coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Register qonto-assistant as a protected system (finance.qonto.read)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
QONTO-WP-0004-T04. Modeled directly on examples/tenant-engine/: one
resource type (finance-snapshot), one action (finance.qonto.read),
two registered subjects (an agent-harness session identity and the
founder's human identity), and a Rego policy gating on
resource.system + action + subject.type + tenant match. Tenant
capability-role/plan liveness (VEN/CUS) is deliberately NOT encoded
here -- that's qonto-assistant's separate tenant-engine live-lookup
check, per this package's own scope note.

Verified: flex-auth test-policy (6 rego tests + 6 fixtures, all pass),
load-registry, and CLI check for both an allow and a deny case. Also
verified end-to-end over real HTTP: a live flex-auth serve loaded with
this exact registry+policy, hit by qonto-assistant's actual
FlexAuthCheckClient (not a mock) -- allow for tenant:friendly:binky,
deny (wrong_tenant) for a mismatched tenant.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-24 00:19:26 +02:00
parent 0061835d3a
commit ae295824bd
8 changed files with 510 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

74
examples/qonto-assistant/policy_fixtures.yaml Normal file
View file

@ -0,0 +1,74 @@
[
{
"id": "fixture:qonto-assistant-agent-read-allow",
"request": {
"id": "check:qonto-assistant-read-t1",
"tenant": "tenant:friendly:binky",
"subject": {"id": "agent-harness-binky", "type": "agent"},
"action": "finance.qonto.read",
"resource": {"id": "finance-snapshot", "type": "finance-snapshot", "system": "qonto-assistant"},
"context": {}
},
"expect": {"effect": "allow", "reason": "finance_read_policy_matched"}
},
{
"id": "fixture:qonto-assistant-human-read-allow",
"request": {
"id": "check:qonto-assistant-read-t2",
"tenant": "tenant:friendly:binky",
"subject": {"id": "bernd.worsch", "type": "human"},
"action": "finance.qonto.read",
"resource": {"id": "finance-snapshot", "type": "finance-snapshot", "system": "qonto-assistant"},
"context": {}
},
"expect": {"effect": "allow", "reason": "finance_read_policy_matched"}
},
{
"id": "fixture:qonto-assistant-wrong-system-deny",
"request": {
"id": "check:qonto-assistant-read-t3",
"tenant": "tenant:friendly:binky",
"subject": {"id": "agent-harness-binky", "type": "agent"},
"action": "finance.qonto.read",
"resource": {"id": "x", "type": "finance-snapshot", "system": "some-other-system"},
"context": {}
},
"expect": {"effect": "deny", "reason": "wrong_system"}
},
{
"id": "fixture:qonto-assistant-unknown-action-deny",
"request": {
"id": "check:qonto-assistant-read-t4",
"tenant": "tenant:friendly:binky",
"subject": {"id": "agent-harness-binky", "type": "agent"},
"action": "finance.qonto.transfer",
"resource": {"id": "finance-snapshot", "type": "finance-snapshot", "system": "qonto-assistant"},
"context": {}
},
"expect": {"effect": "deny", "reason": "unknown_action"}
},
{
"id": "fixture:qonto-assistant-wrong-subject-type-deny",
"request": {
"id": "check:qonto-assistant-read-t5",
"tenant": "tenant:friendly:binky",
"subject": {"id": "unknown-device", "type": "device"},
"action": "finance.qonto.read",
"resource": {"id": "finance-snapshot", "type": "finance-snapshot", "system": "qonto-assistant"},
"context": {}
},
"expect": {"effect": "deny", "reason": "wrong_subject_type"}
},
{
"id": "fixture:qonto-assistant-wrong-tenant-deny",
"request": {
"id": "check:qonto-assistant-read-t6",
"tenant": "tenant:friendly:some-other-company",
"subject": {"id": "agent-harness-binky", "type": "agent"},
"action": "finance.qonto.read",
"resource": {"id": "finance-snapshot", "type": "finance-snapshot", "system": "qonto-assistant"},
"context": {}
},
"expect": {"effect": "deny", "reason": "wrong_tenant"}
}
]