Relocate condition tests onto the conditions

Move each condition's evaluation branches out of AccessRuleEngineTests into
IpAllowlistConditionTests and TimeOfDayConditionTests, and test the combination
semantics directly on AccessEvaluation.Combine. AccessRuleEngineTests keeps only
the engine's orchestration (delegation, folding, signal forwarding, empty list,
null-entry fail-closed), exercised with a stub condition.

Also add direct TimeWindow.Contains coverage for the inclusive boundaries
(time == from/to) and unparseable bounds, which the engine tests never hit.

Author: Hinton

bitwarden_license/test/Services/Pam.Test/Engine/AccessEvaluationTests.cs

@@ -0,0 +1,72 @@
+using Bit.Services.Pam.Engine;
+using Xunit;
+
+namespace Bit.Services.Pam.Test.Engine;
+
+public class AccessEvaluationTests
+{
+    [Fact]
+    public void Combine_Empty_Allows()
+    {
+        // An empty rule is vacuously satisfied.
+        Assert.Equal(AccessEvaluationOutcome.Allow, AccessEvaluation.Combine([]).Outcome);
+    }
+
+    [Fact]
+    public void Combine_AllAllow_Allows()
+    {
+        var result = AccessEvaluation.Combine([AccessEvaluation.Allow, AccessEvaluation.Allow]);
+
+        Assert.Equal(AccessEvaluationOutcome.Allow, result.Outcome);
+    }
+
+    [Fact]
+    public void Combine_ApprovalOverAllow_RequiresApproval()
+    {
+        var result = AccessEvaluation.Combine([AccessEvaluation.Allow, AccessEvaluation.RequiresApproval]);
+
+        Assert.Equal(AccessEvaluationOutcome.RequiresApproval, result.Outcome);
+    }
+
+    [Fact]
+    public void Combine_DenyOutranksAllow_Denies()
+    {
+        var result = AccessEvaluation.Combine([AccessEvaluation.Allow, AccessEvaluation.Deny(DenyReason.NotWithinIpRange)]);
+
+        Assert.Equal(AccessEvaluationOutcome.Deny, result.Outcome);
+        Assert.Equal(DenyReason.NotWithinIpRange, result.Reason);
+    }
+
+    [Fact]
+    public void Combine_DenyOutranksApproval_Denies()
+    {
+        // Deny beats a pending approval regardless of order: there is nothing to approve if access is barred.
+        var result = AccessEvaluation.Combine([AccessEvaluation.RequiresApproval, AccessEvaluation.Deny(DenyReason.NotWithinTimeWindow)]);
+
+        Assert.Equal(AccessEvaluationOutcome.Deny, result.Outcome);
+        Assert.Equal(DenyReason.NotWithinTimeWindow, result.Reason);
+    }
+
+    [Fact]
+    public void Combine_ApprovalAfterDeny_StillDenies()
+    {
+        var result = AccessEvaluation.Combine([AccessEvaluation.Deny(DenyReason.NotWithinIpRange), AccessEvaluation.RequiresApproval]);
+
+        Assert.Equal(AccessEvaluationOutcome.Deny, result.Outcome);
+        Assert.Equal(DenyReason.NotWithinIpRange, result.Reason);
+    }
+
+    [Fact]
+    public void Combine_FirstDenyWins_PreservesItsReason()
+    {
+        // Combine short-circuits on the first deny, so its reason is the one reported.
+        var result = AccessEvaluation.Combine(
+        [
+            AccessEvaluation.Deny(DenyReason.NotWithinTimeWindow),
+            AccessEvaluation.Deny(DenyReason.NotWithinIpRange),
+        ]);
+
+        Assert.Equal(AccessEvaluationOutcome.Deny, result.Outcome);
+        Assert.Equal(DenyReason.NotWithinTimeWindow, result.Reason);
+    }
+}

bitwarden_license/test/Services/Pam.Test/Engine/AccessRuleEngineTests.cs

@@ -1,276 +1,86 @@
 using System.Net;
 using Bit.Services.Pam.Engine;
-using Bit.Services.Pam.Enums;
 using Bit.Services.Pam.Models.Conditions;
 using Xunit;
 
 namespace Bit.Services.Pam.Test.Engine;
 
 public class AccessRuleEngineTests
 {
-    // 2026-06-04T12:00:00Z is a Thursday, so "thu" windows match in UTC.
-    private static readonly DateTimeOffset _now = new(2026, 6, 4, 12, 0, 0, TimeSpan.Zero);
-
     private readonly AccessRuleEngine _sut = new();
 
