|
| 1 | +/* |
| 2 | + * runtime-e2e/decide_fulfill_obligation/DecideFulfillObligationTest.java |
| 3 | + * |
| 4 | + * Real-wire test of the Decision Mode PEP surface (ADR-056, epic #2563, |
| 5 | + * tracking #2571) against a running AxonFlow enterprise agent. |
| 6 | + * |
| 7 | + * Proves, with NO mocks, that the SDK can run the decide -> fulfill -> forward |
| 8 | + * path end-to-end: |
| 9 | + * |
| 10 | + * 1. decide() on a PII-bearing query returns an allow verdict carrying a |
| 11 | + * request-phase redact_pii obligation whose fulfillment names the |
| 12 | + * request-redaction engine endpoint. |
| 13 | + * 2. fulfillRequest() discharges that obligation through the engine and |
| 14 | + * returns engine-masked content in which neither the email |
| 15 | + * (john.doe@example.com) nor the card (4111111111111111) survives, and |
| 16 | + * the content differs from the original. (No local redaction exists in |
| 17 | + * the SDK — only the engine can produce this.) |
| 18 | + * 3. decideAndFulfill() yields the same masked content in one call. |
| 19 | + * 4. Demo credentials (demo-org / demo-license-not-real) are refused with an |
| 20 | + * AuthenticationException (HTTP 401). |
| 21 | + * |
| 22 | + * Run: |
| 23 | + * source /tmp/axonflow-e2e-env.sh |
| 24 | + * mvn -q -DskipTests package |
| 25 | + * mvn -q -DskipTests dependency:build-classpath -Dmdep.outputFile=/tmp/cp.txt |
| 26 | + * SDK_JAR=$(ls target/axonflow-sdk-*.jar | grep -v sources | grep -v javadoc | head -1) |
| 27 | + * java -cp "$SDK_JAR:$(cat /tmp/cp.txt)" \ |
| 28 | + * runtime-e2e/decide_fulfill_obligation/DecideFulfillObligationTest.java |
| 29 | + */ |
| 30 | +import com.getaxonflow.sdk.AxonFlow; |
| 31 | +import com.getaxonflow.sdk.AxonFlowConfig; |
| 32 | +import com.getaxonflow.sdk.Pep; |
| 33 | +import com.getaxonflow.sdk.exceptions.AuthenticationException; |
| 34 | +import com.getaxonflow.sdk.types.DecideRequest; |
| 35 | +import com.getaxonflow.sdk.types.DecideResponse; |
| 36 | +import com.getaxonflow.sdk.types.DecisionTarget; |
| 37 | + |
| 38 | +public class DecideFulfillObligationTest { |
| 39 | + |
| 40 | + static final String EMAIL = "john.doe@example.com"; |
| 41 | + static final String CARD = "4111111111111111"; |
| 42 | + static final String QUERY = "Send the receipt to " + EMAIL + " and charge card " + CARD; |
| 43 | + |
| 44 | + static void fail(String msg) { |
| 45 | + System.err.println("FAIL: " + msg); |
| 46 | + System.exit(1); |
| 47 | + } |
| 48 | + |
| 49 | + static void check(boolean cond, String msg) { |
| 50 | + if (!cond) { |
| 51 | + fail(msg); |
| 52 | + } |
| 53 | + } |
| 54 | + |
| 55 | + public static void main(String[] args) { |
| 56 | + String endpoint = System.getenv().getOrDefault("AXONFLOW_ENDPOINT", "http://localhost:8080"); |
| 57 | + String clientId = System.getenv("AXONFLOW_CLIENT_ID"); |
| 58 | + String clientSecret = System.getenv("AXONFLOW_CLIENT_SECRET"); |
| 59 | + String tenantId = System.getenv("AXONFLOW_TENANT_ID"); |
| 60 | + String userToken = System.getenv("AXONFLOW_USER_TOKEN"); |
| 61 | + if (clientId == null || clientSecret == null) { |
| 62 | + fail("AXONFLOW_CLIENT_ID / AXONFLOW_CLIENT_SECRET unset — source /tmp/axonflow-e2e-env.sh"); |
| 63 | + } |
| 64 | + |
| 65 | + AxonFlow client = |
| 66 | + AxonFlow.create( |
| 67 | + AxonFlowConfig.builder() |
| 68 | + .endpoint(endpoint) |
| 69 | + .clientId(clientId) |
| 70 | + .clientSecret(clientSecret) |
| 71 | + .build()); |
