coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Authorize tenant-engine guardrail read and set actions
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 39s
Details
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
FLEX-WP-0014. Package tenant-engine.write-api.mutate v1 now carries
nine actions: tenant.guardrail.read and tenant.guardrail.set on
resource type guardrail, verbatim from tenant-engine's mapping.

The read/write split is used now: flex-auth may read ceilings and is
denied action_not_granted on set; tenant-engine may do both. 17/17
Rego tests and 23/23 fixtures pass. Live e2e against a real
tenant-engine FlexAuthWriteAuthorizer matches.

In source only; production still serves the seven-action 9320df39 pin.
This commit is contained in:
tegwick 2026-08-16 02:46:25 +02:00
parent 8563c17a9f
commit f304688d72
13 changed files with 627 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

35
examples/tenant-engine/README.md
View file

@ -8,12 +8,12 @@ protected-system consumer, gating its own write API
| File | Purpose |
| --- | --- |
| `protected_system_manifest.yaml` | Resource types (`tenant`, `role-grant`, `plan-assignment`) and the seven actions: `tenant.create`, `tenant.role.grant`, `tenant.role.revoke`, `tenant.plan.assign`, plus the `FLEX-WP-0010` lifecycle actions `tenant.update`, `tenant.retire`, `tenant.reactivate` |
| `subject_manifest.yaml` | The one registered caller: `tenant-engine`'s own service identity |
| `protected_system_manifest.yaml` | Resource types (`tenant`, `role-grant`, `plan-assignment`, `guardrail`) and the nine actions: the original four, the `FLEX-WP-0010` lifecycle trio, and the `FLEX-WP-0014` guardrail pair `tenant.guardrail.read` / `tenant.guardrail.set` |
| `subject_manifest.yaml` | Two registered callers: `tenant-engine` (all nine actions) and `flex-auth` (read-only on `tenant.guardrail.read`) |
| `policy_package.md` | Rego rules + embedded tests gating the write API |
| `policy_fixtures.yaml` | Allow/deny request/decision pairs, referenced by `policy_package.md`'s frontmatter |
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `flex-auth serve`/`check`/`load-registry` |
| `check_request_allow_create.json`, `check_request_deny_unknown_subject.json`, `check_request_allow_retire.json`, `check_request_deny_misspelled_lifecycle.json` | Standalone example requests for `flex-auth check` |
| `check_request_allow_create.json`, `check_request_deny_unknown_subject.json`, `check_request_allow_retire.json`, `check_request_deny_misspelled_lifecycle.json`, `check_request_allow_guardrail_read.json`, `check_request_allow_guardrail_set.json`, `check_request_deny_guardrail_set_as_reader.json`, `check_request_deny_misspelled_guardrail.json` | Standalone example requests for `flex-auth check` |
**No `resource_manifest.yaml`** — unlike ops-warden's fixed SSH-certificate
inventory, `tenant-engine`'s resources (tenants) are created dynamically.
@ -88,8 +88,33 @@ driven through the client, which only ever emits the seven registered strings
| `tenant.retired` (typo) | deny `unknown_action` | `decision:30946c43cbe80bfc` |
| unregistered subject | deny `unknown_subject` | `decision:7b107e73cf16fab9` |
Rollback target is `sha256:c25fc34a…` (four-action). TEN-WP-0006 guardrail
actions are **not** in this image.
Rollback target is `sha256:c25fc34a…` (four-action).
## Verified — guardrail actions (FLEX-WP-0014-T03, 2026-08-16)
`test-policy` reports **17/17 Rego tests and 23/23 fixtures passing**, the
registry loads (2 subjects, 2 groups), and `go test ./...` / `gofmt` /
`go vet` are clean.
End-to-end over real HTTP: a live `flex-auth serve` on `127.0.0.1:9098`
loaded with this registry and policy, and a real `tenant-engine`
(`TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098`) driven through its
unmodified `FlexAuthWriteAuthorizer`:
| Call | tenant-engine | flex-auth decision |
| --- | --- | --- |
| `POST /tenants` actor=`tenant-engine` | 201 | allow `write_api_policy_matched` |
| `GET .../guardrails?actor=flex-auth` | 200 grouping `spend.monthly=25000` | allow |
| `GET .../guardrails?actor=ops` | 403 `write_denied` | deny `unknown_subject` |
| `PUT .../guardrails/spend.monthly` actor=`tenant-engine` | 200 override `9000` v2 | allow |
| `PUT ...` actor=`flex-auth` | 403 `write_denied` | deny `action_not_granted` |
| `PUT ...` actor=`ops` | 403 `write_denied` | deny `unknown_subject` |
**In source, not yet in the production image.** The live
`flex-auth-tenant-engine` Deployment still serves the seven-action
`sha256:9320df39` pin. A CI-built image from this commit plus a pin
restore is the remaining step before a live guardrail check succeeds
against the cluster Service.
## Related