-    private static AccessSignals Signals(IPAddress? ip = null, DateTimeOffset? at = null) => new()
+    private static AccessSignals Signals() => new()
     {
-        IpAddress = ip,
-        Timestamp = at ?? _now,
+        IpAddress = IPAddress.Parse("10.1.2.3"),
+        Timestamp = new DateTimeOffset(2026, 6, 4, 12, 0, 0, TimeSpan.Zero),
     };
 
-    private static AccessCondition[] Set(params AccessCondition[] conditions) => conditions;
-
-    [Fact]
-    public void Evaluate_HumanApproval_RequiresApproval()
-    {
-        var evaluation = _sut.Evaluate(Set(new HumanApprovalCondition()), Signals());
-
-        Assert.Equal(AccessEvaluationOutcome.RequiresApproval, evaluation.Outcome);
-    }
-
-    [Fact]
-    public void Evaluate_IpAllowlist_IpInRange_Allows()
-    {
-        var conditions = Set(new IpAllowlistCondition { Cidrs = ["10.0.0.0/8"] });
-
-        var evaluation = _sut.Evaluate(conditions, Signals(IPAddress.Parse("10.1.2.3")));
-
-        Assert.Equal(AccessEvaluationOutcome.Allow, evaluation.Outcome);
-    }
-
-    [Fact]
-    public void Evaluate_IpAllowlist_IpOutOfRange_Denies()
-    {
-        var conditions = Set(new IpAllowlistCondition { Cidrs = ["10.0.0.0/8"] });
-
-        var evaluation = _sut.Evaluate(conditions, Signals(IPAddress.Parse("192.168.1.1")));
-
-        Assert.Equal(AccessEvaluationOutcome.Deny, evaluation.Outcome);
-        Assert.Equal(DenyReason.NotWithinIpRange, evaluation.Reason);
-    }
-
-    [Fact]
-    public void Evaluate_IpAllowlist_UnknownIp_DeniesClosed()
-    {
-        var conditions = Set(new IpAllowlistCondition { Cidrs = ["10.0.0.0/8"] });
-
-        var evaluation = _sut.Evaluate(conditions, Signals(ip: null));
-
-        Assert.Equal(AccessEvaluationOutcome.Deny, evaluation.Outcome);
-        Assert.Equal(DenyReason.NotWithinIpRange, evaluation.Reason);
-    }
-
-    [Fact]
-    public void Evaluate_IpAllowlist_NoEntries_DeniesClosed()
-    {
-        var evaluation = _sut.Evaluate(Set(new IpAllowlistCondition()), Signals(IPAddress.Parse("10.1.2.3")));
-
-        Assert.Equal(AccessEvaluationOutcome.Deny, evaluation.Outcome);
-        Assert.Equal(DenyReason.NotWithinIpRange, evaluation.Reason);
-    }
-
-    [Fact]
-    public void Evaluate_TimeOfDay_WithinWindow_Allows()
-    {
-        var conditions = Set(new TimeOfDayCondition
-        {
-            Tz = "UTC",
-            Windows = [new TimeWindow { Days = [AccessWeekday.Thu], From = "09:00", To = "17:00" }],
-        });
-
-        var evaluation = _sut.Evaluate(conditions, Signals());
-
-        Assert.Equal(AccessEvaluationOutcome.Allow, evaluation.Outcome);
-    }
-
-    [Fact]
-    public void Evaluate_TimeOfDay_OutsideTimeWindow_Denies()
-    {
-        var conditions = Set(new TimeOfDayCondition
-        {
-            Tz = "UTC",
-            Windows = [new TimeWindow { Days = [AccessWeekday.Thu], From = "00:00", To = "06:00" }],
-        });
-
-        var evaluation = _sut.Evaluate(conditions, Signals());
-
-        Assert.Equal(AccessEvaluationOutcome.Deny, evaluation.Outcome);
-        Assert.Equal(DenyReason.NotWithinTimeWindow, evaluation.Reason);
-    }
-
     [Fact]
-    public void Evaluate_TimeOfDay_DayNotListed_Denies()
+    public void Evaluate_NoConditions_Allows()
     {
-        var conditions = Set(new TimeOfDayCondition
-        {
-            Tz = "UTC",
-            Windows = [new TimeWindow { Days = [AccessWeekday.Fri], From = "00:00", To = "23:59" }],
-        });
-
-        var evaluation = _sut.Evaluate(conditions, Signals());
-
-        Assert.Equal(AccessEvaluationOutcome.Deny, evaluation.Outcome);
-        Assert.Equal(DenyReason.NotWithinTimeWindow, evaluation.Reason);
+        // A rule with no conditions is vacuously satisfied: access is auto-granted while still flowing through
+        // PAM for audit logging.
+        Assert.Equal(AccessEvaluationOutcome.Allow, _sut.Evaluate([], Signals()).Outcome);
     }
 
