feat: add xfail markers for known issues, add deny-with-CEL-body and top-level-fail validation tests

Signed-off-by: Silvia Tarabova <starabov@redhat.com>

Author: silvi-t

testsuite/tests/singlecluster/extensions/pipeline_policy/interactions/test_pipeline_policy_auth.py

@@ -36,6 +36,8 @@ def test_auth_and_pipeline_unauthorized(client):
     assert response.headers.get("x-pipeline-policy") is None
 
 
+@pytest.mark.issue("https://github.com/Kuadrant/wasm-shim/issues/371")
+@pytest.mark.xfail(reason="https://github.com/Kuadrant/wasm-shim/issues/371")
 def test_auth_and_pipeline_blocked_path(client, auth):
     """Authenticated request to blocked path is denied by PipelinePolicy deny action."""
     response = client.get("/blocked", auth=auth)

testsuite/tests/singlecluster/extensions/pipeline_policy/test_pipeline_policy_composition.py

@@ -49,6 +49,87 @@ def test_fail_before_deny(request, cluster, blame, route, client, threat_assessm
     assert response.status_code == 500
 
 
+@pytest.mark.issue("https://github.com/Kuadrant/wasm-shim/issues/371")
+@pytest.mark.xfail(reason="https://github.com/Kuadrant/wasm-shim/issues/371")
+def test_deny_after_grpc_call(request, cluster, blame, route, client, threat_assessment_service):
+    """Deny action after gRPC call works when the deny predicate matches."""
+    svc_url = (
+        f"grpc://{threat_assessment_service.name()}.{threat_assessment_service.namespace()}.svc.cluster.local:8080"
+    )
+    policy = PipelinePolicy.create_instance(cluster, blame("grpc-deny"), route)
+    policy.add_action_method(
+        name="assess",
+        url=svc_url,
+        service="threat.v1.ThreatAssessmentService",
+        method="AssessRequest",
+        message_template="threat.v1.ThreatRequest{uri: request.path}",
+    )
+    policy.on_http_request.add_grpc_method(method="assess", var="threat")
+    policy.on_http_request.add_deny(predicate='request.url_path == "/blocked"', with_status=403)
+    request.addfinalizer(policy.delete)
+    policy.commit()
+    policy.wait_for_ready()
+
+    response = client.get("/blocked")
+    assert response.status_code == 403
+
+
+def test_deny_based_on_grpc_var(request, cluster, blame, route, client, threat_assessment_service):
+    """Deny action using gRPC response variable denies requests when threat level is high."""
+    svc_url = (
+        f"grpc://{threat_assessment_service.name()}.{threat_assessment_service.namespace()}.svc.cluster.local:8080"
+    )
+    policy = PipelinePolicy.create_instance(cluster, blame("grpc-var-deny"), route)
+    policy.add_action_method(
+        name="assess",
+        url=svc_url,
+        service="threat.v1.ThreatAssessmentService",
+        method="AssessRequest",
+        message_template="threat.v1.ThreatRequest{uri: request.path}",
+    )
+    policy.on_http_request.add_grpc_method(method="assess", var="threat")
+    policy.on_http_request.add_deny(predicate="threat.threat_level >= 4", with_status=403)
+    request.addfinalizer(policy.delete)
+    policy.commit()
+    policy.wait_for_ready()
+
+    response = client.get("/admin")
+    assert response.status_code == 403
+
+    response = client.get("/get")
+    assert response.status_code == 200
+
+
+@pytest.mark.issue("https://github.com/Kuadrant/kuadrant-operator/issues/2018")
+@pytest.mark.xfail(reason="https://github.com/Kuadrant/kuadrant-operator/issues/2018")
+def test_deny_with_dynamic_body(request, cluster, blame, route, client, threat_assessment_service):
+    """Deny action with CEL expression in withBody interpolates gRPC response variable."""
+    svc_url = (
+        f"grpc://{threat_assessment_service.name()}.{threat_assessment_service.namespace()}.svc.cluster.local:8080"
+    )
+    policy = PipelinePolicy.create_instance(cluster, blame("dyn-body"), route)
+    policy.add_action_method(
+        name="assess",
+        url=svc_url,
+        service="threat.v1.ThreatAssessmentService",
+        method="AssessRequest",
+        message_template="threat.v1.ThreatRequest{uri: request.path}",
+    )
+    policy.on_http_request.add_grpc_method(method="assess", var="threat")
+    policy.on_http_request.add_deny(
+        predicate="threat.threat_level >= 4",
+        with_status=403,
+        with_body="'blocked: threat level ' + string(threat.threat_level)",
+    )
+    request.addfinalizer(policy.delete)
+    policy.commit()
+    policy.wait_for_ready()
+
+    response = client.get("/admin")
+    assert response.status_code == 403
+    assert "blocked: threat level" in response.text
+
+
 def test_response_action_ordering(request, cluster, blame, route, client):
     """Response actions execute in spec order; both headers from separate actions are present."""
     policy = PipelinePolicy.create_instance(cluster, blame("respord"), route)

