The highest tagged major version is
Documentation
¶
Overview ¶
Package authorizationtest provides deterministic fixtures, assertions, and selected common-contract checks for authorization integrations. Builders are mutable, outputs copy maps/slices, and assertion failures may expose raw fixture errors. Use trusted non-secret fixtures; no external interoperability certification is made.
Index ¶
- func AllowEvaluator(reason authorization.ReasonCode) authorization.Evaluator
- func CanonicalDecisionJSON(decision authorization.Decision) ([]byte, error)
- func DenyEvaluator(reason authorization.ReasonCode) authorization.Evaluator
- func ErrorEvaluator(err error) authorization.Evaluator
- func FixedTime() time.Time
- func MustEngine(t TestingT, snapshot *authorization.Snapshot, ...) *authorization.Engine
- func MustSnapshot(t TestingT, revision authorization.Revision, ...) *authorization.Snapshot
- func NotApplicableEvaluator() authorization.Evaluator
- func RequireDecision(t TestingT, got authorization.Decision, err error, want authorization.Decision)
- func RequireOutcome(t TestingT, decision authorization.Decision, want authorization.Outcome)
- func RunAuthorizerConformance(t *testing.T, factory AuthorizerFactory)
- type AuthorizerFactory
- type RequestBuilder
- func (builder *RequestBuilder) Build() authorization.Request
- func (builder *RequestBuilder) WithAction(action authorization.Action) *RequestBuilder
- func (builder *RequestBuilder) WithAttribute(name authorization.AttributeName, value authorization.Value) *RequestBuilder
- func (builder *RequestBuilder) WithEnvironmentAttribute(name authorization.AttributeName, value authorization.Value) *RequestBuilder
- func (builder *RequestBuilder) WithGroup(id authorization.SubjectID) *RequestBuilder
- func (builder *RequestBuilder) WithResource(typeName authorization.ResourceType, id authorization.ResourceID) *RequestBuilder
- func (builder *RequestBuilder) WithResourceAttribute(name authorization.AttributeName, value authorization.Value) *RequestBuilder
- func (builder *RequestBuilder) WithSubject(kind authorization.SubjectKind, id authorization.SubjectID) *RequestBuilder
- func (builder *RequestBuilder) WithSubjectAttribute(name authorization.AttributeName, value authorization.Value) *RequestBuilder
- func (builder *RequestBuilder) WithTenant(tenant authorization.TenantID) *RequestBuilder
- func (builder *RequestBuilder) WithTime(at time.Time) *RequestBuilder
- type StaticEvaluator
- type TestingT
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AllowEvaluator ¶
func AllowEvaluator(reason authorization.ReasonCode) authorization.Evaluator
AllowEvaluator returns an unconditional allow fixture with the supplied non-secret reason.
func CanonicalDecisionJSON ¶
func CanonicalDecisionJSON(decision authorization.Decision) ([]byte, error)
CanonicalDecisionJSON returns deterministic indented fixture JSON with one LF. It is not a signature/canonicalization standard and normalizes unknown outcome labels through String.
func DenyEvaluator ¶
func DenyEvaluator(reason authorization.ReasonCode) authorization.Evaluator
DenyEvaluator returns an unconditional deny fixture with the supplied non-secret reason.
func ErrorEvaluator ¶
func ErrorEvaluator(err error) authorization.Evaluator
ErrorEvaluator returns a no-match fixture with the borrowed error; nil means no error.
func MustEngine ¶
func MustEngine( t TestingT, snapshot *authorization.Snapshot, options ...authorization.EngineOption, ) *authorization.Engine
MustEngine constructs an engine or fails the test with constructor diagnostics.
func MustSnapshot ¶
func MustSnapshot( t TestingT, revision authorization.Revision, algorithm authorization.CombiningAlgorithm, definitions ...authorization.PolicyDefinition, ) *authorization.Snapshot
MustSnapshot constructs a snapshot or fails the test with constructor diagnostics.
func NotApplicableEvaluator ¶
func NotApplicableEvaluator() authorization.Evaluator
NotApplicableEvaluator returns an unconditional no-match fixture.
func RequireDecision ¶
func RequireDecision( t TestingT, got authorization.Decision, err error, want authorization.Decision, )
RequireDecision requires no error and full deep equality, reporting raw fixture diagnostics on failure.
func RequireOutcome ¶
func RequireOutcome( t TestingT, decision authorization.Decision, want authorization.Outcome, )
RequireOutcome checks only the outcome, not reason/revision/diagnostic equality.
func RunAuthorizerConformance ¶
func RunAuthorizerConformance(t *testing.T, factory AuthorizerFactory)
RunAuthorizerConformance runs selected common allow/deny/default-deny/error/invalid/canceled scenarios. It is not exhaustive model or external-standard qualification.
