mirror of
https://github.com/mcloh/Enterprise-MCP-Service-Bus.git
synced 2026-11-06 06:24:12 +00:00
22 lines
917 B
Rego
22 lines
917 B
Rego
package emcp.entitlement_test
|
|
|
|
import rego.v1
|
|
import data.emcp.entitlement
|
|
|
|
test_allow_when_tool_in_entitlement if {
|
|
entitlement.allow with input as {"client_profile": "Sales.Read", "tool": "sales.customer.get"}
|
|
with data.emcp.client_profiles as {"Sales.Read": {"allowed_tools": ["sales.customer.get"]}}
|
|
}
|
|
|
|
test_deny_when_tool_not_in_entitlement if {
|
|
# README.md §45 Teste 1/2: finance.createPayment must never be reachable
|
|
# by a Sales.Read client, discovered or not.
|
|
not entitlement.allow with input as {"client_profile": "Sales.Read", "tool": "finance.createPayment"}
|
|
with data.emcp.client_profiles as {"Sales.Read": {"allowed_tools": ["sales.customer.get"]}}
|
|
}
|
|
|
|
test_deny_when_client_profile_unknown if {
|
|
not entitlement.allow with input as {"client_profile": "NoSuchProfile", "tool": "sales.customer.get"}
|
|
with data.emcp.client_profiles as {"Sales.Read": {"allowed_tools": ["sales.customer.get"]}}
|
|
}
|