generated from coulomb/repo-seed
Add Markitect check fixtures
This commit is contained in:
239
examples/markitect/check_fixtures.yaml
Normal file
239
examples/markitect/check_fixtures.yaml
Normal file
@@ -0,0 +1,239 @@
|
||||
- id: fixture:markitect-public-document-allow
|
||||
request:
|
||||
id: check:markitect-public-document
|
||||
subject:
|
||||
id: user:visitor
|
||||
type: Human
|
||||
tenant: tenant:alpha
|
||||
action: read
|
||||
resource:
|
||||
id: document:public-note
|
||||
type: document
|
||||
system: markitect-tool
|
||||
tenant: tenant:alpha
|
||||
attributes:
|
||||
labels:
|
||||
- public
|
||||
trust_zone: public
|
||||
caring_context:
|
||||
id: descriptor:public-document-reader
|
||||
profile: caring-0.4.0-rc2
|
||||
subject_type: Human
|
||||
organization_relation: Customer
|
||||
canonical_role: Doer
|
||||
scope:
|
||||
level: Resource
|
||||
id: document:public-note
|
||||
tenant: tenant:alpha
|
||||
planes:
|
||||
- Data
|
||||
capabilities:
|
||||
- View
|
||||
exposure_modes:
|
||||
- Plaintext
|
||||
conditions:
|
||||
- Logged
|
||||
expect:
|
||||
effect: allow
|
||||
reason: public_document
|
||||
metadata:
|
||||
expected_caring_descriptor: descriptor:public-document-reader
|
||||
expected_conformance_findings: []
|
||||
expected_exposure_modes:
|
||||
- Plaintext
|
||||
expected_audit_behavior: sampled_allow
|
||||
- id: fixture:markitect-internal-document-deny
|
||||
request:
|
||||
id: check:markitect-internal-document-deny
|
||||
subject:
|
||||
id: user:visitor
|
||||
type: Human
|
||||
tenant: tenant:alpha
|
||||
attributes:
|
||||
groups: []
|
||||
action: read
|
||||
resource:
|
||||
id: document:internal-note
|
||||
type: document
|
||||
system: markitect-tool
|
||||
tenant: tenant:alpha
|
||||
attributes:
|
||||
labels:
|
||||
- internal
|
||||
trust_zone: internal
|
||||
expect:
|
||||
effect: deny
|
||||
reason: no_matching_rule
|
||||
metadata:
|
||||
expected_caring_descriptor: null
|
||||
expected_conformance_findings: []
|
||||
expected_exposure_modes:
|
||||
- None
|
||||
expected_audit_behavior: always_record
|
||||
- id: fixture:markitect-internal-document-reader-allow
|
||||
request:
|
||||
id: check:markitect-internal-document-reader
|
||||
subject:
|
||||
id: user:alice
|
||||
type: Human
|
||||
tenant: tenant:alpha
|
||||
attributes:
|
||||
groups:
|
||||
- group:platform-architecture
|
||||
action: read
|
||||
resource:
|
||||
id: document:internal-note
|
||||
type: document
|
||||
system: markitect-tool
|
||||
tenant: tenant:alpha
|
||||
attributes:
|
||||
labels:
|
||||
- internal
|
||||
trust_zone: internal
|
||||
caring_context:
|
||||
id: descriptor:internal-document-reader
|
||||
profile: caring-0.4.0-rc2
|
||||
subject_type: Human
|
||||
organization_relation: Customer
|
||||
canonical_role: Doer
|
||||
scope:
|
||||
level: Resource
|
||||
id: document:internal-note
|
||||
tenant: tenant:alpha
|
||||
planes:
|
||||
- Data
|
||||
capabilities:
|
||||
- View
|
||||
exposure_modes:
|
||||
- Masked
|
||||
- Plaintext
|
||||
conditions:
|
||||
- Logged
|
||||
restrictions:
|
||||
- ExportBlocked
|
||||
expect:
|
||||
effect: allow
|
||||
reason: reader_group
|
||||
metadata:
|
||||
