dave/personaEngine2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement Stage A: rule engine, validation, audit, and safety gates

Browse Source 
Completes 109 of 121 tasks. Every remaining task needs a tenant connection
(T055, T056, T101-T103) or an Azure Automation account (T115-T121).

  354 offline Pester tests      PASS
  Engine purity (Principle IV)  PASS
  Sanitization (SC-013)         PASS  (156 files)
  Graph module loaded in tests  none  (SC-008 holds)

What landed
  - Four-layer configuration validation with stable finding codes, covering
    every VR-002 and VR-003 condition, plus a 23-fixture invalid-config corpus
  - Run loop, audit records (NDJSON through a single sink), summaries,
    reconciliation, and exit codes 0-6
  - Persistence behind a single write-body builder whose result always has
    exactly one key
  - Invoke-PersonaEngine.ps1 and Edit-PersonaEngineConfig.ps1
  - Six docs, two pipelines, traceability matrix, V-5a and sanitization records

Three deviations from tasks.md, each recorded in its status block

  T033 is not in Resolve-UserPersona. evaluationErrorThreshold is run-level
  state and the rule engine is pure; a counter there would break Principle IV.
  It lives in New-PersonaRunCounter and is applied in the run loop.

  A new src/Engine/ layer holds Invoke-PersonaEngineRun. The entry script
  imports the manifest, which requires Microsoft.Graph.Authentication, so a
  loop living only inside it could not run on a machine without the Graph SDK
  and SC-004 could not be proven at all. The entry script is now a thin
  wrapper and what ships is what is tested.

  The invalid-config corpus is generated by a committed script, with the
  generated fixtures committed too, so a reviewer sees the fixture in the diff.

Defects found by running the code, not by reading it

  Group and role ID lists were double-wrapped: @(Get-PersonaGroupIdPage ...)
  around a comma-returned array collapsed every membership list into one
  bogus space-joined entry. That is a silent false non-match, exactly what
  FR-013 exists to prevent.

  A 403 whose status appears only in the exception message parsed as $null,
  which the retry policy treats as a transport error - five requests per
  account against a tenant already refusing. Status extraction now falls back
  to the message text, bounded to 400-599.

  The sanitization scan walked tracked files only, so it covered 34 of 156
  files and none of this phase's code. It now scans untracked non-ignored
  files too, and a negative control confirms it catches a planted leak.

  Test-Json reports one error per violating location, not first-failure-only
  as the V-5a draft claimed. Record and pin corrected.

