FLEX-WP-0006: implement ops-warden signing gate policy

internal/decision/engine.go

@@ -105,6 +105,7 @@ func (e *Engine) BatchCheck(ctx context.Context, request api.BatchCheckRequest)
 	for _, resource := range request.Resources {
 		decision, err := e.Check(ctx, api.CheckRequest{
 			ID:            request.ID,
+			Tenant:        request.Tenant,
 			Subject:       request.Subject,
 			Action:        request.Action,
 			Resource:      resource,
@@ -188,6 +189,15 @@ func (e *Engine) normalizeRequest(request api.CheckRequest) (api.CheckRequest, r
 	normalized := request
 	facts := registryFacts{}
 
+	if normalized.Tenant != "" {
+		if normalized.Subject.Tenant == "" {
+			normalized.Subject.Tenant = normalized.Tenant
+		}
+		if normalized.Resource.Tenant == "" {
+			normalized.Resource.Tenant = normalized.Tenant
+		}
+	}
+
 	if subject, ok := e.store.Subject(request.Subject.ID); ok {
 		facts.subjectFound = true
 		facts.subject = subject

internal/policy/package_test.go

@@ -74,6 +74,28 @@ func TestRedactPolicyPackageMarkdownValidates(t *testing.T) {
 	}
 }
 
+func TestOpsWardenPolicyPackageMarkdownValidates(t *testing.T) {
+	pkg, err := policy.LoadAndValidateFile(context.Background(), filepath.Join("..", "..", "examples", "ops-warden", "policy_package.md"))
+	if err != nil {
+		t.Fatalf("LoadAndValidateFile: %v", err)
+	}
+
+	if !pkg.Valid {
+		t.Fatalf("pkg.Valid = false\n%s", formatValidation(pkg.Validation))
+	}
+	if pkg.Metadata.Namespace != "ops-warden:ssh-certificate" {
+		t.Fatalf("metadata.Namespace = %q; want ops-warden:ssh-certificate", pkg.Metadata.Namespace)
+	}
+	if len(pkg.Validation.Fixtures) != 8 {
+		t.Fatalf("Validation.Fixtures len = %d; want 8", len(pkg.Validation.Fixtures))
+	}
+	for _, fixture := range pkg.Validation.Fixtures {
+		if !fixture.Passed {
+			t.Fatalf("fixture %s failed: %s\nactual: %+v", fixture.ID, fixture.Error, fixture.Actual)
+		}
+	}
+}
+
 func TestCaringFindingsAreAdvisoryUntilEnforced(t *testing.T) {
 	doc := inlinePolicy(false, "allow")
 	pkg, err := policy.Load([]byte(doc), "inline-policy.md")