coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/examples/qonto-assistant
History
tegwick ae295824bd
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Register qonto-assistant as a protected system (finance.qonto.read) 
QONTO-WP-0004-T04. Modeled directly on examples/tenant-engine/: one
resource type (finance-snapshot), one action (finance.qonto.read),
two registered subjects (an agent-harness session identity and the
founder's human identity), and a Rego policy gating on
resource.system + action + subject.type + tenant match. Tenant
capability-role/plan liveness (VEN/CUS) is deliberately NOT encoded
here -- that's qonto-assistant's separate tenant-engine live-lookup
check, per this package's own scope note.

Verified: flex-auth test-policy (6 rego tests + 6 fixtures, all pass),
load-registry, and CLI check for both an allow and a deny case. Also
verified end-to-end over real HTTP: a live flex-auth serve loaded with
this exact registry+policy, hit by qonto-assistant's actual
FlexAuthCheckClient (not a mock) -- allow for tenant:friendly:binky,
deny (wrong_tenant) for a mismatched tenant.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-24 00:19:26 +02:00
..
check_request_allow_read.json Register qonto-assistant as a protected system (finance.qonto.read) 2026-07-24 00:19:26 +02:00
check_request_deny_wrong_tenant.json Register qonto-assistant as a protected system (finance.qonto.read) 2026-07-24 00:19:26 +02:00
policy_fixtures.yaml Register qonto-assistant as a protected system (finance.qonto.read) 2026-07-24 00:19:26 +02:00
policy_package.md Register qonto-assistant as a protected system (finance.qonto.read) 2026-07-24 00:19:26 +02:00
protected_system_manifest.yaml Register qonto-assistant as a protected system (finance.qonto.read) 2026-07-24 00:19:26 +02:00
README.md Register qonto-assistant as a protected system (finance.qonto.read) 2026-07-24 00:19:26 +02:00
registry_snapshot.json Register qonto-assistant as a protected system (finance.qonto.read) 2026-07-24 00:19:26 +02:00
subject_manifest.yaml Register qonto-assistant as a protected system (finance.qonto.read) 2026-07-24 00:19:26 +02:00

README.md

qonto-assistant Consumer Integration Fixtures

QONTO-WP-0004-T04. Registers qonto-assistant as a flex-auth protected-system consumer, gating its finance.qonto.read capability (the live-authorization half of docs/SecurityPractice.md — the other half is a tenant-engine capability-role/plan liveness check, deliberately kept separate; see policy_package.md's scope note).

Files

File Purpose
protected_system_manifest.yaml Resource type (finance-snapshot) and action (finance.qonto.read)
subject_manifest.yaml Registered callers: an agent-harness session identity and the founder's human identity, both in group:qonto-assistant-readers
policy_package.md Rego rules + embedded tests gating the read action
policy_fixtures.yaml Allow/deny request/decision pairs, referenced by policy_package.md's frontmatter
registry_snapshot.json Merged systems/subjects/groups snapshot assembled from the two manifests above, loadable by flex-auth serve/check/load-registry
check_request_allow_read.json, check_request_deny_wrong_tenant.json Standalone example requests for flex-auth check

No resource_manifest.yaml — like tenant-engine's tenants, qonto-assistant doesn't have a fixed enumerable resource inventory to register; the single finance-snapshot resource type is declared on the protected-system manifest and that is sufficient for this policy's coarse per-actor/per-tenant gate.

Verified

go build -o bin/flex-auth ./cmd/flex-auth

# Rego rules + embedded tests + fixtures, all pass:
bin/flex-auth test-policy -file examples/qonto-assistant/policy_package.md

# Registry loads cleanly:
bin/flex-auth load-registry -file examples/qonto-assistant/registry_snapshot.json

# Individual requests via the CLI:
bin/flex-auth check \
  -registry examples/qonto-assistant/registry_snapshot.json \
  -policy examples/qonto-assistant/policy_package.md \
  -request examples/qonto-assistant/check_request_allow_read.json

# End-to-end over real HTTP: a live `flex-auth serve` loaded with this exact
# registry+policy, hit by qonto-assistant's actual FlexAuthCheckClient (not
# a mock) -- see qonto-assistant/tests/test_flex_auth_client.py and
# tests/test_live_authorization_gate.py, and the manual curl walkthrough
# below:
bin/flex-auth serve -addr 127.0.0.1:9099 \
  -registry examples/qonto-assistant/registry_snapshot.json \
  -policy examples/qonto-assistant/policy_package.md
# from another shell:
curl -s -X POST http://127.0.0.1:9099/v1/check -H "Content-Type: application/json" \
  -d @examples/qonto-assistant/check_request_allow_read.json
# -> effect: allow, reason: finance_read_policy_matched
curl -s -X POST http://127.0.0.1:9099/v1/check -H "Content-Type: application/json" \
  -d @examples/qonto-assistant/check_request_deny_wrong_tenant.json
# -> effect: deny, reason: wrong_tenant

Related

  • qonto-assistant/docs/SecurityPractice.md
  • qonto-assistant/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md
  • examples/tenant-engine/ — the pattern this was modeled on
  • net-kingdom/docs/adr/ADR-0014-tenant-capability-roles-and-tenant-engine-ownership.md