| 72 | + |
| 73 | + DecideRequest req = |
| 74 | + DecideRequest.builder("tool", QUERY) |
| 75 | + .target(new DecisionTarget("tool", null, null, "send_receipt")) |
| 76 | + .userToken(userToken) |
| 77 | + .build(); |
| 78 | + |
| 79 | + // 1. decide -> allow + request-phase redact_pii obligation. |
| 80 | + DecideResponse decision = client.decide(req); |
| 81 | + System.out.println( |
| 82 | + "decide -> verdict=" |
| 83 | + + decision.getVerdict() |
| 84 | + + " decision_id=" |
| 85 | + + decision.getDecisionId() |
| 86 | + + " obligations=" |
| 87 | + + decision.getObligations().size() |
| 88 | + + " evaluated_policies=" |
| 89 | + + decision.getEvaluatedPolicies()); |
| 90 | + check(Pep.VERDICT_ALLOW.equals(decision.getVerdict()), "expected allow, got " + decision.getVerdict()); |
| 91 | + check( |
| 92 | + Pep.hasRequestRedaction(decision.getObligations()), |
| 93 | + "expected a request-phase redact_pii obligation, got " + decision.getObligations()); |
| 94 | + System.out.println("PASS step 1: decide returned allow + redact_pii request-phase obligation"); |
| 95 | + |
| 96 | + // 2. fulfillRequest -> engine-masked content; PII must NOT survive. |
| 97 | + AxonFlow.FulfillResult fr = client.fulfillRequest(decision, QUERY); |
| 98 | + System.out.println("fulfillRequest -> didRedact=" + fr.didRedact() + " content=" + fr.getContent()); |
| 99 | + assertMasked(fr.getContent()); |
| 100 | + check(fr.didRedact(), "expected the engine to have changed the content (didRedact=true)"); |
| 101 | + System.out.println("PASS step 2: fulfillRequest masked email + card via the engine (no local redaction)"); |
| 102 | + |
| 103 | + // 3. decideAndFulfill -> same masked content in one call. |
| 104 | + AxonFlow.DecideAndFulfillResult daf = client.decideAndFulfill(req); |
| 105 | + System.out.println( |
| 106 | + "decideAndFulfill -> verdict=" + daf.getVerdict() + " content=" + daf.getContent()); |
| 107 | + check(Pep.VERDICT_ALLOW.equals(daf.getVerdict()), "decideAndFulfill verdict=" + daf.getVerdict()); |
| 108 | + assertMasked(daf.getContent()); |
| 109 | + System.out.println("PASS step 3: decideAndFulfill returned engine-masked content in one call"); |
| 110 | + |
| 111 | + // 4. Demo credentials are refused with 401. |
| 112 | + AxonFlow demo = |
| 113 | + AxonFlow.create( |
| 114 | + AxonFlowConfig.builder() |
| 115 | + .endpoint(endpoint) |
| 116 | + .clientId("demo-org") |
| 117 | + .clientSecret("demo-license-not-real") |
| 118 | + .build()); |
| 119 | + try { |
| 120 | + demo.decide(DecideRequest.builder("tool", "ping").build()); |
| 121 | + fail("expected demo credentials to be refused with AuthenticationException"); |
| 122 | + } catch (AuthenticationException e) { |
| 123 | + System.out.println("PASS step 4: demo credentials refused -> AuthenticationException: " + e.getMessage()); |
| 124 | + } |
| 125 | + |
| 126 | + System.out.println("ALL PASS: decide -> fulfill -> forward verified through the SDK against the live agent"); |
| 127 | + } |
| 128 | + |
| 129 | + static void assertMasked(String content) { |
| 130 | + check(content != null, "content is null"); |
| 131 | + check(!content.contains(EMAIL), "email '" + EMAIL + "' survived in: " + content); |
| 132 | + check(!content.contains(CARD), "card '" + CARD + "' survived in: " + content); |
| 133 | + check(!content.equals(QUERY), "content equals the original (no redaction happened): " + content); |
| 134 | + } |
| 135 | +} |
0 commit comments