up

src/Policy/__Tests/StellaOps.Policy.Tests/SplLayeringEngineTests.cs

@@ -0,0 +1,64 @@
+using System.Text.Json;
+using StellaOps.Policy;
+using Xunit;
+
+namespace StellaOps.Policy.Tests;
+
+public class SplLayeringEngineTests
+{
+    [Fact]
+    public void Merge_ReplacesStatementsById_AndKeepsBaseOnes()
+    {
+        const string baseDoc = """
+        {"apiVersion":"spl.stellaops/v1","kind":"Policy","metadata":{"name":"demo"},"spec":{"defaultEffect":"deny","statements":[{"id":"A","effect":"allow","match":{"resource":"/r","actions":["read"]}}, {"id":"B","effect":"deny","match":{"resource":"/r","actions":["write"]}}]}}
+        """;
+
+        const string overlay = """
+        {"apiVersion":"spl.stellaops/v1","kind":"Policy","metadata":{"name":"demo"},"spec":{"statements":[{"id":"A","effect":"deny","match":{"resource":"/r","actions":["read","write"]}}, {"id":"C","effect":"allow","match":{"resource":"/r","actions":["read"]}}]}}
+        """;
+
+        var merged = SplLayeringEngine.Merge(baseDoc, overlay);
+
+        const string expected = "{\"apiVersion\":\"spl.stellaops/v1\",\"kind\":\"Policy\",\"metadata\":{\"name\":\"demo\"},\"spec\":{\"defaultEffect\":\"deny\",\"statements\":[{\"effect\":\"deny\",\"id\":\"A\",\"match\":{\"actions\":[\"read\",\"write\"],\"resource\":\"/r\"}},{\"effect\":\"deny\",\"id\":\"B\",\"match\":{\"actions\":[\"write\"],\"resource\":\"/r\"}},{\"effect\":\"allow\",\"id\":\"C\",\"match\":{\"actions\":[\"read\"],\"resource\":\"/r\"}}]}}";
+
+        Assert.Equal(expected, merged);
+    }
+
+    [Fact]
+    public void Merge_MergesMetadataAndDefaultEffect()
+    {
+        const string baseDoc = """
+        {"apiVersion":"spl.stellaops/v1","kind":"Policy","metadata":{"name":"demo","labels":{"env":"dev"}},"spec":{"defaultEffect":"deny","statements":[{"id":"A","effect":"allow","match":{"resource":"/r","actions":["read"]}}]}}
+        """;
+
+        const string overlay = """
+        {"apiVersion":"spl.stellaops/v1","kind":"Policy","metadata":{"labels":{"env":"prod","tier":"gold"}},"spec":{"defaultEffect":"allow","statements":[{"id":"B","effect":"deny","match":{"resource":"/r","actions":["write"]}}]}}
+        """;
+
+        var merged = SplLayeringEngine.Merge(baseDoc, overlay);
+
+        const string expected = "{\"apiVersion\":\"spl.stellaops/v1\",\"kind\":\"Policy\",\"metadata\":{\"labels\":{\"env\":\"prod\",\"tier\":\"gold\"},\"name\":\"demo\"},\"spec\":{\"defaultEffect\":\"allow\",\"statements\":[{\"effect\":\"allow\",\"id\":\"A\",\"match\":{\"actions\":[\"read\"],\"resource\":\"/r\"}},{\"effect\":\"deny\",\"id\":\"B\",\"match\":{\"actions\":[\"write\"],\"resource\":\"/r\"}}]}}";
+
+        Assert.Equal(expected, merged);
+    }
+
+    [Fact]
+    public void Merge_PreservesUnknownTopLevelAndSpecFields()
+    {
+        const string baseDoc = """
+        {"apiVersion":"spl.stellaops/v1","kind":"Policy","metadata":{"name":"demo"},"extras":{"foo":1},"spec":{"defaultEffect":"deny","statements":[{"id":"A","effect":"allow","match":{"resource":"/r","actions":["read"]}}],"extensions":{"bar":true}}}
+        """;
+
+        const string overlay = """
+        {"apiVersion":"spl.stellaops/v1","kind":"Policy","metadata":{"name":"demo"},"spec":{"statements":[{"id":"B","effect":"deny","match":{"resource":"/r","actions":["write"]}}]}}
+        """;
+
+        var merged = SplLayeringEngine.Merge(baseDoc, overlay);
+
+        using var doc = JsonDocument.Parse(merged);
+        var root = doc.RootElement;
+
+        Assert.True(root.TryGetProperty("extras", out var extras) && extras.TryGetProperty("foo", out var foo) && foo.GetInt32() == 1);
+        Assert.True(root.GetProperty("spec").TryGetProperty("extensions", out var extensions) && extensions.TryGetProperty("bar", out var bar) && bar.GetBoolean());
+    }
+}