coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Authorize tenant-engine guardrail read and set actions
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 39s
Details

Browse source 
FLEX-WP-0014. Package tenant-engine.write-api.mutate v1 now carries
nine actions: tenant.guardrail.read and tenant.guardrail.set on
resource type guardrail, verbatim from tenant-engine's mapping.

The read/write split is used now: flex-auth may read ceilings and is
denied action_not_granted on set; tenant-engine may do both. 17/17
Rego tests and 23/23 fixtures pass. Live e2e against a real
tenant-engine FlexAuthWriteAuthorizer matches.

In source only; production still serves the seven-action 9320df39 pin.
This commit is contained in:
tegwick 2026-08-16 02:46:25 +02:00
parent 8563c17a9f
commit f304688d72
13 changed files with 627 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

84
examples/tenant-engine/policy_fixtures.yaml
View file

@ -190,5 +190,89 @@
"context": {}
},
"expect": {"effect": "deny", "reason": "wrong_subject_type"}
},
{
"id": "fixture:tenant-engine-guardrail-read-pdp-allow",
"request": {
"id": "check:tenant-engine-guardrail-read-pdp",
"tenant": "tenant:friendly:binky",
"subject": {"id": "flex-auth", "type": "service"},
"action": "tenant.guardrail.read",
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
"context": {}
},
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
},
{
"id": "fixture:tenant-engine-guardrail-read-writer-allow",
"request": {
"id": "check:tenant-engine-guardrail-read-writer",
"tenant": "tenant:friendly:binky",
"subject": {"id": "tenant-engine", "type": "service"},
"action": "tenant.guardrail.read",
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
"context": {}
},
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
},
{
"id": "fixture:tenant-engine-guardrail-set-writer-allow",
"request": {
"id": "check:tenant-engine-guardrail-set-writer",
"tenant": "tenant:friendly:binky",
"subject": {"id": "tenant-engine", "type": "service"},
"action": "tenant.guardrail.set",
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
"context": {}
},
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
},
{
"id": "fixture:tenant-engine-guardrail-set-pdp-deny",
"request": {
"id": "check:tenant-engine-guardrail-set-pdp",
"tenant": "tenant:friendly:binky",
"subject": {"id": "flex-auth", "type": "service"},
"action": "tenant.guardrail.set",
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
"context": {}
},
"expect": {"effect": "deny", "reason": "action_not_granted"}
},
{
"id": "fixture:tenant-engine-guardrail-read-unknown-subject-deny",
"request": {
"id": "check:tenant-engine-guardrail-read-ops",
"tenant": "tenant:friendly:binky",
"subject": {"id": "ops", "type": "service"},
"action": "tenant.guardrail.read",
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
"context": {}
},
"expect": {"effect": "deny", "reason": "unknown_subject"}
},
{
"id": "fixture:tenant-engine-guardrail-set-unknown-subject-deny",
"request": {
"id": "check:tenant-engine-guardrail-set-ops",
"tenant": "tenant:friendly:binky",
"subject": {"id": "ops", "type": "service"},
"action": "tenant.guardrail.set",
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
"context": {}
},
"expect": {"effect": "deny", "reason": "unknown_subject"}
},
{
"id": "fixture:tenant-engine-misspelled-guardrail-action-deny",
"request": {
"id": "check:tenant-engine-guardrail-get",
"tenant": "tenant:friendly:binky",
"subject": {"id": "flex-auth", "type": "service"},
"action": "tenant.guardrail.get",
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
"context": {}
},
"expect": {"effect": "deny", "reason": "unknown_action"}
}
]