liveBook · Manning

Request-driven test

As explained in Authorization in Action

A request-driven test evaluates authorization behavior by submitting constructed authorization requests and checking the resulting decisions.

A request-driven test evaluates an authorization policy by submitting a constructed request and checking whether the decision matches the expected result. It turns real access scenarios into repeatable checks for runtime behavior. section 10.3

Project document access

A test allows Alice to view a document in her project, then denies Fay because she is not a member, despite being an employee.

How Authorization in Action covers it

How deep it goes
Defines constructed requests and expected outcomes, while deferring structural checks to complementary static analysis.
Examples
Uses Cedar-style project-document tests contrasting a project member who is allowed with a nonmember who is denied.
What it assumes
Assumes recognizable principals, actions, resources, entity relationships, and expected authorization decisions.
What you can do after
Diagnose unintended runtime authorization behavior by asserting decisions for realistic identity, action, resource, and relationship combinations.
How it connects
Connects authorization policies with static analysis, schemas, entity relationships, and CI pipelines.
Cover of Authorization in Action
liveBookmanning.com
Read Authorization in Action on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Authorization in Action. The section links point to the parts of the book it draws on.