Enforcement remains blocked on the V-4 security sign-off.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Dave
2026-08-20 21:48:19 -04:00
parent c59c85dd55
commit cdc6bb33d3
124 changed files with 16638 additions and 199 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/TestData/InvalidConfigs/New-InvalidConfigCorpus.ps1
+188
View File
@@ -0,0 +1,188 @@
<#
Regenerates the invalid-configuration corpus.
Each file is a valid configuration with exactly ONE thing broken, named after the
finding code it must produce. One defect per file is the point: a fixture with two
problems cannot prove which one produced the finding, and a validator that
reported the wrong code would still pass.
Run this only when adding a condition. The generated files are committed, so a
reviewer sees the fixture in the diff rather than a script that produces it.
pwsh ./tests/TestData/InvalidConfigs/New-InvalidConfigCorpus.ps1
#>
[CmdletBinding()]
param(
[string] $OutputDirectory = $PSScriptRoot
)
$ErrorActionPreference = 'Stop'
function New-BaseDocument {
@{
configVersion = '1.0.0'
engine = @{
targetAttribute = 'extension_<EXTENSION-APP-ID>_<PERSONA>'
approvedWritableAttributes = @('extension_<EXTENSION-APP-ID>_<PERSONA>')
maxConditionDepth = 5
summaryInterval = 25
defaultMembershipMode = 'direct'
}
dataSources = @{
groups = @{ enabled = $true }
roles = @{ enabled = $true }
}
logging = @{ destination = 'stream'; traceConditionValues = $false }
personas = @('Employee', 'Guest', 'Tier0-Admin')
rules = @(
@{
id = 'RULE-0010-GUEST'; name = 'Guest accounts'; description = 'Accounts whose user type is Guest.'
enabled = $true; priority = 10; persona = 'Guest'
match = @{ operator = 'all'; conditions = @(@{ type = 'property'; property = 'UserType'; operator = 'equals'; value = 'Guest' }) }
}
@{
id = 'RULE-0900-EMPLOYEE'; name = 'Employees'; description = 'Default classification for member accounts.'
enabled = $true; priority = 900; persona = 'Employee'
match = @{ operator = 'all'; conditions = @(@{ type = 'property'; property = 'Department'; operator = 'isNotNull' }) }
}
)
}
}
function New-MembershipRule {
param([hashtable] $Condition)
@{
id = 'RULE-0030-TIER0'; name = 'Tier 0 administrators'; description = 'Members of the Tier 0 group.'
enabled = $true; priority = 30; persona = 'Tier0-Admin'
match = @{ operator = 'all'; conditions = @($Condition) }
}
}
$cases = [ordered]@{}
# ---------------------------------------------------------------- VR-002
$d = New-BaseDocument
$d.rules[1].id = 'RULE-0010-GUEST'
$cases['PE-SEM-001-duplicate-rule-id'] = $d
$d = New-BaseDocument
$d.rules[1].priority = 10
$cases['PE-SEM-002-duplicate-priority'] = $d
$d = New-BaseDocument
foreach ($rule in $d.rules) { $rule.enabled = $false }
$cases['PE-SEM-003-no-enabled-rules'] = $d
$d = New-BaseDocument
$d.engine.targetAttribute = ' '
$cases['PE-SEM-004-blank-target-attribute'] = $d
$d = New-BaseDocument
$d.engine.approvedWritableAttributes = @('extension_<EXTENSION-APP-ID>_<SOMETHING-ELSE>')
$cases['PE-SEM-005-target-not-approved'] = $d
$d = New-BaseDocument
$d.dataSources.roles.enabled = $false
$d.rules += New-MembershipRule -Condition @{ type = 'role'; operator = 'memberOf'; roleIds = @('<TIER0-ROLE-TEMPLATE-ID>') }
$cases['PE-SEM-006-unavailable-data-source'] = $d
$d = New-BaseDocument
$d.rules += New-MembershipRule -Condition @{ type = 'membership'; operator = 'memberOf' }
$cases['PE-SEM-007-memberof-without-groups'] = $d
$d = New-BaseDocument
$d.rules[0].match.conditions[0] = @{ type = 'property'; property = 'UserType'; operator = 'in' }
$cases['PE-SEM-008-in-without-values'] = $d
$d = New-BaseDocument
$d.rules[1].match.conditions[0] = @{ type = 'property'; property = 'Department'; operator = 'isNotNull'; value = 'Finance' }
$cases['PE-SEM-009-isnull-with-value'] = $d
$d = New-BaseDocument
$d.rules[1].persona = 'Undeclared-Persona'
$cases['PE-SEM-010-undeclared-persona'] = $d
$d = New-BaseDocument
$d.rules[1].persona = 'Unclassified'
$cases['PE-SEM-011-unclassified-as-persona'] = $d
$d = New-BaseDocument
$d.engine.maxConditionDepth = 2
$d.rules[0].match = @{
operator = 'all'
conditions = @(
@{ operator = 'all'; conditions = @(
@{ operator = 'all'; conditions = @(
@{ type = 'property'; property = 'UserType'; operator = 'equals'; value = 'Guest' }
) }
) }
)
}
$cases['PE-SEM-012-depth-over-configured-maximum'] = $d
$d = New-BaseDocument
$d.engine.maxConditionDepth = 25
$cases['PE-SEM-013-depth-over-hard-ceiling'] = $d
$d = New-BaseDocument
$d.dataSources.groups.membershipMode = 'direct'
$d.rules += New-MembershipRule -Condition @{
type = 'membership'; operator = 'memberOf'; membershipMode = 'transitive'
groupObjectIds = @('00000000-0000-0000-0000-0000000000a0')
}
$cases['PE-SEM-014-mode-not-enabled-globally'] = $d
$d = New-BaseDocument
$d.rules[1].match.conditions[0] = @{ type = 'property'; property = 'employeeHireDate'; operator = 'isNotNull' }
$cases['PE-SEM-015-unsupported-property'] = $d
$d = New-BaseDocument
$d.rules[1].match.conditions[0] = @{ type = 'property'; property = 'Department'; operator = 'matchesRegex'; value = '[unclosed' }
