110 lines
2.9 KiB
Rego
110 lines
2.9 KiB
Rego
package proofedmesh.data_sources.expense_db_app_test
|
|
|
|
import data.proofedmesh.data_sources.expense_db_app as ds
|
|
import rego.v1
|
|
|
|
employee_mapping := {"by_sub": {"user-12345": "EMP-12345"}}
|
|
|
|
test_allow_travel_own_assignments if {
|
|
ds.allow with input as {
|
|
"agent_id": "agent-travel",
|
|
"user_sub": "user-12345",
|
|
"session_id": "SES-abc",
|
|
"data_source": "ds:expense-db-app",
|
|
"resource": "project_assignments",
|
|
"filters": {"employee_id": "EMP-12345"},
|
|
"operation": "read",
|
|
}
|
|
with data.employee_mapping as employee_mapping
|
|
}
|
|
|
|
test_deny_travel_other_employee if {
|
|
not ds.allow with input as {
|
|
"agent_id": "agent-travel",
|
|
"user_sub": "user-12345",
|
|
"session_id": "SES-abc",
|
|
"data_source": "ds:expense-db-app",
|
|
"resource": "project_assignments",
|
|
"filters": {"employee_id": "EMP-99999"},
|
|
"operation": "read",
|
|
}
|
|
with data.employee_mapping as employee_mapping
|
|
}
|
|
|
|
test_deny_missing_required_filter if {
|
|
not ds.allow with input as {
|
|
"agent_id": "agent-travel",
|
|
"user_sub": "user-12345",
|
|
"session_id": "SES-abc",
|
|
"data_source": "ds:expense-db-app",
|
|
"resource": "project_assignments",
|
|
"filters": {"active_on": "2026-10-25"},
|
|
"operation": "read",
|
|
}
|
|
with data.employee_mapping as employee_mapping
|
|
}
|
|
|
|
test_deny_disallowed_filter_key if {
|
|
not ds.allow with input as {
|
|
"agent_id": "agent-travel",
|
|
"user_sub": "user-12345",
|
|
"session_id": "SES-abc",
|
|
"data_source": "ds:expense-db-app",
|
|
"resource": "project_assignments",
|
|
"filters": {"employee_id": "EMP-12345", "department": "ENG"},
|
|
"operation": "read",
|
|
}
|
|
with data.employee_mapping as employee_mapping
|
|
}
|
|
|
|
test_allow_mapping_account_assignments if {
|
|
ds.allow with input as {
|
|
"agent_id": "agent-sink-mapping",
|
|
"user_sub": "user-12345",
|
|
"session_id": "SES-abc",
|
|
"data_source": "ds:expense-db-app",
|
|
"resource": "account_assignments",
|
|
"filters": {"project_code": "P-42"},
|
|
"operation": "read",
|
|
}
|
|
with data.employee_mapping as employee_mapping
|
|
}
|
|
|
|
test_deny_missing_user_sub if {
|
|
not ds.allow with input as {
|
|
"agent_id": "agent-travel",
|
|
"user_sub": "",
|
|
"session_id": "SES-abc",
|
|
"data_source": "ds:expense-db-app",
|
|
"resource": "project_assignments",
|
|
"filters": {"employee_id": "EMP-12345"},
|
|
"operation": "read",
|
|
}
|
|
with data.employee_mapping as employee_mapping
|
|
}
|
|
|
|
test_deny_wrong_data_source if {
|
|
not ds.allow with input as {
|
|
"agent_id": "agent-travel",
|
|
"user_sub": "user-12345",
|
|
"session_id": "SES-abc",
|
|
"data_source": "ds:other",
|
|
"resource": "project_assignments",
|
|
"filters": {"employee_id": "EMP-12345"},
|
|
"operation": "read",
|
|
}
|
|
with data.employee_mapping as employee_mapping
|
|
}
|
|
|
|
test_deny_write_op if {
|
|
not ds.allow with input as {
|
|
"agent_id": "agent-travel",
|
|
"user_sub": "user-12345",
|
|
"session_id": "SES-abc",
|
|
"data_source": "ds:expense-db-app",
|
|
"resource": "project_assignments",
|
|
"filters": {"employee_id": "EMP-12345"},
|
|
"operation": "write",
|
|
}
|
|
with data.employee_mapping as employee_mapping
|
|
}
|