Types ¶
type AuthorizerFactory ¶
type AuthorizerFactory func(authorization.Evaluator) authorization.Authorizer
AuthorizerFactory constructs one authorizer around the supplied fixture evaluator.
type RequestBuilder ¶
type RequestBuilder struct {
// contains filtered or unexported fields
}
RequestBuilder is mutable fixture state; it is not safe for concurrent mutation.
func NewRequest ¶
func NewRequest() *RequestBuilder
NewRequest returns an independent valid document-read fixture with deterministic identity/time.
func (*RequestBuilder) Build ¶
func (builder *RequestBuilder) Build() authorization.Request
Build copies group slices and attribute maps; immutable Values are shared by value. It does not validate the request.
func (*RequestBuilder) WithAction ¶
func (builder *RequestBuilder) WithAction(action authorization.Action) *RequestBuilder
WithAction replaces the exact operation label and returns the same builder.
func (*RequestBuilder) WithAttribute ¶
func (builder *RequestBuilder) WithAttribute( name authorization.AttributeName, value authorization.Value, ) *RequestBuilder
WithAttribute sets one request fact and returns the same builder.
func (*RequestBuilder) WithEnvironmentAttribute ¶
func (builder *RequestBuilder) WithEnvironmentAttribute( name authorization.AttributeName, value authorization.Value, ) *RequestBuilder
WithEnvironmentAttribute sets one environment fact and returns the same builder.
func (*RequestBuilder) WithGroup ¶
func (builder *RequestBuilder) WithGroup(id authorization.SubjectID) *RequestBuilder
WithGroup appends membership without deduplication/validation and returns the same builder.
func (*RequestBuilder) WithResource ¶
func (builder *RequestBuilder) WithResource( typeName authorization.ResourceType, id authorization.ResourceID, ) *RequestBuilder
WithResource replaces type/instance labels and returns the same builder.
func (*RequestBuilder) WithResourceAttribute ¶
func (builder *RequestBuilder) WithResourceAttribute( name authorization.AttributeName, value authorization.Value, ) *RequestBuilder
WithResourceAttribute sets one resource fact and returns the same builder.
func (*RequestBuilder) WithSubject ¶
func (builder *RequestBuilder) WithSubject( kind authorization.SubjectKind, id authorization.SubjectID, ) *RequestBuilder
WithSubject replaces kind/ID without validation and returns the same builder.
func (*RequestBuilder) WithSubjectAttribute ¶
func (builder *RequestBuilder) WithSubjectAttribute( name authorization.AttributeName, value authorization.Value, ) *RequestBuilder
WithSubjectAttribute sets one subject fact and returns the same builder.
func (*RequestBuilder) WithTenant ¶
func (builder *RequestBuilder) WithTenant(tenant authorization.TenantID) *RequestBuilder
WithTenant replaces scope without verifying membership and returns the same builder.
func (*RequestBuilder) WithTime ¶
func (builder *RequestBuilder) WithTime(at time.Time) *RequestBuilder
WithTime normalizes fixture time to UTC without monotonic data.
type StaticEvaluator ¶
type StaticEvaluator struct {
// Decision is configured fixture output; Evaluate copies its ID/trace slices.
Decision authorization.Decision
// Err is a borrowed error cause; deliberate unwrapping/fixture use can expose its text/type.
Err error
}
StaticEvaluator returns configured output independently of request/context; keep its state stable across calls.
func (StaticEvaluator) Evaluate ¶
func (evaluator StaticEvaluator) Evaluate( context.Context, authorization.Request, ) (authorization.Decision, error)
Evaluate copies decision slices and returns the borrowed Err, ignoring cancellation and request validation.
Source Files