28 lines
2.9 KiB
Python
|
import json,time,copy,subprocess,tempfile
|
||
|
|
from pathlib import Path
|
||
|
|
import argparse
|
||
|
|
p=argparse.ArgumentParser();p.add_argument('--binary',required=True);p.add_argument('--receipt',type=Path,required=True);args=p.parse_args()
|
||
|
|
r=Path(__file__).resolve().parents[1]/'examples/informed-decision-t03'
|
||
|
|
records=json.loads((r/'records.json').read_text())
|
||
|
|
results=[]
|
||
|
|
with tempfile.TemporaryDirectory() as temp:
|
||
|
|
request_path=Path(temp)/'request.json'
|
||
|
|
def check(name,request,expected):
|
||
|
|
request_path.write_text(json.dumps(request))
|
||
|
|
result=subprocess.run([args.binary,'check','--registry',str(r/'registry.json'),'--policy',str(r/'policy.md'),'--request',str(request_path)],capture_output=True,text=True,check=True)
|
||
|
|
d=json.loads(result.stdout)
|
||
|
|
assert d['effect']==expected,(name,d)
|
||
|
|
results.append({'check':name,'effect':d['effect']})
|
||
|
|
return d
|
||
|
|
for memo,record in records.items():
|
||
|
|
request={'id':'local-regression','tenant':'tenant:platform','subject':{'id':'synthetic-reviewer','type':'human','tenant':'tenant:platform','attributes':{'groups':['net-kingdom-admins'],'roles':[],'tenant_source':'registration-supplied','principal_type_source':'authentication-derived','assurance':{'level':'aal2','mfa':True,'methods':['pwd','otp'],'source':'key-cape','at':int(time.time())}}},'resource':{'id':memo,'type':'decision-memo','system':'informed-decision','tenant':'tenant:platform'},'action':'accept','context':{'memo_version':1,'approval_id':record['approval_id'],'approval_binding_digest':record['binding_digest']},'policy_version':'v1'}
|
||
|
|
for action in ['read','acknowledge','accept','return','discuss','decline']:
|
||
|
|
d=check(record['action']+':'+action,request|{'action':action},'allow')
|
||
|
|
for name,path,value in [('wrong-group',['subject','attributes','groups'],['net-kingdom-users']),('no-group',['subject','attributes','groups'],[]),('service',['subject','type'],'service'),('stale-mfa',['subject','attributes','assurance','at'],int(time.time())-901),('future-mfa',['subject','attributes','assurance','at'],int(time.time())+300),('no-mfa',['subject','attributes','assurance','mfa'],False),('forged-human-route',['subject','attributes','principal_type_source'],'registration-supplied'),('wrong-tenant',['subject','tenant'],'tenant:other'),('other-memo',['resource','id'],'memo:other'),('changed-version',['context','memo_version'],2),('changed-approval',['context','approval_id'],'other'),('changed-digest',['context','approval_binding_digest'],'sha256:'+'0'*64),('consume',['action'],'consume')]:
|
||
|
|
candidate=copy.deepcopy(request); target=candidate
|
||
|
|
for key in path[:-1]:target=target[key]
|
||
|
|
target[path[-1]]=value
|
||
|
|
check(record['action']+':'+name,candidate,'deny')
|
||
|
|
args.receipt.write_text(json.dumps({'scope':'local actual evaluator with synthetic identity; no live human approvals','checks':results},indent=2)+'\n')
|
||
|
|
print(len(results),'policy checks passed')
|