coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/examples/railiance-platform/README.md
tegwick 0e020b2d8c Cover wrong-tenant denials in ops-warden and railiance-platform fixtures. 
FLEX-WP-0022-T03: the rules already refused a foreign tenant; the fixture
suites never varied the field. No policy or version change. Asked
tenant-engine to name the CheckRequest tenant relation for T01/T02.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
2026-09-15 23:38:48 +02:00

1.3 KiB
Raw Blame History

Railiance Platform credential-grant example

This package provides the flex-auth side of FLEX-WP-0012: registered grant metadata, representative requester subjects, a default-deny issue policy, and fixtures for TTL, actor type, purpose, delivery mode, unknown grants, and wrong tenant.

The wire translation is intentionally outside the policy. Both candidate integration shapes must emit requested_ttl_seconds as a positive number; duration strings such as 15m are rejected rather than guessed.

go run ./cmd/flex-auth load-registry --file examples/railiance-platform/registry_snapshot.json
go run ./cmd/flex-auth test-policy --file examples/railiance-platform/policy_package.md
go run ./cmd/flex-auth check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_allow.json
go run ./cmd/flex-auth check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_deny_unknown.json
go run ./cmd/flex-auth check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_deny_wrong_tenant.json