flex-auth/examples/tenant-engine/policy_fixtures.yaml

[
  {
    "id": "fixture:tenant-engine-create-allow",
    "request": {
      "id": "check:tenant-engine-create-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.create",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-role-grant-allow",
    "request": {
      "id": "check:tenant-engine-role-grant-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.role.grant",
      "resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-role-revoke-allow",
    "request": {
      "id": "check:tenant-engine-role-revoke-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.role.revoke",
      "resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-plan-assign-allow",
    "request": {
      "id": "check:tenant-engine-plan-assign-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.plan.assign",
      "resource": {"id": "t-1", "type": "plan-assignment", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-update-allow",
    "request": {
      "id": "check:tenant-engine-update-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.update",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-retire-allow",
    "request": {
      "id": "check:tenant-engine-retire-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.retire",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-reactivate-allow",
    "request": {
      "id": "check:tenant-engine-reactivate-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.reactivate",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-update-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-update-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "some-other-service", "type": "service"},
      "action": "tenant.update",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-retire-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-retire-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "some-other-service", "type": "service"},
      "action": "tenant.retire",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-reactivate-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-reactivate-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "some-other-service", "type": "service"},
      "action": "tenant.reactivate",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-misspelled-lifecycle-action-deny",
    "request": {
      "id": "check:tenant-engine-retired-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.retired",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_action"}
  },
  {
    "id": "fixture:tenant-engine-lifecycle-underscore-action-deny",
    "request": {
      "id": "check:tenant-engine-underscore-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant_update",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_action"}
  },
  {
    "id": "fixture:tenant-engine-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-create-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "some-other-service", "type": "service"},
      "action": "tenant.create",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-wrong-system-deny",
    "request": {
      "id": "check:tenant-engine-create-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.create",
      "resource": {"id": "t-1", "type": "tenant", "system": "some-other-system"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "wrong_system"}
  },
  {
    "id": "fixture:tenant-engine-unknown-action-deny",
    "request": {
      "id": "check:tenant-engine-delete-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.delete",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_action"}
  },
  {
    "id": "fixture:tenant-engine-wrong-subject-type-deny",
    "request": {
      "id": "check:tenant-engine-create-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "human"},
      "action": "tenant.create",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "wrong_subject_type"}
  },
  {
    "id": "fixture:tenant-engine-guardrail-read-pdp-allow",
    "request": {
      "id": "check:tenant-engine-guardrail-read-pdp",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "flex-auth", "type": "service"},
      "action": "tenant.guardrail.read",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-guardrail-read-writer-allow",
    "request": {
      "id": "check:tenant-engine-guardrail-read-writer",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.guardrail.read",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-guardrail-set-writer-allow",
    "request": {
      "id": "check:tenant-engine-guardrail-set-writer",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.guardrail.set",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-guardrail-set-pdp-deny",
    "request": {
      "id": "check:tenant-engine-guardrail-set-pdp",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "flex-auth", "type": "service"},
      "action": "tenant.guardrail.set",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "action_not_granted"}
  },
  {
    "id": "fixture:tenant-engine-guardrail-read-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-guardrail-read-ops",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "ops", "type": "service"},
      "action": "tenant.guardrail.read",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-guardrail-set-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-guardrail-set-ops",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "ops", "type": "service"},
      "action": "tenant.guardrail.set",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-misspelled-guardrail-action-deny",
    "request": {
      "id": "check:tenant-engine-guardrail-get",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "flex-auth", "type": "service"},
      "action": "tenant.guardrail.get",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_action"}
