coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(policy): adopt security zone stances
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 33s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
This commit is contained in:
tegwick 2026-08-22 15:17:13 +02:00
parent fbef547cfa
commit e521e7b715
8 changed files with 248 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

36
cmd/flex-auth/main_test.go
View file

@ -262,31 +262,34 @@ func TestOpsWardenProductionRegistryActors(t *testing.T) {
wantReason string
}{
{
name: "state hub bridge agent allow",
name: "state hub bridge agent advisory while zone is unknown",
subjectID: "agt-state-hub-bridge",
actor: "agt-state-hub-bridge",
actorType: "agt",
principal: "agt-task-bridge",
ttlHours: 1,
wantEffect: api.DecisionEffectAllow,
wantEffect: api.DecisionEffectAuditOnly,
wantReason: "advisory_would_signing_policy_matched",
},
{
name: "state hub bridge IAM subject allow",
name: "state hub bridge IAM subject advisory while zone is unknown",
subjectID: "iam:agt-state-hub-bridge",
actor: "agt-state-hub-bridge",
actorType: "agt",
principal: "agt-task-bridge",
ttlHours: 1,
wantEffect: api.DecisionEffectAllow,
wantEffect: api.DecisionEffectAuditOnly,
wantReason: "advisory_would_signing_policy_matched",
},
{
name: "codex interhub bootstrap agent allow",
name: "codex interhub bootstrap advisory while zone is unknown",
subjectID: "agt-codex-interhub-bootstrap",
actor: "agt-codex-interhub-bootstrap",
actorType: "agt",
principal: "agt-interhub-bootstrap",
ttlHours: 1,
wantEffect: api.DecisionEffectAllow,
wantEffect: api.DecisionEffectAuditOnly,
wantReason: "advisory_would_signing_policy_matched",
},
{
name: "admin actor allow",
@ -298,33 +301,34 @@ func TestOpsWardenProductionRegistryActors(t *testing.T) {
wantEffect: api.DecisionEffectAllow,
},
{
name: "automation actor allow",
name: "automation actor advisory while zone is unknown",
subjectID: "atm-backup-daily",
actor: "atm-backup-daily",
actorType: "atm",
principal: "atm-backup-daily",
ttlHours: 1,
wantEffect: api.DecisionEffectAllow,
wantEffect: api.DecisionEffectAuditOnly,
wantReason: "advisory_would_signing_policy_matched",
},
{
name: "ttl above production max denies",
name: "ttl above production max is advisory while zone is unknown",
subjectID: "agt-state-hub-bridge",
actor: "agt-state-hub-bridge",
actorType: "agt",
principal: "agt-task-bridge",
ttlHours: 999,
wantEffect: api.DecisionEffectDeny,
wantReason: "ttl_out_of_bounds",
wantEffect: api.DecisionEffectAuditOnly,
wantReason: "advisory_would_ttl_out_of_bounds",
},
{
name: "unregistered production actor denies",
name: "unregistered production actor is advisory unknown",
subjectID: "agt-missing",
actor: "agt-missing",
actorType: "agt",
principal: "agt-missing",
ttlHours: 1,
wantEffect: api.DecisionEffectDeny,
wantReason: "unknown_actor_resource",
wantEffect: api.DecisionEffectAuditOnly,
wantReason: "advisory_would_unknown_actor_resource",
},
}
@ -340,8 +344,8 @@ func TestOpsWardenProductionRegistryActors(t *testing.T) {
if tt.wantReason != "" && decision.Reason != tt.wantReason {
t.Fatalf("decision.Reason = %q; want %q; decision: %+v", decision.Reason, tt.wantReason, decision)
}
if tt.wantEffect == api.DecisionEffectAllow && decision.ID == "" {
t.Fatal("allow decision ID is empty")
if (tt.wantEffect == api.DecisionEffectAllow || tt.wantEffect == api.DecisionEffectAuditOnly) && decision.ID == "" {
t.Fatal("proceeding decision ID is empty")
}
})
}