coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(policy): add credential grant authorization package
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
This commit is contained in:
tegwick 2026-08-23 13:59:03 +02:00
parent df54c1b8f5
commit acbaa4a7c9
12 changed files with 476 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

34
cmd/flex-auth/main_test.go
View file

@ -103,6 +103,36 @@ func TestRunCheckOpsWarden(t *testing.T) {
}
}
func TestRunRailiancePlatformCredentialGrantContract(t *testing.T) {
var stdout, stderr bytes.Buffer
code := run([]string{"test-policy", "--file", railiancePlatformPath("policy_package.md")}, &stdout, &stderr)
if code != 0 || !strings.Contains(stdout.String(), `"valid": true`) {
t.Fatalf("test-policy code = %d, stderr = %s, stdout = %s", code, stderr.String(), stdout.String())
}
stdout.Reset()
stderr.Reset()
code = run([]string{
"check",
"--registry", railiancePlatformPath("registry_snapshot.json"),
"--policy", railiancePlatformPath("policy_package.md"),
"--request", railiancePlatformPath("check_request_allow.json"),
}, &stdout, &stderr)
if code != 0 {
t.Fatalf("check code = %d, stderr = %s", code, stderr.String())
}
var decision api.DecisionEnvelope
if err := json.Unmarshal(stdout.Bytes(), &decision); err != nil {
t.Fatal(err)
}
if decision.Effect != api.DecisionEffectAllow || decision.Reason != "credential_grant_allowed" {
t.Fatalf("decision = %s/%s; want allow/credential_grant_allowed", decision.Effect, decision.Reason)
}
if decision.Binding == nil || decision.Binding.Context["requested_ttl_seconds"] != float64(900) {
t.Fatalf("binding = %+v; want normalized numeric TTL", decision.Binding)
}
}
func TestServeOpsWardenCheckContract(t *testing.T) {
logPath := filepath.Join(t.TempDir(), "decisions.jsonl")
engine, err := buildEngine(context.Background(), opsPath("registry_snapshot.json"), opsPath("policy_package.md"), logPath)
@ -370,6 +400,10 @@ func opsPath(name string) string {
return filepath.Join("..", "..", "examples", "ops-warden", name)
}
func railiancePlatformPath(name string) string {
return filepath.Join("..", "..", "examples", "railiance-platform", name)
}
func opsWardenProductionSignRequest(subjectID, actor, actorType, principal string, ttlHours float64) api.CheckRequest {
return api.CheckRequest{
ID: "check:ops-warden-production-" + actor,