108 lines
3.1 KiB
Rego
108 lines
3.1 KiB
Rego
package proofedmesh.transformations.expense_test
|
|
|
|
import data.proofedmesh.transformations.expense
|
|
import rego.v1
|
|
|
|
canonical_payload := {
|
|
"employee_id": "EMP-12345",
|
|
"currency": "EUR",
|
|
"total_amount": "428.50",
|
|
}
|
|
|
|
sink_payload := {"expense": {
|
|
"employee_id": "EMP-12345",
|
|
"currency": "EUR",
|
|
"total_amount": "428.50",
|
|
}}
|
|
|
|
test_allow_map_to_sink if {
|
|
expense.allow with input as {
|
|
"agent_id": "agent-sink-mapping",
|
|
"operation": "expense.map_to_sink",
|
|
"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
|
|
"output_schema": {"name": "sink.db.expense", "version": "1.0.0"},
|
|
"input_payload": canonical_payload,
|
|
"output_payload": sink_payload,
|
|
}
|
|
}
|
|
|
|
test_deny_unknown_agent if {
|
|
not expense.allow with input as {
|
|
"agent_id": "agent-rogue",
|
|
"operation": "expense.map_to_sink",
|
|
"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
|
|
"output_schema": {"name": "sink.db.expense", "version": "1.0.0"},
|
|
"input_payload": canonical_payload,
|
|
"output_payload": sink_payload,
|
|
}
|
|
}
|
|
|
|
test_deny_schema_mismatch if {
|
|
not expense.allow with input as {
|
|
"agent_id": "agent-sink-mapping",
|
|
"operation": "expense.map_to_sink",
|
|
"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
|
|
"output_schema": {"name": "sink.db.expense", "version": "2.0.0"},
|
|
"input_payload": canonical_payload,
|
|
"output_payload": sink_payload,
|
|
}
|
|
}
|
|
|
|
test_deny_total_amount_change if {
|
|
tampered := {"expense": {
|
|
"employee_id": "EMP-12345",
|
|
"currency": "EUR",
|
|
"total_amount": "999.99",
|
|
}}
|
|
not expense.allow with input as {
|
|
"agent_id": "agent-sink-mapping",
|
|
"operation": "expense.map_to_sink",
|
|
"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
|
|
"output_schema": {"name": "sink.db.expense", "version": "1.0.0"},
|
|
"input_payload": canonical_payload,
|
|
"output_payload": tampered,
|
|
}
|
|
}
|
|
|
|
test_deny_currency_change if {
|
|
tampered := {"expense": {
|
|
"employee_id": "EMP-12345",
|
|
"currency": "USD",
|
|
"total_amount": "428.50",
|
|
}}
|
|
not expense.allow with input as {
|
|
"agent_id": "agent-sink-mapping",
|
|
"operation": "expense.map_to_sink",
|
|
"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
|
|
"output_schema": {"name": "sink.db.expense", "version": "1.0.0"},
|
|
"input_payload": canonical_payload,
|
|
"output_payload": tampered,
|
|
}
|
|
}
|
|
|
|
test_deny_employee_change if {
|
|
tampered := {"expense": {
|
|
"employee_id": "EMP-99999",
|
|
"currency": "EUR",
|
|
"total_amount": "428.50",
|
|
}}
|
|
not expense.allow with input as {
|
|
"agent_id": "agent-sink-mapping",
|
|
"operation": "expense.map_to_sink",
|
|
"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
|
|
"output_schema": {"name": "sink.db.expense", "version": "1.0.0"},
|
|
"input_payload": canonical_payload,
|
|
"output_payload": tampered,
|
|
}
|
|
}
|
|
|
|
test_deny_posting_agent_cannot_map if {
|
|
not expense.allow with input as {
|
|
"agent_id": "agent-sink-posting",
|
|
"operation": "expense.map_to_sink",
|
|
"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
|
|
"output_schema": {"name": "sink.db.expense", "version": "1.0.0"},
|
|
"input_payload": canonical_payload,
|
|
"output_payload": sink_payload,
|
|
}
|
|
}
|