@nitra/cursor 1.8.222 → 1.8.228

package/policy/abie/health_check_policy/health_check_policy_test.rego

@@ -0,0 +1,99 @@
+# Тести для `abie.health_check_policy`. Запуск:
+#   conftest verify -p npm/policy/abie/health_check_policy
+package abie.health_check_policy_test
+
+import rego.v1
+
+import data.abie.health_check_policy
+
+valid_hcp := {
+	"apiVersion": "networking.gke.io/v1",
+	"kind": "HealthCheckPolicy",
+	"metadata": {"name": "api"},
+	"spec": {
+		"default": {"config": {
+			"type": "HTTP",
+			"httpHealthCheck": {"requestPath": "/healthz", "port": 8080},
+		}},
+		"targetRef": {"group": "", "kind": "Service", "name": "api-hl"},
+	},
+}
+
+# ── happy path ────────────────────────────────────────────────────────────
+
+test_allow_canonical if {
+	count(health_check_policy.deny) == 0 with input as valid_hcp
+}
+
+# ── apiVersion ────────────────────────────────────────────────────────────
+
+test_deny_wrong_api_version if {
+	bad := json.patch(valid_hcp, [{"op": "replace", "path": "/apiVersion", "value": "networking.gke.io/v1beta1"}])
+	count(health_check_policy.deny) > 0 with input as bad
+}
+
+# ── metadata.name ─────────────────────────────────────────────────────────
+
+test_deny_empty_name if {
+	bad := json.patch(valid_hcp, [{"op": "replace", "path": "/metadata/name", "value": ""}])
+	count(health_check_policy.deny) > 0 with input as bad
+}
+
+# ── spec.default.config.type ──────────────────────────────────────────────
+
+test_deny_config_type_not_http if {
+	bad := json.patch(valid_hcp, [{"op": "replace", "path": "/spec/default/config/type", "value": "TCP"}])
+	count(health_check_policy.deny) > 0 with input as bad
+}
+
+# ── requestPath ───────────────────────────────────────────────────────────
+
+test_deny_empty_request_path if {
+	bad := json.patch(valid_hcp, [{
+		"op": "replace",
+		"path": "/spec/default/config/httpHealthCheck/requestPath",
+		"value": "",
+	}])
+	count(health_check_policy.deny) > 0 with input as bad
+}
+
+test_deny_request_path_without_slash if {
+	bad := json.patch(valid_hcp, [{
+		"op": "replace",
+		"path": "/spec/default/config/httpHealthCheck/requestPath",
+		"value": "healthz",
+	}])
+	count(health_check_policy.deny) > 0 with input as bad
+}
+
+# ── port ──────────────────────────────────────────────────────────────────
+
+test_deny_port_not_8080 if {
+	bad := json.patch(valid_hcp, [{
+		"op": "replace",
+		"path": "/spec/default/config/httpHealthCheck/port",
+		"value": 9090,
+	}])
+	count(health_check_policy.deny) > 0 with input as bad
+}
+
+# ── targetRef ─────────────────────────────────────────────────────────────
+
+test_deny_target_ref_kind_not_service if {
+	bad := json.patch(valid_hcp, [{"op": "replace", "path": "/spec/targetRef/kind", "value": "Gateway"}])
+	count(health_check_policy.deny) > 0 with input as bad
+}
+
+test_deny_target_ref_name_without_hl if {
+	bad := json.patch(valid_hcp, [{"op": "replace", "path": "/spec/targetRef/name", "value": "api"}])
+	count(health_check_policy.deny) > 0 with input as bad
+}
+
+# Не HCP — пакет не діє.
+test_allow_other_kind if {
+	count(health_check_policy.deny) == 0 with input as {
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {"name": "x"},
+	}
+}

package/policy/abie/http_route_base/http_route_base_test.rego

@@ -0,0 +1,64 @@
+# Тести для `abie.http_route_base`. Запуск:
+#   conftest verify -p npm/policy/abie/http_route_base
+package abie.http_route_base_test
+
+import rego.v1
+
+import data.abie.http_route_base
+
+mk_route(hostnames) := {
+	"apiVersion": "gateway.networking.k8s.io/v1",
+	"kind": "HTTPRoute",
+	"metadata": {"name": "r", "namespace": "dev"},
+	"spec": {"hostnames": hostnames},
+}
+
+# ── allow ────────────────────────────────────────────────────────────────
+
+test_allow_apex if {
+	count(http_route_base.deny) == 0 with input as mk_route(["aiml.live"])
+}
+
+test_allow_subdomain if {
+	count(http_route_base.deny) == 0 with input as mk_route(["api.aiml.live"])
+}
+
+test_allow_wildcard if {
+	count(http_route_base.deny) == 0 with input as mk_route(["*.aiml.live"])
+}
+
+test_allow_uppercase_apex if {
+	count(http_route_base.deny) == 0 with input as mk_route(["AIML.LIVE"])
+}
+
+test_allow_multiple_subdomains if {
+	count(http_route_base.deny) == 0 with input as mk_route(["api.aiml.live", "admin.aiml.live"])
+}
+
+# ── deny ─────────────────────────────────────────────────────────────────
+
+test_deny_other_apex if {
+	count(http_route_base.deny) > 0 with input as mk_route(["example.com"])
+}
+
+test_deny_wrong_subdomain if {
+	count(http_route_base.deny) > 0 with input as mk_route(["api.example.com"])
+}
+
+test_deny_mixed_one_bad if {
+	count(http_route_base.deny) > 0 with input as mk_route(["api.aiml.live", "evil.com"])
+}
+
+test_deny_aiml_live_substring if {
+	# "aiml.live.example.com" не має закінчуватись на ".aiml.live" — це інший домен.
+	count(http_route_base.deny) > 0 with input as mk_route(["aiml.live.example.com"])
+}
+
+# Не HTTPRoute — пакет не діє.
+test_allow_non_httproute if {
+	count(http_route_base.deny) == 0 with input as {
+		"apiVersion": "v1",
+		"kind": "Service",
+		"metadata": {"name": "x"},
+	}
+}