coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make undeclared policy attribute reads a validate error.

Browse source 
FLEX-WP-0025-T03: flex-auth validate flags input.*.attributes keys that
no sibling registry or manifest supplies. A broken testdata package
proves tests can pass while the ceiling remains caller-only.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
tegwick 2026-09-14 09:54:09 +02:00
parent 80cae28a74
commit c074237aac
10 changed files with 401 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

34
internal/policy/package_test.go
View file

@ -122,6 +122,40 @@ func TestCaringFindingsAreAdvisoryUntilEnforced(t *testing.T) {
}
}
func TestValidateFlagsUndeclaredAttributeRead(t *testing.T) {
pkg, err := policy.LoadAndValidateFile(context.Background(), filepath.Join("testdata", "undeclared-ceiling", "policy_package.md"))
if err != nil {
t.Fatalf("LoadAndValidateFile: %v", err)
}
if pkg.Valid {
t.Fatalf("pkg.Valid = true; want undeclared ceiling to fail validate\n%s", formatValidation(pkg.Validation))
}
found := false
for _, diagnostic := range pkg.Validation.Diagnostics {
if diagnostic.Code == "POLICY-ATTRIBUTE-UNDECLARED" && strings.Contains(diagnostic.Message, "max_ttl_hours") {
found = true
if diagnostic.Severity != "error" {
t.Fatalf("undeclared diagnostic severity = %q; want error", diagnostic.Severity)
}
}
}
if !found {
t.Fatalf("missing POLICY-ATTRIBUTE-UNDECLARED for max_ttl_hours\n%s", formatValidation(pkg.Validation))
}
}
func TestOpsWardenAttributeReadsAreDeclared(t *testing.T) {
pkg, err := policy.LoadAndValidateFile(context.Background(), filepath.Join("..", "..", "examples", "ops-warden", "policy_package.md"))
if err != nil {
t.Fatalf("LoadAndValidateFile: %v", err)
}
for _, diagnostic := range pkg.Validation.Diagnostics {
if diagnostic.Code == "POLICY-ATTRIBUTE-UNDECLARED" {
t.Fatalf("ops-warden undeclared attribute: %s", diagnostic.Message)
}
}
}
func TestFixtureMismatchInvalidatesPackage(t *testing.T) {
pkg, err := policy.Load([]byte(inlinePolicy(false, "deny")), "inline-policy.md")
if err != nil {