From b3902e2ba3c3f6e5f76312d85bc0c166f2dc5f47 Mon Sep 17 00:00:00 2001 From: Aaron Clawson <3766680+MadVikingGod@users.noreply.github.com> Date: Thu, 15 Aug 2024 01:52:21 +0200 Subject: [PATCH] Add tests for rego policies (#1334) Co-authored-by: Aaron Clawson Co-authored-by: Liudmila Molkova --- Makefile | 5 +++++ policies/registry_test.rego | 24 ++++++++++++++++++++++++ 2 files changed, 29 insertions(+) create mode 100644 policies/registry_test.rego diff --git a/Makefile b/Makefile index a424f222f6..9976671c68 100644 --- a/Makefile +++ b/Makefile @@ -120,6 +120,11 @@ check-policies: --diagnostic-format=ansi \ --policy=/policies/registry.rego +# Test rego policies +.PHONY: test-policies +test-policies: + docker run --rm -v $(PWD)/policies:/policies openpolicyagent/opa:0.67.1 test --explain fails /policies + # Generate markdown tables from YAML definitions .PHONY: table-generation table-generation: diff --git a/policies/registry_test.rego b/policies/registry_test.rego new file mode 100644 index 0000000000..4880af7b0f --- /dev/null +++ b/policies/registry_test.rego @@ -0,0 +1,24 @@ +package before_resolution_test + +import data.before_resolution + +import future.keywords.if + +test_registry_attribute_groups if { + count(before_resolution.deny) > 0 with input as {"groups": [{"id": "registry.test", "type": "foo"}]} + count(before_resolution.deny) == 0 with input as {"groups": [{"id": "registry.test", "type": "attribute_group"}]} +} + +test_attribute_ids if { + # This requires a prefix for use with opa, but weaver will fill in. + count(before_resolution.deny) > 0 with input as {"groups": [{"id": "not_registry", "prefix": "", "attributes": [{"id": "foo"}]}]} + count(before_resolution.deny) == 0 with input as {"groups": [ + {"id": "registry.test", "prefix": "", "attributes": [{"id": "foo"}]}, + {"id": "not_registry", "prefix": "", "attributes": [{"ref": "foo"}]}, + ]} +} + +test_attribute_refs if { + count(before_resolution.deny) > 0 with input as {"groups": [{"id": "registry.foo", "attributes": [{"ref": "foo"}]}]} + count(before_resolution.deny) == 0 with input as {"groups": [{"id": "not_registry", "attributes": [{"ref": "foo"}]}]} +}