tegwick
ae295824bd
QONTO-WP-0004-T04. Modeled directly on examples/tenant-engine/: one resource type (finance-snapshot), one action (finance.qonto.read), two registered subjects (an agent-harness session identity and the founder's human identity), and a Rego policy gating on resource.system + action + subject.type + tenant match. Tenant capability-role/plan liveness (VEN/CUS) is deliberately NOT encoded here -- that's qonto-assistant's separate tenant-engine live-lookup check, per this package's own scope note. Verified: flex-auth test-policy (6 rego tests + 6 fixtures, all pass), load-registry, and CLI check for both an allow and a deny case. Also verified end-to-end over real HTTP: a live flex-auth serve loaded with this exact registry+policy, hit by qonto-assistant's actual FlexAuthCheckClient (not a mock) -- allow for tenant:friendly:binky, deny (wrong_tenant) for a mismatched tenant. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
74 lines
2.7 KiB
YAML
74 lines
2.7 KiB
YAML
[
|
|
{
|
|
"id": "fixture:qonto-assistant-agent-read-allow",
|
|
"request": {
|
|
"id": "check:qonto-assistant-read-t1",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "agent-harness-binky", "type": "agent"},
|
|
"action": "finance.qonto.read",
|
|
"resource": {"id": "finance-snapshot", "type": "finance-snapshot", "system": "qonto-assistant"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "finance_read_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:qonto-assistant-human-read-allow",
|
|
"request": {
|
|
"id": "check:qonto-assistant-read-t2",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "bernd.worsch", "type": "human"},
|
|
"action": "finance.qonto.read",
|
|
"resource": {"id": "finance-snapshot", "type": "finance-snapshot", "system": "qonto-assistant"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "allow", "reason": "finance_read_policy_matched"}
|
|
},
|
|
{
|
|
"id": "fixture:qonto-assistant-wrong-system-deny",
|
|
"request": {
|
|
"id": "check:qonto-assistant-read-t3",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "agent-harness-binky", "type": "agent"},
|
|
"action": "finance.qonto.read",
|
|
"resource": {"id": "x", "type": "finance-snapshot", "system": "some-other-system"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "wrong_system"}
|
|
},
|
|
{
|
|
"id": "fixture:qonto-assistant-unknown-action-deny",
|
|
"request": {
|
|
"id": "check:qonto-assistant-read-t4",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "agent-harness-binky", "type": "agent"},
|
|
"action": "finance.qonto.transfer",
|
|
"resource": {"id": "finance-snapshot", "type": "finance-snapshot", "system": "qonto-assistant"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "unknown_action"}
|
|
},
|
|
{
|
|
"id": "fixture:qonto-assistant-wrong-subject-type-deny",
|
|
"request": {
|
|
"id": "check:qonto-assistant-read-t5",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {"id": "unknown-device", "type": "device"},
|
|
"action": "finance.qonto.read",
|
|
"resource": {"id": "finance-snapshot", "type": "finance-snapshot", "system": "qonto-assistant"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "wrong_subject_type"}
|
|
},
|
|
{
|
|
"id": "fixture:qonto-assistant-wrong-tenant-deny",
|
|
"request": {
|
|
"id": "check:qonto-assistant-read-t6",
|
|
"tenant": "tenant:friendly:some-other-company",
|
|
"subject": {"id": "agent-harness-binky", "type": "agent"},
|
|
"action": "finance.qonto.read",
|
|
"resource": {"id": "finance-snapshot", "type": "finance-snapshot", "system": "qonto-assistant"},
|
|
"context": {}
|
|
},
|
|
"expect": {"effect": "deny", "reason": "wrong_tenant"}
|
|
}
|
|
]
|