gatekeep-sqlx 0.3.0

SQLx query lowering adapter for gatekeep
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128

use gatekeep::{Condition, PartialFacts, Residual, condition, partial_evaluate, policy};

use crate::support::{
    NullableFlag, Owner, Shared, TestError, TestResult, Tier, assert_lowered_matches_residual,
    cases, cx, grant, insert_cases, pool, reset_database, selected_rows,
};

#[tokio::test]
#[ignore = "requires docker postgres; run `make test-db`"]
async fn lowered_filters_and_grades_match_in_memory_residual_evaluation() -> TestResult<()> {
    let pool = pool().await?;
    reset_database(&pool).await?;
    let cases = cases();
    insert_cases(&pool, &cases).await?;
    let cx = cx()?;

    let policy = policy::any([
        policy::grant(Tier::Shared, condition::has::<Shared>()),
        policy::grant(
            Tier::Full,
            Condition::All(vec![
                condition::has::<Owner>(),
                condition::not(condition::has::<NullableFlag>()),
            ]),
        ),
    ]);
    let partial = PartialFacts::new()
        .with_unknown::<Shared>()
        .with_unknown::<Owner>()
        .with_unknown::<NullableFlag>();
    let Residual::Pending { residual, .. } = partial_evaluate(&policy, &partial) else {
        return Err(TestError::UnexpectedResolvedResidual);
    };
    assert_lowered_matches_residual(&pool, &cx, &cases, &residual).await?;

    assert_lowered_matches_residual(
        &pool,
        &cx,
        &cases,
        &gatekeep::ResidualPolicy::All(vec![
            grant(Tier::Shared, condition::has::<Shared>()),
            grant(Tier::Full, condition::has::<Owner>()),
        ]),
    )
    .await?;

    assert_lowered_matches_residual(
        &pool,
        &cx,
        &cases,
        &gatekeep::ResidualPolicy::OrElse {
            primary: Box::new(grant(Tier::Shared, condition::has::<Shared>())),
            fallback: Box::new(grant(Tier::Full, condition::has::<Owner>())),
        },
    )
    .await?;

    assert_lowered_matches_residual(
        &pool,
        &cx,
        &cases,
        &grant(
            Tier::Full,
            condition::any([condition::has::<Shared>(), condition::has::<Owner>()]),
        ),
    )
    .await?;
    assert_lowered_matches_residual(
        &pool,
        &cx,
        &cases,
        &grant(Tier::Shared, condition::always()),
    )
    .await?;
    assert_lowered_matches_residual(&pool, &cx, &cases, &grant(Tier::Full, condition::never()))
        .await?;

    assert_lowered_matches_residual(
        &pool,
        &cx,
        &cases,
        &gatekeep::ResidualPolicy::Permit(Tier::Shared),
    )
    .await?;
    assert_lowered_matches_residual(&pool, &cx, &cases, &gatekeep::ResidualPolicy::Deny).await?;
    assert_lowered_matches_residual(
        &pool,
        &cx,
        &cases,
        &gatekeep::ResidualPolicy::All(Vec::new()),
    )
    .await?;
    assert_lowered_matches_residual(
        &pool,
        &cx,
        &cases,
        &gatekeep::ResidualPolicy::Any(Vec::new()),
    )
    .await?;
    Ok(())
}

#[tokio::test]
#[ignore = "requires docker postgres; run `make test-db`"]
async fn obligated_or_else_fallback_is_pruned_in_postgres() -> TestResult<()> {
    let pool = pool().await?;
    reset_database(&pool).await?;
    let cases = cases();
    insert_cases(&pool, &cases).await?;
    let cx = cx()?;
    let residual = gatekeep::ResidualPolicy::OrElse {
        primary: Box::new(grant(Tier::Shared, condition::has::<Shared>())),
        fallback: Box::new(gatekeep::ResidualPolicy::Grant {
            outcome: Tier::Full,
            condition: condition::has::<Owner>(),
            label: None,
            deny_shape: gatekeep::DenyShape::Forbidden,
            obligations: vec![gatekeep::ObligationId::new("break_glass")?],
            reason: None,
        }),
    };

    assert_eq!(
        selected_rows(&pool, &cx, &residual).await?,
        vec![(2, 1), (5, 1)]
    );
    Ok(())
}