coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(authz): bind decisions to exact actions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
This commit is contained in:
tegwick 2026-08-23 13:18:26 +02:00
parent 7323dd1a60
commit c473f1971d
28 changed files with 644 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

2
internal/adapters/keycloak/adapter.go
View file

@ -144,6 +144,7 @@ func (a *Adapter) envelope(request api.CheckRequest, authz AuthorizationRequest,
MatchedRule: reason,
Resource: request.Resource,
Subject: request.Subject,
Binding: api.NewDecisionBinding(request),
Diagnostics: diagnostics,
Provenance: api.DecisionProvenance{
Evaluator: EvaluatorName,
@ -168,6 +169,7 @@ func (a *Adapter) failureEnvelope(request api.CheckRequest, authz AuthorizationR
MatchedRule: reason,
Resource: request.Resource,
Subject: request.Subject,
Binding: api.NewDecisionBinding(request),
Diagnostics: failureDiagnostics(authz, kind, err),
Provenance: api.DecisionProvenance{
Evaluator: EvaluatorName,

3
internal/adapters/keycloak/adapter_test.go
View file

@ -86,6 +86,9 @@ func TestAdapterCheckWrapsKeycloakAllow(t *testing.T) {
if got.Effect != api.DecisionEffectAllow || got.Reason != "uma_permission_granted" {
t.Fatalf("decision = %s/%s", got.Effect, got.Reason)
}
if got.Binding == nil || got.Binding.Action != "read" || got.Binding.RequestDigest == "" {
t.Fatalf("binding = %+v; want action-bound request", got.Binding)
}
if got.Provenance.Evaluator != keycloak.EvaluatorName || got.MatchedPolicyVersion != "kc-v2" {
t.Fatalf("provenance = %+v matched=%s", got.Provenance, got.MatchedPolicyVersion)
}

2
internal/adapters/relationship/adapter.go
View file

@ -219,6 +219,7 @@ func (a *Adapter) envelope(request api.CheckRequest, tupleRequest TupleCheckRequ
MatchedRule: firstNonEmpty(result.MatchedRule, reason),
Resource: request.Resource,
Subject: request.Subject,
Binding: api.NewDecisionBinding(request),
Diagnostics: diagnostics,
Provenance: api.DecisionProvenance{
Evaluator: EvaluatorName + "/" + a.backendName,
@ -244,6 +245,7 @@ func (a *Adapter) failureEnvelope(request api.CheckRequest, tupleRequest TupleCh
MatchedRule: reason,
Resource: request.Resource,
Subject: request.Subject,
Binding: api.NewDecisionBinding(request),
Diagnostics: failureDiagnostics(a.backendName, tupleRequest, kind, err),
Provenance: api.DecisionProvenance{
Evaluator: EvaluatorName + "/" + a.backendName,

3
internal/adapters/relationship/adapter_test.go
View file

@ -73,6 +73,9 @@ func TestAdapterCheckPreservesCARINGFromMatchedTuple(t *testing.T) {
if got.Effect != api.DecisionEffectAllow || got.Reason != "direct_tuple" {
t.Fatalf("decision = %s/%s; want allow/direct_tuple", got.Effect, got.Reason)
}
if got.Binding == nil || got.Binding.Action != "read" || got.Binding.RequestDigest == "" {
t.Fatalf("binding = %+v; want action-bound request", got.Binding)
}
if got.Provenance.Evaluator != "relationship-pdp/openfga" || got.Provenance.DirectoryETag != "zed:42" {
t.Fatalf("provenance = %+v", got.Provenance)
}

2
internal/adapters/rule/adapter.go
View file

@ -223,6 +223,7 @@ func (a *Adapter) envelope(request api.CheckRequest, evaluation EvaluationReques
MatchedRule: firstNonEmpty(result.MatchedRule, reason),
Resource: request.Resource,
Subject: request.Subject,
Binding: api.NewDecisionBinding(request),
Obligations: append([]api.Obligation(nil), result.Obligations...),
Diagnostics: diagnostics,
Provenance: api.DecisionProvenance{
@ -248,6 +249,7 @@ func (a *Adapter) failureEnvelope(request api.CheckRequest, evaluation Evaluatio
MatchedRule: reason,
Resource: request.Resource,
Subject: request.Subject,
Binding: api.NewDecisionBinding(request),
Diagnostics: failureDiagnostics(a.backendName, evaluation, kind, err),
Provenance: api.DecisionProvenance{
Evaluator: EvaluatorName + "/" + a.backendName,

3
internal/adapters/rule/adapter_test.go
View file

@ -83,6 +83,9 @@ func TestAdapterCheckWrapsRuleResult(t *testing.T) {
if got.Effect != api.DecisionEffectRedact || got.Reason != "masked_internal_document" {
t.Fatalf("decision = %s/%s", got.Effect, got.Reason)
}
if got.Binding == nil || got.Binding.Action != "read" || got.Binding.RequestDigest == "" {
t.Fatalf("binding = %+v; want action-bound request", got.Binding)
}
if got.Provenance.Evaluator != "rule-pdp/opa" || got.MatchedPolicyVersion != "v2" {
t.Fatalf("provenance = %+v matched=%s", got.Provenance, got.MatchedPolicyVersion)
}

2
internal/adapters/topaz/adapter.go
View file

@ -190,6 +190,7 @@ func (a *Adapter) envelope(request api.CheckRequest, topazRequest DirectoryCheck
MatchedRule: firstNonEmpty(result.MatchedRule, reason),
Resource: request.Resource,
Subject: request.Subject,
Binding: api.NewDecisionBinding(request),
Obligations: append([]api.Obligation(nil), result.Obligations...),
Diagnostics: diagnostics,
Provenance: api.DecisionProvenance{
@ -226,6 +227,7 @@ func (a *Adapter) failureEnvelope(request api.CheckRequest, topazRequest Directo
MatchedRule: reason,
Resource: request.Resource,
Subject: request.Subject,
Binding: api.NewDecisionBinding(request),
Diagnostics: diagnostics,
Provenance: api.DecisionProvenance{
Evaluator: EvaluatorName,

3
internal/adapters/topaz/adapter_test.go
View file

@ -77,6 +77,9 @@ func TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope(t *testing.T) {
if got.Effect != api.DecisionEffectAllow || got.Reason != "topaz_directory_allow" {
t.Fatalf("decision = %s/%s; want allow/topaz_directory_allow", got.Effect, got.Reason)
}
if got.Binding == nil || got.Binding.Action != "read" || got.Binding.RequestDigest == "" {
t.Fatalf("binding = %+v; want action-bound request", got.Binding)
}
if got.Provenance.Evaluator != topaz.EvaluatorName || got.Provenance.Mode != topaz.DelegatedMode {
t.Fatalf("provenance = %+v; want delegated Topaz", got.Provenance)
}