coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Cover wrong-tenant denials in ops-warden and railiance-platform fixtures.

Browse source 
FLEX-WP-0022-T03: the rules already refused a foreign tenant; the fixture
suites never varied the field. No policy or version change. Asked
tenant-engine to name the CheckRequest tenant relation for T01/T02.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
This commit is contained in:
tegwick 2026-09-15 23:38:48 +02:00
parent 6fd3a0cbc4
commit 0e020b2d8c
8 changed files with 117 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

1
examples/ops-warden/README.md
View file

@ -28,6 +28,7 @@ flex-auth validate --kind subject-manifest --file examples/ops-warden/subject_ma
flex-auth load-registry --file examples/ops-warden/registry_snapshot.json
flex-auth test-policy --file examples/ops-warden/policy_package.md
flex-auth check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_allow_adm.json
flex-auth check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_deny_wrong_tenant.json
```
The fixture public-key fingerprints are examples only. Do not put real keys,

23
examples/ops-warden/check_request_deny_wrong_tenant.json Normal file
View file

@ -0,0 +1,23 @@
{
"id": "check:ops-warden-wrong-tenant",
"tenant": "tenant:other",
"subject": {
"id": "platform-steward",
"type": "adm"
},
"action": "sign",
"resource": {
"id": "ssh-cert:actor/platform-steward",
"type": "ssh-certificate",
"system": "ops-warden"
},
"context": {
"principals": [
"platform",
"root"
],
"actor_type": "adm",
"ttl_hours": 4,
"pubkey_fingerprint": "SHA256:example-adm-fingerprint"
}
}

45
examples/ops-warden/policy_fixtures.yaml
View file

@ -394,5 +394,50 @@
"effect": "audit_only",
"reason": "advisory_would_signing_policy_matched"
}
},
{
"id": "fixture:ops-warden-wrong-tenant-deny",
"request": {
"id": "check:ops-warden-wrong-tenant",
"tenant": "tenant:other",
"subject": {
"id": "platform-steward",
"type": "adm"
},
"action": "sign",
"resource": {
"id": "ssh-cert:actor/platform-steward",
"type": "ssh-certificate",
"system": "ops-warden",
"attributes": {
"actor_id": "platform-steward",
"actor_type": "adm",
"allowed_subjects": [
"platform-steward",
"iam:platform-steward"
],
"allowed_principals": [
"platform",
"root"
],
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
"principals": [
"platform",
"root"
],
"actor_type": "adm",
"ttl_hours": 4,
"pubkey_fingerprint": "SHA256:example-adm-fingerprint"
}
},
"expect": {
"effect": "deny",
"reason": "wrong_tenant"
}
}
]