     [Fact]
-    public void Evaluate_TimeOfDay_EvaluatesInConfiguredTimezone()
+    public void Evaluate_DefersToEachConditionsOwnResult()
     {
-        // 23:00 UTC is 19:00 (Thursday) in America/New_York during June DST, inside the window.
-        var conditions = Set(new TimeOfDayCondition
-        {
-            Tz = "America/New_York",
-            Windows = [new TimeWindow { Days = [AccessWeekday.Thu], From = "18:00", To = "20:00" }],
-        });
-
-        var evaluation = _sut.Evaluate(conditions, Signals(at: new DateTimeOffset(2026, 6, 4, 23, 0, 0, TimeSpan.Zero)));
-
-        Assert.Equal(AccessEvaluationOutcome.Allow, evaluation.Outcome);
+        // The engine does not decide anything itself; it returns what the condition's Evaluate reports.
+        Assert.Equal(AccessEvaluationOutcome.RequiresApproval,
+            _sut.Evaluate([new StubCondition(AccessEvaluation.RequiresApproval)], Signals()).Outcome);
     }
 
     [Fact]
-    public void Evaluate_TimeOfDay_UnknownTimezone_DeniesClosed()
+    public void Evaluate_CombinesConditionResults_DenyWins()
     {
-        var conditions = Set(new TimeOfDayCondition
+        // Folding is delegated to AccessEvaluation.Combine (deny > approval > allow); a single denying condition
+        // drives the whole rule to deny. The full precedence matrix is covered in AccessEvaluationTests.
+        var conditions = new AccessCondition[]
         {
-            Tz = "Not/AZone",
-            Windows = [new TimeWindow { Days = [AccessWeekday.Thu], From = "00:00", To = "23:59" }],
-        });
+            new StubCondition(AccessEvaluation.Allow),
+            new StubCondition(AccessEvaluation.Deny(DenyReason.NotWithinIpRange)),
+        };
 
         var evaluation = _sut.Evaluate(conditions, Signals());
 
-        Assert.Equal(AccessEvaluationOutcome.Deny, evaluation.Outcome);
-        Assert.Equal(DenyReason.NotWithinTimeWindow, evaluation.Reason);
-    }
-
-    [Fact]
-    public void Evaluate_AllConditionsAllow_Allows()
-    {
-        var conditions = Set(
-            new IpAllowlistCondition { Cidrs = ["10.0.0.0/8"] },
-            new TimeOfDayCondition { Tz = "UTC", Windows = [new TimeWindow { Days = [AccessWeekday.Thu], From = "09:00", To = "17:00" }] });
-
-        var evaluation = _sut.Evaluate(conditions, Signals(IPAddress.Parse("10.1.2.3")));
-
-        Assert.Equal(AccessEvaluationOutcome.Allow, evaluation.Outcome);
-    }
-
-    [Fact]
-    public void Evaluate_OneConditionDenies_DeniesWithThatReason()
-    {
-        var conditions = Set(
-            new IpAllowlistCondition { Cidrs = ["10.0.0.0/8"] },
-            new TimeOfDayCondition { Tz = "UTC", Windows = [new TimeWindow { Days = [AccessWeekday.Thu], From = "00:00", To = "06:00" }] });
-
-        var evaluation = _sut.Evaluate(conditions, Signals(IPAddress.Parse("10.1.2.3")));
-
-        Assert.Equal(AccessEvaluationOutcome.Deny, evaluation.Outcome);
-        Assert.Equal(DenyReason.NotWithinTimeWindow, evaluation.Reason);
-    }
-
-    [Fact]
-    public void Evaluate_AllowPlusHumanApproval_RequiresApproval()
-    {
-        var conditions = Set(
-            new IpAllowlistCondition { Cidrs = ["10.0.0.0/8"] },
-            new HumanApprovalCondition());
-
-        var evaluation = _sut.Evaluate(conditions, Signals(IPAddress.Parse("10.1.2.3")));
-
-        Assert.Equal(AccessEvaluationOutcome.RequiresApproval, evaluation.Outcome);
-    }
-
-    [Fact]
-    public void Evaluate_DenyOutranksApproval()
-    {
-        // A denying condition beats a pending approval: there is nothing to approve if access is barred outright.
-        var conditions = Set(
-            new HumanApprovalCondition(),
-            new IpAllowlistCondition { Cidrs = ["10.0.0.0/8"] });
-
-        var evaluation = _sut.Evaluate(conditions, Signals(IPAddress.Parse("192.168.1.1")));
-
         Assert.Equal(AccessEvaluationOutcome.Deny, evaluation.Outcome);
         Assert.Equal(DenyReason.NotWithinIpRange, evaluation.Reason);
     }
 
