Zhengchao An a7827ed91b test(policy): add property tests for the policy evaluation algebra (#4840) ...

crates/policy had zero property tests: the wildcard Action/Resource matching
and Deny-first evaluation in Policy::is_allowed — the algebra authorization
safety rests on — were guarded only by example-based tests.

Add crates/policy/tests/policy_eval_proptest.rs with three generated-input
invariants (pure evaluation, no IO or global state, parallel-safe):

- explicit_deny_anywhere_denies: a Deny matching the request denies it no
  matter how many broad Allow statements co-exist or at which index the Deny
  sits; a built-in sanity assertion first proves the Allows alone would permit,
  so the Deny is what flips the decision.
- wildcard_superset_implies_concrete_match: any request allowed by an
  exact-action/exact-resource policy is also allowed after widening to s3:* on
  bucket/* and to * on arn:aws:s3:::*, checked both on the built grant and on
  random probe requests (implication form).
- empty_policy_denies_everything: a statement-less policy and Policy::default()
  deny every non-owner request.

Statements are built from JSON exactly as production policies arrive via
PutPolicy. Generated names avoid wildcard metacharacters so the only wildcards
in play are the ones the properties introduce deliberately. proptest joins
crates/policy dev-deps following the filemeta/ecstore precedent.

Refs: backlog#1151 (sec-9)

2026-07-15 10:48:01 +00:00

..

bucket_iam_authz_matrix.rs

test(security): add bucket-policy x IAM priority conflict matrix (#4825)

2026-07-15 04:06:26 +00:00

policy_eval_proptest.rs

test(policy): add property tests for the policy evaluation algebra (#4840)

2026-07-15 10:48:01 +00:00

policy_is_allowed.rs

fix(policy): compare NotResource in Statement equality (#4454)

2026-07-08 17:02:20 +08:00