coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/examples/tenant-engine/README.md
tegwick 8e127e50f7 Authorize tenant-engine lifecycle actions (FLEX-WP-0010) 
Extend the tenant-engine write-API policy package with tenant.update,
tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005
introduced. Until now every lifecycle mutation resolved to deny
unknown_action, blocking TEN-WP-0005-T05 production rollout.

- policy_package.md: three actions in valid_actions and frontmatter;
  CARING capabilities extended with EditAny/Archive/Restore
- protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt
  registry_snapshot.json carry all seven actions
- docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces
- 8 new fixture pairs and 5 new Rego tests, including action-drift
  guards (tenant.retired, tenant_update -> unknown_action)

T02 decision, recorded in policy_package.md: tenant.retire does NOT get
stricter authorization yet. With one service subject and no assurance
claim in the CheckRequest there is nothing stricter to check, and a
condition the sole caller always satisfies would falsely read as
separate control. Retirement is reversible and non-destructive. Revisit
on KEY-WP-0005 assurance claims or a second operator subject.

Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt
and go vet clean. End-to-end against a live serve with a real
tenant-engine through the unmodified FlexAuthWriteAuthorizer: update
6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970
all allow; unregistered actor denied unknown_subject
(59d3e99c6416be89, 403 write_denied).

Handoff revision for TEN-WP-0005-T05: package
tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-10 20:52:10 +02:00

4.2 KiB
Raw Blame History

tenant-engine Consumer Integration Fixtures

FLEX-WP-0008-T01/T02. Registers tenant-engine as a flex-auth protected-system consumer, gating its own write API (TEN-WP-0003's authz.FlexAuthWriteAuthorizer).

Files

File Purpose
protected_system_manifest.yaml Resource types (tenant, role-grant, plan-assignment) and the seven actions: tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign, plus the FLEX-WP-0010 lifecycle actions tenant.update, tenant.retire, tenant.reactivate
subject_manifest.yaml The one registered caller: tenant-engine's own service identity
policy_package.md Rego rules + embedded tests gating the write API
policy_fixtures.yaml Allow/deny request/decision pairs, referenced by policy_package.md's frontmatter
registry_snapshot.json Merged systems/subjects/groups snapshot assembled from the two manifests above, loadable by flex-auth serve/check/load-registry
check_request_allow_create.json, check_request_deny_unknown_subject.json, check_request_allow_retire.json, check_request_deny_misspelled_lifecycle.json Standalone example requests for flex-auth check

No resource_manifest.yaml — unlike ops-warden's fixed SSH-certificate inventory, tenant-engine's resources (tenants) are created dynamically. See docs/tenant-engine-resource-namespace.md for why that's a deliberate omission, not an oversight.

Verified

go build -o bin/flex-auth ./cmd/flex-auth

# Rego rules + embedded tests + fixtures, all pass:
bin/flex-auth test-policy -file examples/tenant-engine/policy_package.md

# Registry loads cleanly:
bin/flex-auth load-registry -file examples/tenant-engine/registry_snapshot.json

# Individual requests via the CLI:
bin/flex-auth check \
  -registry examples/tenant-engine/registry_snapshot.json \
  -policy examples/tenant-engine/policy_package.md \
  -request examples/tenant-engine/check_request_allow_create.json

# End-to-end over real HTTP: a live `flex-auth serve` loaded with this
# exact registry+policy, hit by tenant-engine's actual
# FlexAuthCheckClient/FlexAuthWriteAuthorizer (not a mock) --
# POST /tenants with actor="ops" -> 403 (unknown_subject);
# actor="tenant-engine" -> 201 (write_api_policy_matched).
bin/flex-auth serve -addr 127.0.0.1:9098 \
  -registry examples/tenant-engine/registry_snapshot.json \
  -policy examples/tenant-engine/policy_package.md
# (from tenant-engine's own checkout)
TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098 make run

Verified — lifecycle actions (FLEX-WP-0010-T03, 2026-08-10)

test-policy reports 11/11 Rego tests and 16/16 fixtures passing, the registry loads, and go test ./... / gofmt / go vet are clean.

End-to-end over real HTTP: a live flex-auth serve on 127.0.0.1:9098 loaded with this registry and policy, and a real tenant-engine (TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098) driven through its unmodified FlexAuthWriteAuthorizer with Idempotency-Key and an If-Match echoed from a prior GET:

Call tenant-engine flex-auth decision
POST /tenants 201 decision:174dc9ecb03ed9e5 allow write_api_policy_matched
PATCH /tenants/t-e2e-1 200 active decision:6176c39c2f4d7b15 allow write_api_policy_matched
POST /tenants/t-e2e-1/retire 200 retired decision:8a801b8ee8455080 allow write_api_policy_matched
POST /tenants/t-e2e-1/reactivate 200 active decision:c64cf3713cecd970 allow write_api_policy_matched
POST .../retire as actor: ops 403 write_denied decision:59d3e99c6416be89 deny unknown_subject

The misspelled-action guard (tenant.retired → deny unknown_action) is covered by fixture and by check -request check_request_deny_misspelled_lifecycle.json; it cannot be driven through the client, which only ever emits the seven registered strings — which is the property the guard exists to protect.

Related

  • docs/tenant-engine-resource-namespace.md
  • docs/tenant-engine-action-vocabulary.md
  • tenant-engine/docs/flex-auth-integration.md — the client side of this integration
  • net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md