Implement Stage A: rule engine, validation, audit, and safety gates
Completes 109 of 121 tasks. Every remaining task needs a tenant connection
(T055, T056, T101-T103) or an Azure Automation account (T115-T121).
354 offline Pester tests PASS
Engine purity (Principle IV) PASS
Sanitization (SC-013) PASS (156 files)
Graph module loaded in tests none (SC-008 holds)
What landed
- Four-layer configuration validation with stable finding codes, covering
every VR-002 and VR-003 condition, plus a 23-fixture invalid-config corpus
- Run loop, audit records (NDJSON through a single sink), summaries,
reconciliation, and exit codes 0-6
- Persistence behind a single write-body builder whose result always has
exactly one key
- Invoke-PersonaEngine.ps1 and Edit-PersonaEngineConfig.ps1
- Six docs, two pipelines, traceability matrix, V-5a and sanitization records
Three deviations from tasks.md, each recorded in its status block
T033 is not in Resolve-UserPersona. evaluationErrorThreshold is run-level
state and the rule engine is pure; a counter there would break Principle IV.
It lives in New-PersonaRunCounter and is applied in the run loop.
A new src/Engine/ layer holds Invoke-PersonaEngineRun. The entry script
imports the manifest, which requires Microsoft.Graph.Authentication, so a
loop living only inside it could not run on a machine without the Graph SDK
and SC-004 could not be proven at all. The entry script is now a thin
wrapper and what ships is what is tested.
The invalid-config corpus is generated by a committed script, with the
generated fixtures committed too, so a reviewer sees the fixture in the diff.
Defects found by running the code, not by reading it
Group and role ID lists were double-wrapped: @(Get-PersonaGroupIdPage ...)
around a comma-returned array collapsed every membership list into one
bogus space-joined entry. That is a silent false non-match, exactly what
FR-013 exists to prevent.
A 403 whose status appears only in the exception message parsed as $null,
which the retry policy treats as a transport error - five requests per
account against a tenant already refusing. Status extraction now falls back
to the message text, bounded to 400-599.
The sanitization scan walked tracked files only, so it covered 34 of 156
files and none of this phase's code. It now scans untracked non-ignored
files too, and a negative control confirms it catches a planted leak.
Test-Json reports one error per violating location, not first-failure-only
as the V-5a draft claimed. Record and pin corrected.
Enforcement remains blocked on the V-4 security sign-off.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,114 @@
|
||||
#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '5.0.0' }
|
||||
|
||||
BeforeAll {
|
||||
$repoRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
|
||||
foreach ($f in @(
|
||||
'src/Normalization/New-PersonaMembershipRecord.ps1'
|
||||
'src/Normalization/New-PersonaUserRecord.ps1'
|
||||
'src/RuleEngine/Test-PersonaCondition.ps1'
|
||||
'src/RuleEngine/Test-PersonaConditionGroup.ps1'
|
||||
'src/RuleEngine/Test-PersonaRule.ps1'
|
||||
'src/RuleEngine/Resolve-UserPersona.ps1'
|
||||
)) { . (Join-Path $repoRoot $f) }
|
||||
|
||||
function New-MatchAllRule {
|
||||
param([string] $Id, [int] $Priority, [string] $Persona, [bool] $Enabled = $true, [string] $Department = 'Finance')
|
||||
[pscustomobject]@{
|
||||
id = $Id
|
||||
priority = $Priority
|
||||
persona = $Persona
|
||||
enabled = $Enabled
|
||||
match = [pscustomobject]@{
|
||||
operator = 'all'
|
||||
conditions = @([pscustomobject]@{ type = 'property'; property = 'Department'; operator = 'equals'; value = $Department })
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$script:user = New-PersonaUserRecord `
|
||||
-AccountObjectId '00000000-0000-0000-0000-000000000101' `
|
||||