     [Fact]
-    public void Evaluate_NoConditions_Allows()
+    public void Evaluate_ForwardsSignalsToConditions()
     {
-        // A rule with no conditions is vacuously satisfied: access is auto-granted while still flowing through
-        // PAM for audit logging.
-        var evaluation = _sut.Evaluate(Set(), Signals());
+        var signals = Signals();
+        var condition = new StubCondition(AccessEvaluation.Allow);
+
+        _sut.Evaluate([condition], signals);
 
-        Assert.Equal(AccessEvaluationOutcome.Allow, evaluation.Outcome);
+        Assert.Same(signals, condition.ReceivedSignals);
     }
 
     [Fact]
     public void Evaluate_NullConditionEntry_DeniesClosed()
     {
         // A null entry (only reachable from a malformed stored document) cannot be evaluated, so it fails closed.
-        // An unknown condition kind can no longer reach the engine: visitor dispatch is exhaustive at compile time.
+        // An unknown condition kind can no longer reach the engine: it is rejected at JSON deserialization.
         var evaluation = _sut.Evaluate([null!], Signals());
 
         Assert.Equal(AccessEvaluationOutcome.Deny, evaluation.Outcome);
         Assert.Equal(DenyReason.UnsupportedCondition, evaluation.Reason);
     }
 
-    [Fact]
-    public void Evaluate_IpAllowlist_MalformedCidr_DeniesClosed()
+    /// <summary>A condition with a fixed result, isolating the engine's folding from any real condition logic.</summary>
+    private sealed class StubCondition(AccessEvaluation result) : AccessCondition
     {
-        // A present-but-unparseable CIDR matches no address, so a caller with a known IP still fails closed.
-        var conditions = Set(new IpAllowlistCondition { Cidrs = ["not-a-cidr"] });
-
-        var evaluation = _sut.Evaluate(conditions, Signals(IPAddress.Parse("10.1.2.3")));
+        public AccessSignals? ReceivedSignals { get; private set; }
 
-        Assert.Equal(AccessEvaluationOutcome.Deny, evaluation.Outcome);
-        Assert.Equal(DenyReason.NotWithinIpRange, evaluation.Reason);
-    }
-
-    [Fact]
-    public void Evaluate_IpAllowlist_LaterCidrMatches_Allows()
-    {
-        // The caller matches the second entry, so evaluation must not stop at the first non-matching CIDR.
-        var conditions = Set(new IpAllowlistCondition { Cidrs = ["192.168.0.0/16", "10.0.0.0/8"] });
-
-        var evaluation = _sut.Evaluate(conditions, Signals(IPAddress.Parse("10.1.2.3")));
-
-        Assert.Equal(AccessEvaluationOutcome.Allow, evaluation.Outcome);
-    }
-
-    [Fact]
-    public void Evaluate_TimeOfDay_MalformedWindowTime_DeniesClosed()
-    {
-        // The day matches but the window's bounds are unparseable, so the window cannot admit the caller.
-        var conditions = Set(new TimeOfDayCondition
-        {
-            Tz = "UTC",
-            Windows = [new TimeWindow { Days = [AccessWeekday.Thu], From = "25:99", To = "30:00" }],
-        });
-
-        var evaluation = _sut.Evaluate(conditions, Signals());
-
-        Assert.Equal(AccessEvaluationOutcome.Deny, evaluation.Outcome);
-        Assert.Equal(DenyReason.NotWithinTimeWindow, evaluation.Reason);
-    }
-
-    [Fact]
-    public void Evaluate_TimeOfDay_LaterWindowMatches_Allows()
-    {
-        // The first window is the wrong day; the second admits the caller, so windows past the first must be checked.
-        var conditions = Set(new TimeOfDayCondition
+        public override AccessEvaluation Evaluate(AccessSignals signals)
         {
-            Tz = "UTC",
-            Windows =
-            [
-                new TimeWindow { Days = [AccessWeekday.Fri], From = "09:00", To = "17:00" },
-                new TimeWindow { Days = [AccessWeekday.Thu], From = "09:00", To = "17:00" },
-            ],
-        });
-
-        var evaluation = _sut.Evaluate(conditions, Signals());
+            ReceivedSignals = signals;
+            return result;
+        }
 
-        Assert.Equal(AccessEvaluationOutcome.Allow, evaluation.Outcome);
+        public override T Accept<T>(IAccessConditionVisitor<T> visitor) => throw new NotSupportedException();
     }
 }