expected_caring_descriptor: descriptor:internal-document-reader
|
||||
expected_conformance_findings: []
|
||||
expected_exposure_modes:
|
||||
- Masked
|
||||
- Plaintext
|
||||
expected_audit_behavior: sampled_allow
|
||||
- id: fixture:markitect-restricted-export-steward-mfa
|
||||
request:
|
||||
id: check:markitect-restricted-export
|
||||
subject:
|
||||
id: user:steward
|
||||
type: Human
|
||||
tenant: tenant:alpha
|
||||
attributes:
|
||||
roles:
|
||||
- steward
|
||||
action: export
|
||||
resource:
|
||||
id: export:internal-note-review-bundle
|
||||
type: export
|
||||
system: markitect-tool
|
||||
tenant: tenant:alpha
|
||||
attributes:
|
||||
labels:
|
||||
- export
|
||||
trust_zone: external
|
||||
context:
|
||||
mfa: true
|
||||
reason: customer-approved export
|
||||
caring_context:
|
||||
id: descriptor:restricted-export-steward
|
||||
profile: caring-0.4.0-rc2
|
||||
subject_type: Human
|
||||
organization_relation: Customer
|
||||
canonical_role: Maintainer
|
||||
scope:
|
||||
level: Record
|
||||
id: export:internal-note-review-bundle
|
||||
tenant: tenant:alpha
|
||||
planes:
|
||||
- Data
|
||||
- Audit
|
||||
capabilities:
|
||||
- Export
|
||||
exposure_modes:
|
||||
- Exportable
|
||||
- Plaintext
|
||||
conditions:
|
||||
- MFARequired
|
||||
- Logged
|
||||
expect:
|
||||
effect: allow
|
||||
reason: steward_export_mfa
|
||||
conformance_findings:
|
||||
- code: MARKITECT-EXPORT-MFA-LOGGED
|
||||
severity: info
|
||||
message: Export is allowed only with steward role, MFA, and logging.
|
||||
metadata:
|
||||
expected_caring_descriptor: descriptor:restricted-export-steward
|
||||
expected_exposure_modes:
|
||||
- Exportable
|
||||
- Plaintext
|
||||
expected_audit_behavior: always_record
|
||||
- id: fixture:markitect-context-package-activation
|
||||
request:
|
||||
id: check:markitect-context-package-activation
|
||||
subject:
|
||||
id: user:alice
|
||||
type: Human
|
||||
tenant: tenant:alpha
|
||||
action: activate_context
|
||||
resource:
|
||||
id: context-package:internal-note-review
|
||||
type: context_package
|
||||
system: markitect-tool
|
||||
tenant: tenant:alpha
|
||||
attributes:
|
||||
labels:
|
||||
- internal
|
||||
- generated
|
||||
context:
|
||||
freshness_seconds: 600
|
||||
policy_version: markitect-gateway-v1
|
||||
caring_context:
|
||||
id: descriptor:context-package-activation
|
||||
profile: caring-0.4.0-rc2
|
||||
subject_type: Human
|
||||
organization_relation: Customer
|
||||
canonical_role: Verifier
|
||||
scope:
|
||||
level: Dataset
|
||||
id: context-package:internal-note-review
|
||||
tenant: tenant:alpha
|
||||
planes:
|
||||
- Intent
|
||||
- Policy
|
||||
capabilities:
|
||||
- Use
|
||||
- Execute
|
||||
exposure_modes:
|
||||
- Metadata
|
||||
- Masked
|
||||
conditions:
|
||||
- PurposeBound
|
||||
- Logged
|
||||
expect:
|
||||
effect: allow
|
||||
reason: fresh_context_package
|
||||
obligations:
|
||||
- type: record_context_activation
|
||||
parameters:
|
||||
freshness_seconds: 600
|
||||
conformance_findings:
|
||||
- code: MARKITECT-CONTEXT-FRESHNESS
|
||||
severity: info
|
||||
message: Context package activation includes policy version and freshness metadata.