testsuite/tests/singlecluster/extensions/pipeline_policy/test_pipeline_policy_deny.py

@@ -20,30 +20,30 @@ def pipeline_policy(pipeline_policy):
         with_status=403,
         with_headers='[["x-deny-reason", "blocked"]]',
     )
-    # Custom body
+    # Custom body (CEL expression)
     pipeline_policy.on_http_request.add_deny(
         predicate='request.url_path == "/custom-body"',
         with_status=403,
-        with_body="Access denied",
+        with_body="'Access denied'",
     )
-    # All response fields
+    # All response fields (CEL expression in body)
     pipeline_policy.on_http_request.add_deny(
         predicate='request.url_path == "/custom-all"',
         with_status=451,
         with_headers='[["x-deny-reason", "full-custom"]]',
-        with_body="Fully customized denial",
+        with_body="'Fully customized denial'",
     )
     # Response phase deny — status override
     pipeline_policy.on_http_response.add_deny(
         predicate='"x-override-code" in request.headers',
         with_status=503,
     )
-    # Response phase deny — all fields
+    # Response phase deny — all fields (CEL expression in body)
     pipeline_policy.on_http_response.add_deny(
         predicate='"x-resp-deny" in request.headers',
         with_status=418,
         with_headers='[["x-deny-phase", "response"]]',
-        with_body="Teapot response",
+        with_body="'Teapot response'",
     )
     return pipeline_policy
 
@@ -92,15 +92,19 @@ def test_deny_custom_headers(client):
     assert response.headers.get("x-deny-reason") == "blocked"
 
 
+@pytest.mark.issue("https://github.com/Kuadrant/kuadrant-operator/issues/2018")
+@pytest.mark.xfail(reason="https://github.com/Kuadrant/kuadrant-operator/issues/2018")
 def test_deny_custom_body(client):
-    """Deny with withBody returns custom body text."""
+    """Deny with withBody as CEL expression returns custom body text."""
     response = client.get("/custom-body")
     assert response.status_code == 403
     assert response.text == "Access denied"
 
 
+@pytest.mark.issue("https://github.com/Kuadrant/kuadrant-operator/issues/2018")
+@pytest.mark.xfail(reason="https://github.com/Kuadrant/kuadrant-operator/issues/2018")
 def test_deny_all_response_fields(client):
-    """Deny with withStatus, withHeaders, and withBody all set returns all fields."""
+    """Deny with withStatus, withHeaders, and withBody as CEL expression returns all fields."""
     response = client.get("/custom-all")
     assert response.status_code == 451
     assert response.headers.get("x-deny-reason") == "full-custom"
@@ -119,8 +123,10 @@ def test_response_deny_no_override(client):
     assert response.status_code == 200
 
 
+@pytest.mark.issue("https://github.com/Kuadrant/kuadrant-operator/issues/2018")
+@pytest.mark.xfail(reason="https://github.com/Kuadrant/kuadrant-operator/issues/2018")
 def test_response_deny_with_headers_and_body(client):
-    """Response deny with all fields replaces the backend response."""
+    """Response deny with all fields as CEL expressions replaces the backend response."""
     response = client.get("/get", headers={"x-resp-deny": "true"})
     assert response.status_code == 418
     assert response.headers.get("x-deny-phase") == "response"

testsuite/tests/singlecluster/extensions/pipeline_policy/test_pipeline_policy_isolation.py

@@ -87,6 +87,8 @@ def test_policy_affects_targeted_route(client):
     assert response.headers.get("x-pipeline-policy") == "active"
 
