56 lines
2.6 KiB
Lua
Executable File
56 lines
2.6 KiB
Lua
Executable File
-- Pure claim-role authorization matrix; no engine globals or storage.
|
|
local factory = dofile(assert(arg[1], "access.lua path required"))
|
|
local claims = {owner = {x = 0, y = 0, z = 0}, other = {x = 40, y = 0, z = 0}}
|
|
local memberships = {owner = {resident = "resident", keeper = "storekeeper", stale = "invented"}}
|
|
local policy = factory(claims, memberships)
|
|
local p = {x = 0, y = 0, z = 0}
|
|
local passed = 0
|
|
local function test(name, fn)
|
|
local ok, err = pcall(fn)
|
|
assert(ok, name .. ": " .. tostring(err))
|
|
passed = passed + 1
|
|
print("ok " .. passed .. " - " .. name)
|
|
end
|
|
|
|
test("owner retains full authority and outside land remains usable", function()
|
|
assert(policy.owner_at(p) == "owner" and policy.role_at(p, "owner") == "owner")
|
|
for _, action in ipairs({"build", "dig", "use", "storage", "arrival", "combat"}) do
|
|
assert(policy.allowed(p, "owner", action))
|
|
assert(policy.allowed({x = 20, y = 0, z = 0}, "outsider", action))
|
|
end
|
|
end)
|
|
test("resident can build and use but cannot attack or arrive in another home", function()
|
|
assert(policy.allowed(p, "resident", "build"))
|
|
assert(policy.allowed(p, "resident", "dig"))
|
|
assert(policy.allowed(p, "resident", "use"))
|
|
assert(policy.allowed(p, "resident", "storage"))
|
|
assert(not policy.allowed(p, "resident", "arrival"))
|
|
assert(not policy.allowed(p, "resident", "combat"))
|
|
end)
|
|
test("storekeeper may use only protected storage", function()
|
|
assert(policy.allowed(p, "keeper", "storage"))
|
|
for _, action in ipairs({"build", "dig", "use", "arrival", "combat"}) do
|
|
assert(not policy.allowed(p, "keeper", action), action)
|
|
end
|
|
end)
|
|
test("unknown roles, invalid actions, and ambiguous overlaps fail closed", function()
|
|
for _, action in ipairs({"build", "dig", "use", "storage", "arrival", "combat"}) do
|
|
assert(not policy.allowed(p, "stale", action))
|
|
end
|
|
assert(not policy.allowed(p, "resident", "manage"))
|
|
claims.overlap = {x = 10, y = 0, z = 0}
|
|
assert(policy.owner_at(p) == nil and not policy.allowed(p, "owner", "build"))
|
|
assert(not policy.allowed({}, "owner", "build"))
|
|
claims.overlap = nil
|
|
end)
|
|
test("claim release and reassignment do not transfer the former owner's membership", function()
|
|
claims.owner = nil
|
|
assert(policy.allowed(p, "resident", "build"), "released land is no longer reserved by stale membership")
|
|
assert(policy.allowed(p, "outsider", "build"))
|
|
memberships.owner = nil
|
|
claims.owner = {x = -30, y = 0, z = 0}
|
|
local reassigned = {x = -30, y = 0, z = 0}
|
|
assert(policy.owner_at(reassigned) == "owner" and not policy.allowed(reassigned, "resident", "build"))
|
|
end)
|
|
print("PASS " .. passed .. " claim-role authorization tests")
|