$cases['PE-SEM-016-invalid-regex'] = $d
# ---------------------------------------------------------------- VR-003
$d = New-BaseDocument
$d.engine.targetAttribute = ''
$d.engine.approvedWritableAttributes = @('extension_<EXTENSION-APP-ID>_<PERSONA>')
$cases['PE-SAF-001-blank-target-production'] = $d
$d = New-BaseDocument
$d.engine.targetAttribute = 'department'
$d.engine.approvedWritableAttributes = @('department')
$cases['PE-SAF-002-unsupported-writable-attribute'] = $d
$d = New-BaseDocument
$d.dataSources.groups.enabled = $false
$d.rules += New-MembershipRule -Condition @{
type = 'membership'; operator = 'memberOf'; groupObjectIds = @('00000000-0000-0000-0000-0000000000a0')
}
$cases['PE-SAF-003-group-rules-without-group-retrieval'] = $d
$d = New-BaseDocument
$d.configVersion = '0.9.0'
$cases['PE-SAF-004-version-downgrade'] = $d
$d = New-BaseDocument
$d.rules = @($d.rules[0])
$cases['PE-SAF-005-rule-removed-without-version-change'] = $d
$d = New-BaseDocument
$d.logging.traceConditionValues = $true
$cases['PE-SAF-006-tracing-without-acknowledgement'] = $d
# ---------------------------------------------------------------- baseline
# The comparison baseline for PE-SAF-004 and PE-SAF-005. Valid on its own.
$d = New-BaseDocument
$cases['baseline-deployed'] = $d
foreach ($name in $cases.Keys) {
$path = Join-Path $OutputDirectory "$name.json"
Set-Content -LiteralPath $path -Value ($cases[$name] | ConvertTo-Json -Depth 32) -Encoding utf8NoBOM
Write-Host "wrote $name.json"
}
Write-Host ("{0} fixture(s) written to {1}" -f $cases.Count, $OutputDirectory)
tests/TestData/InvalidConfigs/PE-SAF-001-blank-target-production.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"targetAttribute": "",
"maxConditionDepth": 5,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
],
"defaultMembershipMode": "direct",
"summaryInterval": 25
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}
tests/TestData/InvalidConfigs/PE-SAF-002-unsupported-writable-attribute.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"targetAttribute": "department",
"maxConditionDepth": 5,
"approvedWritableAttributes": [
"department"
],
"defaultMembershipMode": "direct",
"summaryInterval": 25
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}
tests/TestData/InvalidConfigs/PE-SAF-003-group-rules-without-group-retrieval.json
+88
View File
@@ -0,0 +1,88 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": false
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
},
{
"id": "RULE-0030-TIER0",
"persona": "Tier0-Admin",
"description": "Members of the Tier 0 group.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "memberOf",
"type": "membership",
"groupObjectIds": [
"00000000-0000-0000-0000-0000000000a0"
]
}
]
},
"priority": 30,
"enabled": true,
"name": "Tier 0 administrators"
}
]
}
tests/TestData/InvalidConfigs/PE-SAF-004-version-downgrade.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "0.9.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}
tests/TestData/InvalidConfigs/PE-SAF-005-rule-removed-without-version-change.json
+50
View File
@@ -0,0 +1,50 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
}
]
}
tests/TestData/InvalidConfigs/PE-SAF-006-tracing-without-acknowledgement.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"traceConditionValues": true,
"destination": "stream"
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-001-duplicate-rule-id.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"persona": "Employee",
"enabled": true,
"priority": 900,
"description": "Default classification for member accounts.",
"name": "Employees",
"id": "RULE-0010-GUEST"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-002-duplicate-priority.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"persona": "Employee",
"enabled": true,
"priority": 10,
"description": "Default classification for member accounts.",
"name": "Employees",
"id": "RULE-0900-EMPLOYEE"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-003-no-enabled-rules.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"persona": "Guest",
"enabled": false,
"priority": 10,
"description": "Accounts whose user type is Guest.",
"name": "Guest accounts",
"id": "RULE-0010-GUEST"
},
{
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"persona": "Employee",
"enabled": false,
"priority": 900,
"description": "Default classification for member accounts.",
"name": "Employees",
"id": "RULE-0900-EMPLOYEE"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-004-blank-target-attribute.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"targetAttribute": " ",
"maxConditionDepth": 5,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
],
"defaultMembershipMode": "direct",
"summaryInterval": 25
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-005-target-not-approved.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"maxConditionDepth": 5,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<SOMETHING-ELSE>"
],
"defaultMembershipMode": "direct",
"summaryInterval": 25
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-006-unavailable-data-source.json
+88
View File
