coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(authz): bind decisions to exact actions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
This commit is contained in:
tegwick 2026-08-23 13:18:26 +02:00
parent 7323dd1a60
commit c473f1971d
28 changed files with 644 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

9
internal/decision/engine_test.go
View file

@ -49,6 +49,15 @@ func TestCheckUsesExplicitCaringContext(t *testing.T) {
if got.Resource.Type != "document" || got.Resource.Attributes["trust_zone"] != "internal" {
t.Errorf("got.Resource = %+v; want enriched document resource", got.Resource)
}
if got.Binding == nil {
t.Fatal("got.Binding is nil")
}
if got.Binding.Action != request.Action || got.Binding.Subject.ID != got.Subject.ID || got.Binding.Resource.ID != got.Resource.ID {
t.Errorf("got.Binding = %+v; want normalized action, subject, and resource", got.Binding)
}
if !strings.HasPrefix(got.Binding.RequestDigest, "sha256:") || len(got.Binding.RequestDigest) != len("sha256:")+64 {
t.Errorf("got.Binding.RequestDigest = %q; want full SHA-256 digest", got.Binding.RequestDigest)
}
if got.Caring == nil || got.Caring.Descriptor == nil {
t.Fatal("got.Caring.Descriptor is nil")
}