coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Cover wrong-tenant denials in ops-warden and railiance-platform fixtures.

Browse source 
FLEX-WP-0022-T03: the rules already refused a foreign tenant; the fixture
suites never varied the field. No policy or version change. Asked
tenant-engine to name the CheckRequest tenant relation for T01/T02.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
This commit is contained in:
tegwick 2026-09-15 23:38:48 +02:00
parent 6fd3a0cbc4
commit 0e020b2d8c
8 changed files with 117 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

1
examples/ops-warden/README.md
View file

@ -28,6 +28,7 @@ flex-auth validate --kind subject-manifest --file examples/ops-warden/subject_ma
flex-auth load-registry --file examples/ops-warden/registry_snapshot.json
flex-auth test-policy --file examples/ops-warden/policy_package.md
flex-auth check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_allow_adm.json
flex-auth check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_deny_wrong_tenant.json
```
The fixture public-key fingerprints are examples only. Do not put real keys,

23
examples/ops-warden/check_request_deny_wrong_tenant.json Normal file
View file

@ -0,0 +1,23 @@
{
"id": "check:ops-warden-wrong-tenant",
"tenant": "tenant:other",
"subject": {
"id": "platform-steward",
"type": "adm"
},
"action": "sign",
"resource": {
"id": "ssh-cert:actor/platform-steward",
"type": "ssh-certificate",
"system": "ops-warden"
},
"context": {
"principals": [
"platform",
"root"
],
"actor_type": "adm",
"ttl_hours": 4,
"pubkey_fingerprint": "SHA256:example-adm-fingerprint"
}
}

45
examples/ops-warden/policy_fixtures.yaml
View file

@ -394,5 +394,50 @@
"effect": "audit_only",
"reason": "advisory_would_signing_policy_matched"
}
},
{
"id": "fixture:ops-warden-wrong-tenant-deny",
"request": {
"id": "check:ops-warden-wrong-tenant",
"tenant": "tenant:other",
"subject": {
"id": "platform-steward",
"type": "adm"
},
"action": "sign",
"resource": {
"id": "ssh-cert:actor/platform-steward",
"type": "ssh-certificate",
"system": "ops-warden",
"attributes": {
"actor_id": "platform-steward",
"actor_type": "adm",
"allowed_subjects": [
"platform-steward",
"iam:platform-steward"
],
"allowed_principals": [
"platform",
"root"
],
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
"principals": [
"platform",
"root"
],
"actor_type": "adm",
"ttl_hours": 4,
"pubkey_fingerprint": "SHA256:example-adm-fingerprint"
}
},
"expect": {
"effect": "deny",
"reason": "wrong_tenant"
}
}
]

4
examples/railiance-platform/README.md
View file

@ -2,7 +2,8 @@
This package provides the flex-auth side of `FLEX-WP-0012`: registered grant
metadata, representative requester subjects, a default-deny `issue` policy,
and fixtures for TTL, actor type, purpose, delivery mode, and unknown grants.
and fixtures for TTL, actor type, purpose, delivery mode, unknown grants, and
wrong tenant.
The wire translation is intentionally outside the policy. Both candidate
integration shapes must emit `requested_ttl_seconds` as a positive number;
@ -13,4 +14,5 @@ go run ./cmd/flex-auth load-registry --file examples/railiance-platform/registry
go run ./cmd/flex-auth test-policy --file examples/railiance-platform/policy_package.md
go run ./cmd/flex-auth check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_allow.json
go run ./cmd/flex-auth check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_deny_unknown.json
go run ./cmd/flex-auth check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_deny_wrong_tenant.json
```

21
examples/railiance-platform/check_request_deny_wrong_tenant.json Normal file
View file

@ -0,0 +1,21 @@
{
"id": "check:credential-grant-wrong-tenant-http-shape",
"tenant": "tenant:other",
"subject": {
"id": "agent:codex/railiance-platform",
"type": "Agent"
},
"action": "issue",
"resource": {
"id": "credential-grant:rapp-postgres/audit-core-runtime",
"type": "credential-grant",
"system": "railiance-platform"
},
"context": {
"actor_type": "approved-agent",
"bound_subject": "agent:codex/railiance-platform",
"purpose": "audit-core-runtime",
"delivery_mode": "exec-env",
"requested_ttl_seconds": 900
}
}

6
examples/railiance-platform/policy_fixtures.yaml
View file

@ -57,3 +57,9 @@
type: credential-grant
system: railiance-platform
expect: {effect: deny, reason: unknown_grant}
- id: fixture:credential-grant-wrong-tenant-deny
request:
<<: *allow_request
id: check:credential-grant-wrong-tenant-deny
tenant: tenant:other
expect: {effect: deny, reason: wrong_tenant}