Function TestBasicPolicyEngine_Evaluate_Deny

pkg/security/policy_test.go:192–230

(t *testing.T)

}

func TestBasicPolicyEngine_Evaluate_Deny(t *testing.T) {
	engine := NewBasicPolicyEngine(nil, &mockAuditLog{})

	policy := &SecurityPolicy{
		ID:        "policy1",
		Name:      "Deny Policy",
		Enabled:   true,
		Priority:  10,
		Scope:     ScopeGlobal,
		Target:    TargetAll,
		Action:    ActionDeny,
		Resources: []string{"secret"},
		Deny:      []string{"read"},
	}
	_ = engine.AddPolicy(policy)

	request := &PolicyRequest{
		RequestID: "req1",
		UserID:    "user1",
		Action:    "read",
		Resource:  "secret",
		Timestamp: time.Now(),
		Context:   make(map[string]any),
		Metadata:  make(map[string]any),
	}

	evaluation, err := engine.Evaluate(request)
	if err != nil {
		t.Fatalf("Evaluate failed: %v", err)
	}

	if evaluation.Allowed {
		t.Error("expected evaluation to deny access")
	}

	if evaluation.Action != ActionDeny {
		t.Errorf("expected action Deny, got %v", evaluation.Action)
	}
}

func TestBasicPolicyEngine_Evaluate_NoMatchingPolicy(t *testing.T) {
	engine := NewBasicPolicyEngine(nil, &mockAuditLog{})