91 lines
2 KiB
Rego
91 lines
2 KiB
Rego
package proofedmesh.data_sources.receipts_test
|
|
|
|
import data.proofedmesh.data_sources.receipts
|
|
import rego.v1
|
|
|
|
base := {
|
|
"data_source": "ds:receipts",
|
|
"user_sub": "user-12345",
|
|
"session_id": "SES-abc",
|
|
}
|
|
|
|
test_allow_travel_write if {
|
|
receipts.allow with input as object.union(base, {
|
|
"agent_id": "agent-travel",
|
|
"operation": "write",
|
|
"filters": {},
|
|
})
|
|
}
|
|
|
|
test_allow_mapping_read_by_content_hash if {
|
|
receipts.allow with input as object.union(base, {
|
|
"agent_id": "agent-sink-mapping",
|
|
"operation": "read",
|
|
"filters": {"content_hash": "sha256:aa"},
|
|
})
|
|
}
|
|
|
|
test_allow_posting_read_by_content_hash if {
|
|
receipts.allow with input as object.union(base, {
|
|
"agent_id": "agent-sink-posting",
|
|
"operation": "read",
|
|
"filters": {"content_hash": "sha256:aa"},
|
|
})
|
|
}
|
|
|
|
test_deny_read_without_content_hash if {
|
|
not receipts.allow with input as object.union(base, {
|
|
"agent_id": "agent-sink-mapping",
|
|
"operation": "read",
|
|
"filters": {},
|
|
})
|
|
}
|
|
|
|
test_deny_read_with_extra_filter if {
|
|
not receipts.allow with input as object.union(base, {
|
|
"agent_id": "agent-sink-mapping",
|
|
"operation": "read",
|
|
"filters": {"content_hash": "sha256:aa", "list_all": "yes"},
|
|
})
|
|
}
|
|
|
|
test_deny_travel_read if {
|
|
not receipts.allow with input as object.union(base, {
|
|
"agent_id": "agent-travel",
|
|
"operation": "read",
|
|
"filters": {"content_hash": "sha256:aa"},
|
|
})
|
|
}
|
|
|
|
test_deny_posting_write if {
|
|
not receipts.allow with input as object.union(base, {
|
|
"agent_id": "agent-sink-posting",
|
|
"operation": "write",
|
|
"filters": {},
|
|
})
|
|
}
|
|
|
|
test_deny_no_user_session if {
|
|
not receipts.allow with input as object.union(base, {
|
|
"agent_id": "agent-travel",
|
|
"operation": "write",
|
|
"filters": {},
|
|
"user_sub": "",
|
|
})
|
|
}
|
|
|
|
test_deny_unknown_agent if {
|
|
not receipts.allow with input as object.union(base, {
|
|
"agent_id": "agent-rogue",
|
|
"operation": "read",
|
|
"filters": {"content_hash": "sha256:aa"},
|
|
})
|
|
}
|
|
|
|
test_deny_list_operation if {
|
|
not receipts.allow with input as object.union(base, {
|
|
"agent_id": "agent-sink-mapping",
|
|
"operation": "list",
|
|
"filters": {},
|
|
})
|
|
}
|