@@ -0,0 +1,88 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": false
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
},
{
"id": "RULE-0030-TIER0",
"persona": "Tier0-Admin",
"description": "Members of the Tier 0 group.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "memberOf",
"type": "role",
"roleIds": [
"<TIER0-ROLE-TEMPLATE-ID>"
]
}
]
},
"priority": 30,
"enabled": true,
"name": "Tier 0 administrators"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-007-memberof-without-groups.json
+85
View File
@@ -0,0 +1,85 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
},
{
"id": "RULE-0030-TIER0",
"persona": "Tier0-Admin",
"description": "Members of the Tier 0 group.",
"match": {
"operator": "all",
"conditions": [
{
"type": "membership",
"operator": "memberOf"
}
]
},
"priority": 30,
"enabled": true,
"name": "Tier 0 administrators"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-008-in-without-values.json
+67
View File
@@ -0,0 +1,67 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "in",
"type": "property",
"property": "UserType"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-009-isnull-with-value.json
+69
View File
@@ -0,0 +1,69 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department",
"value": "Finance"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-010-undeclared-persona.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"persona": "Undeclared-Persona",
"enabled": true,
"priority": 900,
"description": "Default classification for member accounts.",
"name": "Employees",
"id": "RULE-0900-EMPLOYEE"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-011-unclassified-as-persona.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"persona": "Unclassified",
"enabled": true,
"priority": 900,
"description": "Default classification for member accounts.",
"name": "Employees",
"id": "RULE-0900-EMPLOYEE"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-012-depth-over-configured-maximum.json
+78
View File
@@ -0,0 +1,78 @@
{
"configVersion": "1.0.0",
"engine": {
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"maxConditionDepth": 2,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
],
"defaultMembershipMode": "direct",
"summaryInterval": 25
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"match": {
"operator": "all",
"conditions": [
{
"operator": "all",
"conditions": [
{
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
}
]
}
]
},
"persona": "Guest",
"enabled": true,
"priority": 10,
"description": "Accounts whose user type is Guest.",
"name": "Guest accounts",
"id": "RULE-0010-GUEST"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-013-depth-over-hard-ceiling.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"maxConditionDepth": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
],
"defaultMembershipMode": "direct",
"summaryInterval": 25
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-014-mode-not-enabled-globally.json
+90
View File
@@ -0,0 +1,90 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"membershipMode": "direct",
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
},
{
"id": "RULE-0030-TIER0",
"persona": "Tier0-Admin",
"description": "Members of the Tier 0 group.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "memberOf",
"type": "membership",
"membershipMode": "transitive",
"groupObjectIds": [
"00000000-0000-0000-0000-0000000000a0"
]
}
]
},
"priority": 30,
"enabled": true,
"name": "Tier 0 administrators"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-015-unsupported-property.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "employeeHireDate"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}
tests/TestData/InvalidConfigs/PE-SEM-016-invalid-regex.json
+69
View File
@@ -0,0 +1,69 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "matchesRegex",
"type": "property",
"property": "Department",
"value": "[unclosed"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}
tests/TestData/InvalidConfigs/baseline-deployed.json
+68
View File
@@ -0,0 +1,68 @@
{
"configVersion": "1.0.0",
"engine": {
"maxConditionDepth": 5,
"defaultMembershipMode": "direct",
"targetAttribute": "extension_<EXTENSION-APP-ID>_<PERSONA>",
"summaryInterval": 25,
"approvedWritableAttributes": [
"extension_<EXTENSION-APP-ID>_<PERSONA>"
]
},
"personas": [
"Employee",
"Guest",
"Tier0-Admin"
],
"dataSources": {
"groups": {
"enabled": true
},
"roles": {
"enabled": true
}
},
"logging": {
"destination": "stream",
"traceConditionValues": false
},
"rules": [
{
"id": "RULE-0010-GUEST",
"persona": "Guest",
"description": "Accounts whose user type is Guest.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "equals",
"type": "property",
"property": "UserType",
"value": "Guest"
}
]
},
"priority": 10,
"enabled": true,
"name": "Guest accounts"
},
{
"id": "RULE-0900-EMPLOYEE",
"persona": "Employee",
"description": "Default classification for member accounts.",
"match": {
"operator": "all",
"conditions": [
{
"operator": "isNotNull",
"type": "property",
"property": "Department"
}
]
},
"priority": 900,
"enabled": true,
"name": "Employees"
}
]
}