mercredi 5 février 2020

Rego testing: how to test "not deny"?

I'm exploring testing my Rego policies using opa test starting with this trivial rule:

deny["Must be allowed"] {
  input.allowed == "no"
}

I'm able to successfully test this against a case where this is denied:

test_denied_example {
  deny with input as {"allowed":"no"}
}

However, when I try testing it against a case where it should be allowed like so:

test_allowed_example {
  not deny with input as {"allowed":"yes"}
}

I get an error:

data.example.test_allowed_example: FAIL (330.534µs)

  Enter data.example.test_allowed_example = _
  | Enter data.example.test_allowed_example
  | | Fail not data.example.deny with input as {"allowed": "yes"}
  | Fail data.example.test_allowed_example = _

I can't really parse this error message except for knowing that test_allowed_example was the failed test.

How do I properly test cases where the input is allowed (not denied)?

Aucun commentaire:

Enregistrer un commentaire