coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make undeclared policy attribute reads a validate error.

Browse source 
FLEX-WP-0025-T03: flex-auth validate flags input.*.attributes keys that
no sibling registry or manifest supplies. A broken testdata package
proves tests can pass while the ceiling remains caller-only.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
tegwick 2026-09-14 09:54:09 +02:00
parent 80cae28a74
commit c074237aac
10 changed files with 401 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/request-enrichment.md
View file

@ -158,6 +158,21 @@ be inferred from the key name:
Package changes wait until T03 makes "read a declared registry key" a
`flex-auth validate` finding rather than a review note.
## Validate flags undeclared attribute reads (FLEX-WP-0025-T03)
`flex-auth validate --kind policy` now emits
`POLICY-ATTRIBUTE-UNDECLARED` (error) for every
`input.{resource,subject}.attributes.<key>` the package reads that no sibling
`registry_snapshot.json`, `production_registry_snapshot.json`,
`resource_manifest.yaml`, or `subject_manifest.yaml` supplies. First-class
fields enrichment copies (`labels`, `roles`, `groups`, `claims.*`,
`metadata.*`, …) count as supplied.
It cannot tell a ceiling from a lookup. The finding is the set a reviewer
must look at. Demonstrated against
`internal/policy/testdata/undeclared-ceiling/`: tests and fixtures pass, the
package does not, because `max_ttl_hours` is caller-only.
## Which digest a consumer can reproduce
| Field | Over | Consumer-computable |