 
+@pytest.mark.issue("https://github.com/Kuadrant/kuadrant-operator/issues/2023")
+@pytest.mark.xfail(reason="https://github.com/Kuadrant/kuadrant-operator/issues/2023")
 def test_policy_does_not_affect_other_route(client2):
     """Route without PipelinePolicy on the same gateway does not get the response header."""
     time.sleep(EXTENSION_POLICY_PROPAGATION_WAIT)
@@ -95,6 +97,8 @@ def test_policy_does_not_affect_other_route(client2):
     assert response.headers.get("x-pipeline-policy") is None
 
 
+@pytest.mark.issue("https://github.com/Kuadrant/kuadrant-operator/issues/2023")
+@pytest.mark.xfail(reason="https://github.com/Kuadrant/kuadrant-operator/issues/2023")
 def test_policy_does_not_affect_other_gateway(client3):
     """Route on a different gateway does not get the response header."""
     time.sleep(EXTENSION_POLICY_PROPAGATION_WAIT)

testsuite/tests/singlecluster/extensions/pipeline_policy/test_pipeline_policy_lifecycle.py

@@ -35,6 +35,8 @@ def test_update_policy(request, cluster, blame, route, client):
     assert response.headers.get("x-update-new") == "true"
 
 
+@pytest.mark.issue("https://github.com/Kuadrant/kuadrant-operator/issues/2009")
+@pytest.mark.xfail(reason="https://github.com/Kuadrant/kuadrant-operator/issues/2009")
 @pytest.mark.flaky(reruns=0)
 def test_delete_policy(request, cluster, blame, route, client):
     """After deleting the PipelinePolicy, the CR is removed and the actions stop being enforced."""

testsuite/tests/singlecluster/extensions/pipeline_policy/test_pipeline_policy_validation.py

@@ -14,6 +14,8 @@ def commit():
     """No module-level policy; each test creates its own with bad configuration."""
 
 
+@pytest.mark.issue("https://github.com/Kuadrant/kuadrant-operator/issues/2022")
+@pytest.mark.xfail(reason="https://github.com/Kuadrant/kuadrant-operator/issues/2022")
 def test_invalid_target_ref(request, cluster, blame):
     """PipelinePolicy targeting a non-existent HTTPRoute does not reach Enforced state."""
     target = CustomReference(
@@ -33,6 +35,8 @@ def test_invalid_target_ref(request, cluster, blame):
     ), f"Policy did not report TargetNotFound, status: {policy.refresh().model.status.conditions}"
 
 
+@pytest.mark.issue("https://github.com/Kuadrant/kuadrant-operator/issues/2022")
+@pytest.mark.xfail(reason="https://github.com/Kuadrant/kuadrant-operator/issues/2022")
 def test_invalid_gateway_target_ref(request, cluster, blame):
     """PipelinePolicy targeting a non-existent Gateway does not reach Enforced state."""
     target = CustomReference(
@@ -52,6 +56,23 @@ def test_invalid_gateway_target_ref(request, cluster, blame):
     ), f"Policy did not report TargetNotFound, status: {policy.refresh().model.status.conditions}"
 
 
+@pytest.mark.issue("https://github.com/Kuadrant/kuadrant-operator/issues/2015")
+@pytest.mark.xfail(reason="https://github.com/Kuadrant/kuadrant-operator/issues/2015")
+def test_top_level_fail_action(request, cluster, blame, route):
+    """PipelinePolicy with a top-level fail action (not inside gRPC onReply) should not be accepted."""
+    policy = PipelinePolicy.create_instance(cluster, blame("top-fail"), route)
+    policy.on_http_request.add_fail("top-level fail", predicate='request.url_path == "/fail"')
+
+    request.addfinalizer(policy.delete)
+    policy.commit()
+
+    # TODO: add expected message assertion once the validation is implemented
+    assert policy.wait_until(
+        has_condition("Accepted", "False"),
+        timelimit=30,
+    ), f"Policy with top-level fail was accepted, status: {policy.refresh().model.status.conditions}"
+
+
 def test_invalid_cel_expression(request, cluster, blame, route):
     """PipelinePolicy with malformed CEL predicate fails to enforce."""
     policy = PipelinePolicy.create_instance(cluster, blame("bad-cel"), route)