|
||||
metadata:
|
||||
expected_caring_descriptor: descriptor:context-package-activation
|
||||
expected_exposure_modes:
|
||||
- Metadata
|
||||
- Masked
|
||||
expected_audit_behavior: always_record
|
||||
152
examples/markitect/check_policy_package.md
Normal file
152
examples/markitect/check_policy_package.md
Normal file
@@ -0,0 +1,152 @@
|
||||
---
|
||||
id: markitect.gateway.check-fixtures
|
||||
name: Markitect gateway check fixtures
|
||||
namespace: markitect:gateway
|
||||
version: v1
|
||||
status: draft
|
||||
package: flexauth.markitect.gateway
|
||||
actions:
|
||||
- read
|
||||
- export
|
||||
- activate_context
|
||||
owner: team:platform-architecture
|
||||
fixtures:
|
||||
- check_fixtures.yaml
|
||||
caring:
|
||||
profile: caring-0.4.0-rc2
|
||||
enforce: false
|
||||
canonical_roles:
|
||||
- Doer
|
||||
- Maintainer
|
||||
- Verifier
|
||||
organization_relations:
|
||||
- Customer
|
||||
scopes:
|
||||
- level: Resource
|
||||
id: document:public-note
|
||||
tenant: tenant:alpha
|
||||
- level: Resource
|
||||
id: document:internal-note
|
||||
tenant: tenant:alpha
|
||||
- level: Dataset
|
||||
id: context-package:internal-note-review
|
||||
tenant: tenant:alpha
|
||||
planes:
|
||||
- Intent
|
||||
- Data
|
||||
- Audit
|
||||
capabilities:
|
||||
- View
|
||||
- Export
|
||||
- Use
|
||||
- Execute
|
||||
exposure_modes:
|
||||
- Metadata
|
||||
- Masked
|
||||
- Plaintext
|
||||
- Exportable
|
||||
conditions:
|
||||
- MFARequired
|
||||
- PurposeBound
|
||||
- Logged
|
||||
restrictions:
|
||||
- ExportBlocked
|
||||
metadata:
|
||||
source: examples/markitect/check_policy_package.md
|
||||
---
|
||||
|
||||
# Markitect Gateway Check Fixtures
|
||||
|
||||
This package captures the first Markitect gateway scenarios as executable Rego
|
||||
and external fixtures.
|
||||
|
||||
## Rules
|
||||
|
||||
```rego
|
||||
import future.keywords.if
|
||||
import future.keywords.in
|
||||
|
||||
default decision := {"effect": "deny", "reason": "no_matching_rule"}
|
||||
|
||||
decision := {"effect": "allow", "reason": "public_document"} if {
|
||||
input.action == "read"
|
||||
input.resource.type == "document"
|
||||
"public" in object.get(input.resource.attributes, "labels", [])
|
||||
}
|
||||
|
||||
decision := {"effect": "allow", "reason": "reader_group"} if {
|
||||
input.action == "read"
|
||||
input.resource.type == "document"
|
||||
"internal" in object.get(input.resource.attributes, "labels", [])
|
||||
"group:platform-architecture" in object.get(input.subject.attributes, "groups", [])
|
||||
"View" in input.caring_context.capabilities
|
||||
}
|
||||
|
||||
decision := {
|
||||
"effect": "allow",
|
||||
"reason": "steward_export_mfa",
|
||||
"conformance_findings": [{
|
||||
"code": "MARKITECT-EXPORT-MFA-LOGGED",
|
||||
"severity": "info",
|
||||
"message": "Export is allowed only with steward role, MFA, and logging."
|
||||
}]
|
||||
} if {
|
||||
input.action == "export"
|
||||
"steward" in object.get(input.subject.attributes, "roles", [])
|
||||
input.context.mfa == true
|
||||
"Export" in input.caring_context.capabilities
|
||||
"Exportable" in input.caring_context.exposure_modes
|
||||
}
|
||||
|
||||
decision := {
|
||||
"effect": "allow",
|
||||
"reason": "fresh_context_package",
|
||||
"obligations": [{
|
||||
"type": "record_context_activation",
|
||||
"parameters": {"freshness_seconds": input.context.freshness_seconds}
|
||||
}],
|
||||
"conformance_findings": [{
|
||||
"code": "MARKITECT-CONTEXT-FRESHNESS",
|
||||
"severity": "info",
|
||||
"message": "Context package activation includes policy version and freshness metadata."
|
||||
}]
|
||||
} if {
|
||||
input.action == "activate_context"
|
||||
input.resource.type == "context_package"
|
||||
input.policy_version != ""
|
||||
input.context.freshness_seconds <= 900
|
||||
"Use" in input.caring_context.capabilities
|
||||
"Execute" in input.caring_context.capabilities
|
||||
}
|
||||
```
|
||||
|
||||
## Tests
|
||||
|
||||
```rego test
|
||||
package flexauth.markitect.gateway_test
|
||||
|
||||
import future.keywords.if
|
||||
import data.flexauth.markitect.gateway
|
||||
|
||||
test_public_document_allows if {
|
||||
gateway.decision.effect == "allow" with input as {
|
||||
"action": "read",
|
||||
"resource": {
|
||||
"type": "document",
|
||||
"attributes": {"labels": ["public"]}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
test_export_requires_mfa if {
|
||||
gateway.decision.effect == "deny" with input as {
|
||||
"action": "export",
|
||||
"subject": {"attributes": {"roles": ["steward"]}},
|
||||
"context": {"mfa": false},
|
||||
"caring_context": {
|
||||
"capabilities": ["Export"],
|
||||
"exposure_modes": ["Exportable"]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
Reference in New Issue
Block a user