ZDDC/zddc/internal/zddc/file_test.go
ZDDC 2ccd72fa35 feat(zddc): inherit:false fence + strict-mode refusal
A .zddc may now declare `acl.inherit: false` to fence off ancestor
grants and roles from the descendant subtree — the "complete reset
plus add back" pattern operators want for vendor folders and other
narrowly-scoped subtrees. The cascade walker honors the deepest fence
in [0, toIdx] when evaluating any level at-or-below it, both for
GrantedVerbsAtLevel/EffectiveVerbsRange and for role lookup
(RoleMembers / lookupRoleMembers).

Federal/strict cascade mode IGNORES the fence — required by
NIST AC-6 ("ancestor deny is absolute; no leaf-level override"). So
inherit:false has no effect under strict mode and ancestor grants
remain visible. Operators running the federal Rego preset get the
same behaviour from external policy enforcement.

API surface: ACLRules.Inherit (*bool, nil = unset = inherit-true);
ACLRules.InheritsAncestors() bool; PolicyChain.VisibleStart(toIdx,
mode) int. The mode parameter is now threaded through
GrantedVerbsAtLevel, MatchesPrincipal, MatchingPrincipals,
RoleMembers, and lookupRoleMembers so role resolution is fence-aware.

Tests:
- file_test.go: parser round-trip for absent / true / false inherit
- inherit_test.go: VisibleStart (no fence, fence clamps, nested fences,
  strict-mode override), EffectiveVerbs (fence hides ancestor grants,
  strict-mode keeps them), RoleMembers (ancestor roles hidden by fence,
  local redefinition still works)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-07 10:59:20 -05:00

136 lines
3.5 KiB
Go

package zddc
import (
"os"
"path/filepath"
"testing"
)
// TestParseFile_TablesRoundTrip exercises the Tables field added to
// support the table tool. A .zddc with a tables: map should round-trip
// through ParseFile cleanly without disturbing existing fields.
func TestParseFile_TablesRoundTrip(t *testing.T) {
root := t.TempDir()
body := `acl:
permissions:
"*@example.com": rwcd
title: Demo
apps:
archive: stable
tables:
MDL: ./MDL.table.yaml
Subcontracts: ./contracts/subs.table.yaml
roles:
reviewers:
members: ["bob@example.com"]
`
path := filepath.Join(root, ".zddc")
if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
t.Fatalf("write .zddc: %v", err)
}
zf, err := ParseFile(path)
if err != nil {
t.Fatalf("ParseFile: %v", err)
}
if got := zf.Tables["MDL"]; got != "./MDL.table.yaml" {
t.Errorf("Tables[MDL] = %q want %q", got, "./MDL.table.yaml")
}
if got := zf.Tables["Subcontracts"]; got != "./contracts/subs.table.yaml" {
t.Errorf("Tables[Subcontracts] = %q want %q", got, "./contracts/subs.table.yaml")
}
// Sibling fields should still parse.
if zf.Title != "Demo" {
t.Errorf("Title = %q want %q", zf.Title, "Demo")
}
if got := zf.Apps["archive"]; got != "stable" {
t.Errorf("Apps[archive] = %q want %q", got, "stable")
}
if r, ok := zf.Roles["reviewers"]; !ok || len(r.Members) != 1 {
t.Errorf("Roles[reviewers] = %+v want one member", r)
}
if got := zf.ACL.Permissions["*@example.com"]; got != "rwcd" {
t.Errorf("ACL.Permissions[*@example.com] = %q want rwcd", got)
}
}
// TestParseFile_TablesEmptyOmitted confirms that a .zddc without a
// tables: key parses with a nil Tables map (omitempty round-trip).
func TestParseFile_TablesEmptyOmitted(t *testing.T) {
root := t.TempDir()
body := `title: NoTables
acl:
permissions:
"*@example.com": r
`
path := filepath.Join(root, ".zddc")
if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
t.Fatalf("write .zddc: %v", err)
}
zf, err := ParseFile(path)
if err != nil {
t.Fatalf("ParseFile: %v", err)
}
if zf.Tables != nil {
t.Errorf("Tables = %+v want nil for absent tables: key", zf.Tables)
}
}
// Inherit defaults to "inherit normally" when the field is absent;
// explicit true behaves the same; explicit false marks the level as
// a fence.
func TestParseFile_InheritDirective(t *testing.T) {
cases := []struct {
name string
body string
wantPtrNil bool
wantInherit bool
}{
{
name: "absent → nil pointer, inherits",
body: `acl:
permissions:
"*@example.com": r
`,
wantPtrNil: true,
wantInherit: true,
},
{
name: "explicit true → non-nil, inherits",
body: `acl:
inherit: true
permissions:
"*@example.com": r
`,
wantPtrNil: false,
wantInherit: true,
},
{
name: "explicit false → non-nil, fences",
body: `acl:
inherit: false
permissions:
"*@vendor.com": rwcd
`,
wantPtrNil: false,
wantInherit: false,
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
path := filepath.Join(t.TempDir(), ".zddc")
if err := os.WriteFile(path, []byte(tc.body), 0o644); err != nil {
t.Fatalf("write: %v", err)
}
zf, err := ParseFile(path)
if err != nil {
t.Fatalf("ParseFile: %v", err)
}
if (zf.ACL.Inherit == nil) != tc.wantPtrNil {
t.Errorf("Inherit pointer nil=%v want %v", zf.ACL.Inherit == nil, tc.wantPtrNil)
}
if got := zf.ACL.InheritsAncestors(); got != tc.wantInherit {
t.Errorf("InheritsAncestors() = %v want %v", got, tc.wantInherit)
}
})
}
}