mirror of
https://github.com/hanzoai/vault.git
synced 2026-10-30 18:18:35 +00:00
zeekay
5f514fa2d9
- AES-256-GCM encryption with envelope key management (HSM-ready) - Token generation with PAN fingerprinting and brand detection - RBAC authorization (tokenizer, operator, key admin, auditor roles) - Immutable audit logging for all vault operations - Card storage with multi-tenant isolation - HTTP API: tokenize, detokenize, metadata, delete, rotate - Comprehensive test suite (19 tests, all passing) Production TODOs: HSM backend, PostgreSQL storage, mTLS, append-only audit DB
53 lines
1.3 KiB
Go
53 lines
1.3 KiB
Go
package auth
|
|
|
|
import "testing"
|
|
|
|
func TestAuthorize(t *testing.T) {
|
|
tests := []struct {
|
|
role Role
|
|
op Operation
|
|
expect bool
|
|
}{
|
|
// Tokenizer
|
|
{RoleTokenizer, OpTokenize, true},
|
|
{RoleTokenizer, OpMetadata, true},
|
|
{RoleTokenizer, OpDelete, true},
|
|
{RoleTokenizer, OpDetokenize, false},
|
|
{RoleTokenizer, OpRotate, false},
|
|
{RoleTokenizer, OpKeyGenerate, false},
|
|
|
|
// Operator
|
|
{RoleOperator, OpTokenize, true},
|
|
{RoleOperator, OpDetokenize, true},
|
|
{RoleOperator, OpDelete, true},
|
|
{RoleOperator, OpRotate, true},
|
|
{RoleOperator, OpMetadata, true},
|
|
{RoleOperator, OpKeyGenerate, false},
|
|
|
|
// Key Admin
|
|
{RoleKeyAdmin, OpKeyGenerate, true},
|
|
{RoleKeyAdmin, OpKeyRotate, true},
|
|
{RoleKeyAdmin, OpKeyDestroy, true},
|
|
{RoleKeyAdmin, OpTokenize, false},
|
|
{RoleKeyAdmin, OpDetokenize, false},
|
|
|
|
// Auditor
|
|
{RoleAuditor, OpAuditRead, true},
|
|
{RoleAuditor, OpTokenize, false},
|
|
{RoleAuditor, OpDetokenize, false},
|
|
|
|
// Unknown role
|
|
{Role("unknown"), OpTokenize, false},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
err := Authorize(tt.role, tt.op)
|
|
if tt.expect && err != nil {
|
|
t.Errorf("Authorize(%s, %s) should succeed, got %v", tt.role, tt.op, err)
|
|
}
|
|
if !tt.expect && err == nil {
|
|
t.Errorf("Authorize(%s, %s) should fail", tt.role, tt.op)
|
|
}
|
|
}
|
|
}
|