  },
  {
    "id": "fixture:tenant-engine-portal-create",
    "request": {
      "id": "check:portal-create",
      "tenant": "tenant:trial:demo-company",
      "subject": {
        "id": "user-engine",
        "type": "service"
      },
      "action": "tenant.create",
      "resource": {
        "id": "tenant:trial:demo-company",
        "type": "tenant",
        "system": "tenant-engine"
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "write_api_policy_matched"
    }
  },
  {
    "id": "fixture:tenant-engine-portal-read",
    "request": {
      "id": "check:portal-read",
      "tenant": "tenant:trial:demo-company",
      "subject": {
        "id": "user-engine",
        "type": "service"
      },
      "action": "tenant.read",
      "resource": {
        "id": "tenant:trial:demo-company",
        "type": "tenant",
        "system": "tenant-engine"
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "write_api_policy_matched"
    }
  },
  {
    "id": "fixture:tenant-engine-portal-platform-create",
    "request": {
      "id": "check:portal-platform-create",
      "tenant": "tenant:platform",
      "subject": {
        "id": "user-engine",
        "type": "service"
      },
      "action": "tenant.create",
      "resource": {
        "id": "tenant:platform",
        "type": "tenant",
        "system": "tenant-engine"
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "action_not_granted"
    }
  },
  {
    "id": "fixture:tenant-engine-portal-platform-read",
    "request": {
      "id": "check:portal-platform-read",
      "tenant": "tenant:platform",
      "subject": {
        "id": "user-engine",
        "type": "service"
      },
      "action": "tenant.read",
      "resource": {
        "id": "tenant:platform",
        "type": "tenant",
        "system": "tenant-engine"
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "action_not_granted"
    }
  },
  {
    "id": "fixture:tenant-engine-portal-role-grant",
    "request": {
      "id": "check:portal-role-grant",
      "tenant": "tenant:trial:demo-company",
      "subject": {
        "id": "user-engine",
        "type": "service"
      },
      "action": "tenant.role.grant",
      "resource": {
        "id": "tenant:trial:demo-company",
        "type": "role-grant",
        "system": "tenant-engine"
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "action_not_granted"
    }
  },
  {
    "id": "fixture:tenant-engine-portal-role-revoke",
    "request": {
      "id": "check:portal-role-revoke",
      "tenant": "tenant:trial:demo-company",
      "subject": {
        "id": "user-engine",
        "type": "service"
      },
      "action": "tenant.role.revoke",
      "resource": {
        "id": "tenant:trial:demo-company",
        "type": "role-grant",
        "system": "tenant-engine"
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "action_not_granted"
    }
  },
  {
    "id": "fixture:tenant-engine-portal-plan-assign",
    "request": {
      "id": "check:portal-plan-assign",
      "tenant": "tenant:trial:demo-company",
      "subject": {
        "id": "user-engine",
        "type": "service"
      },
      "action": "tenant.plan.assign",
      "resource": {
        "id": "tenant:trial:demo-company",
        "type": "plan-assignment",
        "system": "tenant-engine"
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "action_not_granted"
    }
  },
  {
    "id": "fixture:tenant-engine-portal-update",
    "request": {
      "id": "check:portal-update",
      "tenant": "tenant:trial:demo-company",
      "subject": {
        "id": "user-engine",
        "type": "service"
      },
      "action": "tenant.update",
      "resource": {
        "id": "tenant:trial:demo-company",
        "type": "tenant",
        "system": "tenant-engine"
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "action_not_granted"
    }
  },
  {
    "id": "fixture:tenant-engine-portal-retire",
    "request": {
      "id": "check:portal-retire",
      "tenant": "tenant:trial:demo-company",
      "subject": {
        "id": "user-engine",
        "type": "service"
      },
      "action": "tenant.retire",
      "resource": {
        "id": "tenant:trial:demo-company",
        "type": "tenant",
        "system": "tenant-engine"
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "action_not_granted"
    }
  },
  {
    "id": "fixture:tenant-engine-portal-reactivate",
    "request": {
      "id": "check:portal-reactivate",
      "tenant": "tenant:trial:demo-company",
      "subject": {
        "id": "user-engine",
        "type": "service"
      },
      "action": "tenant.reactivate",
      "resource": {
        "id": "tenant:trial:demo-company",
        "type": "tenant",
        "system": "tenant-engine"
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "action_not_granted"
    }
  },
  {
    "id": "fixture:tenant-engine-portal-guardrail-read",
    "request": {
      "id": "check:portal-guardrail-read",
      "tenant": "tenant:trial:demo-company",
      "subject": {
        "id": "user-engine",
        "type": "service"
      },
      "action": "tenant.guardrail.read",
      "resource": {
        "id": "tenant:trial:demo-company",
        "type": "guardrail",
        "system": "tenant-engine"
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "action_not_granted"
    }
  },
  {
    "id": "fixture:tenant-engine-portal-guardrail-set",
    "request": {
      "id": "check:portal-guardrail-set",
      "tenant": "tenant:trial:demo-company",
      "subject": {
        "id": "user-engine",
        "type": "service"
      },
      "action": "tenant.guardrail.set",
      "resource": {
        "id": "tenant:trial:demo-company",
        "type": "guardrail",
        "system": "tenant-engine"
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "action_not_granted"
    }
  }
]