coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/examples/railiance-platform
History
tegwick 0e020b2d8c Cover wrong-tenant denials in ops-warden and railiance-platform fixtures. 
FLEX-WP-0022-T03: the rules already refused a foreign tenant; the fixture
suites never varied the field. No policy or version change. Asked
tenant-engine to name the CheckRequest tenant relation for T01/T02.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
2026-09-15 23:38:48 +02:00
..
check_request_allow.json feat(policy): add credential grant authorization package 2026-08-23 13:59:03 +02:00
check_request_deny_unknown.json feat(policy): add credential grant authorization package 2026-08-23 13:59:03 +02:00
check_request_deny_wrong_tenant.json Cover wrong-tenant denials in ops-warden and railiance-platform fixtures. 2026-09-15 23:38:48 +02:00
policy_fixtures.yaml Cover wrong-tenant denials in ops-warden and railiance-platform fixtures. 2026-09-15 23:38:48 +02:00
policy_package.md feat(policy): add credential grant authorization package 2026-08-23 13:59:03 +02:00
protected_system_manifest.yaml feat(policy): add credential grant authorization package 2026-08-23 13:59:03 +02:00
README.md Cover wrong-tenant denials in ops-warden and railiance-platform fixtures. 2026-09-15 23:38:48 +02:00
registry_snapshot.json feat(policy): add credential grant authorization package 2026-08-23 13:59:03 +02:00
resource_manifest.yaml feat(policy): add credential grant authorization package 2026-08-23 13:59:03 +02:00
subject_manifest.yaml feat(policy): add credential grant authorization package 2026-08-23 13:59:03 +02:00

README.md

Railiance Platform credential-grant example

This package provides the flex-auth side of FLEX-WP-0012: registered grant metadata, representative requester subjects, a default-deny issue policy, and fixtures for TTL, actor type, purpose, delivery mode, unknown grants, and wrong tenant.

The wire translation is intentionally outside the policy. Both candidate integration shapes must emit requested_ttl_seconds as a positive number; duration strings such as 15m are rejected rather than guessed.

go run ./cmd/flex-auth load-registry --file examples/railiance-platform/registry_snapshot.json
go run ./cmd/flex-auth test-policy --file examples/railiance-platform/policy_package.md
go run ./cmd/flex-auth check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_allow.json
go run ./cmd/flex-auth check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_deny_unknown.json
go run ./cmd/flex-auth check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_deny_wrong_tenant.json