-UserPrincipalName 'alex.employee@example.invalid' `
|
||||
-Properties @{ Department = 'Finance' }
|
||||
}
|
||||
|
||||
Describe 'Rule ordering and first-match (FR-008, FR-009, RE-002)' {
|
||||
|
||||
It 'evaluates in ascending priority order and stops at the first match' {
|
||||
$rules = @(
|
||||
New-MatchAllRule -Id 'R-020' -Priority 20 -Persona 'Tier1-Admin'
|
||||
New-MatchAllRule -Id 'R-010' -Priority 10 -Persona 'Tier0-Admin'
|
||||
)
|
||||
$result = Resolve-UserPersona -UserRecord $user -Rules $rules
|
||||
|
||||
$result.CalculatedPersona | Should -Be 'Tier0-Admin'
|
||||
$result.MatchedRuleId | Should -Be 'R-010'
|
||||
}
|
||||
|
||||
It 'stops evaluating once matched, leaving lower-priority rules unevaluated' {
|
||||
$rules = @(
|
||||
New-MatchAllRule -Id 'R-010' -Priority 10 -Persona 'Tier0-Admin'
|
||||
New-MatchAllRule -Id 'R-020' -Priority 20 -Persona 'Tier1-Admin'
|
||||
New-MatchAllRule -Id 'R-030' -Priority 30 -Persona 'Employee'
|
||||
)
|
||||
(Resolve-UserPersona -UserRecord $user -Rules $rules).RulesEvaluated | Should -Be 1
|
||||
}
|
||||
|
||||
It 'is unaffected by the order rules appear in the collection' {
|
||||
$ascending = @(
|
||||
New-MatchAllRule -Id 'R-010' -Priority 10 -Persona 'Tier0-Admin'
|
||||
New-MatchAllRule -Id 'R-020' -Priority 20 -Persona 'Tier1-Admin'
|
||||
)
|
||||
$descending = @(
|
||||
New-MatchAllRule -Id 'R-020' -Priority 20 -Persona 'Tier1-Admin'
|
||||
New-MatchAllRule -Id 'R-010' -Priority 10 -Persona 'Tier0-Admin'
|
||||
)
|
||||
|
||||
(Resolve-UserPersona -UserRecord $user -Rules $ascending).CalculatedPersona |
|
||||
Should -Be (Resolve-UserPersona -UserRecord $user -Rules $descending).CalculatedPersona
|
||||
}
|
||||
|
||||
It 'skips disabled rules and excludes them from the evaluated count' {
|
||||
$rules = @(
|
||||
New-MatchAllRule -Id 'R-010' -Priority 10 -Persona 'Tier0-Admin' -Enabled $false
|
||||
New-MatchAllRule -Id 'R-020' -Priority 20 -Persona 'Tier1-Admin'
|
||||
)
|
||||
$result = Resolve-UserPersona -UserRecord $user -Rules $rules
|
||||
|
||||
$result.CalculatedPersona | Should -Be 'Tier1-Admin'
|
||||
$result.RulesEvaluated | Should -Be 1
|
||||
}
|
||||
|
||||
It 'breaks a duplicate-priority tie deterministically by rule id' {
|
||||
# Duplicate priorities are a validation error (VR-002). If one reaches the
|
||||
# engine anyway, the result must still not depend on collection order.
|
||||
$a = @(
|
||||
New-MatchAllRule -Id 'R-AAA' -Priority 10 -Persona 'Persona-A'
|
||||
New-MatchAllRule -Id 'R-BBB' -Priority 10 -Persona 'Persona-B'
|
||||
)
|
||||
$b = @(
|
||||
New-MatchAllRule -Id 'R-BBB' -Priority 10 -Persona 'Persona-B'
|
||||
New-MatchAllRule -Id 'R-AAA' -Priority 10 -Persona 'Persona-A'
|
||||
)
|
||||
|
||||
(Resolve-UserPersona -UserRecord $user -Rules $a).CalculatedPersona | Should -Be 'Persona-A'
|
||||
(Resolve-UserPersona -UserRecord $user -Rules $b).CalculatedPersona | Should -Be 'Persona-A'
|
||||
}
|
||||
}
|
||||
|
||||
Describe 'Outcome exclusivity (SC-001)' {
|
||||
|
||||
It 'returns exactly one outcome for every user' {
|
||||
$rules = @(New-MatchAllRule -Id 'R-010' -Priority 10 -Persona 'Employee')
|
||||
$result = Resolve-UserPersona -UserRecord $user -Rules $rules
|
||||
|
||||
$result.Outcome | Should -BeIn @('Matched', 'Unclassified', 'EvaluationError')
|
||||
}
|
||||
|
||||
It 'populates MatchedRuleId only when matched' {
|
||||
$matched = Resolve-UserPersona -UserRecord $user -Rules @(New-MatchAllRule -Id 'R-010' -Priority 10 -Persona 'Employee')
|
||||
$matched.MatchedRuleId | Should -Be 'R-010'
|
||||
|
||||
$unmatched = Resolve-UserPersona -UserRecord $user -Rules @(New-MatchAllRule -Id 'R-010' -Priority 10 -Persona 'Employee' -Department 'Legal')
|
||||
$unmatched.MatchedRuleId | Should -BeNullOrEmpty
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user