auth: Add v9 downgrade property tests by juliaogris · Pull Request #68916 · gravitational/teleport

juliaogris · 2026-07-23T00:00:04Z

Add property tests for MaybeDowngradeRoleVersionToV8, which serves a v8 copy of a v9 role to pre-v19 agents that cannot enforce its app_resources restriction. The example test TestMaybeDowngradeRoleVersionToV8 from #68736 checks a handful of hand-written roles. The first property covers arbitrary allow and deny label selectors. The second adds a label expression on each side.

The two interesting cases, before and after the downgrade:

# The role has no deny app labels, so the allow selector moves across.
before:  allow: {app_labels: {env: [prod]}}   deny: {}
after:   allow: {app_labels: {}}              deny: {app_labels: {env: [prod]}}

# The role already has deny app labels, so the labels widen to a wildcard.
before:  allow: {app_labels: {env: [prod]}}   deny: {app_labels: {region: [us]}}
after:   allow: {app_labels: {}}              deny: {app_labels: {"*": ["*"]}}

An app_labels_expression changes in the same way, and is merged with || when the deny side already has one. Both sides' app_resources are cleared, the version is set to v8, and a downgrade reason is added to the metadata labels without disturbing the role's own labels.

The properties assert:

Every app the role allowed before the downgrade is denied after.
Every app the role already denied stays denied.
The input role comes back unmodified, since the caller passes the cache's shared role.

Each property test adds apps matching the role's selectors to the randomly drawn ones, since random apps rarely match a keyed selector.

juliaogris · 2026-08-10T01:18:29Z

@codex review please

chatgpt-codex-connector · 2026-08-10T01:21:31Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: e63463f4a9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

juliaogris · 2026-08-10T03:35:17Z

@codex review please

chatgpt-codex-connector · 2026-08-10T03:44:40Z

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: ddfa498f40

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

carrithers · 2026-08-10T10:54:01Z

These tests look good. The only gap i see is that the PR description states "A pure allow_all role and any client on v19 or later are returned unchanged.", but there is nothing here which actually asserts that, it only asserts downgrades behave correctly.

juliaogris · 2026-08-11T00:29:02Z

These tests look good. The only gap i see is that the PR description states "A pure allow_all role and any client on v19 or later are returned unchanged.", but there is nothing here which actually asserts that, it only asserts downgrades behave correctly.

@carrithers - thanks for the quick feedback.

IMO, the gap you noticed was a PR description bug (fixed) rather than a test gap. Both unchanged paths are already covered by subtests of TestMaybeDowngradeRoleVersionToV8 in merged #68736.

I think it is fine that those are ordinary table tests rather than property tests, since the discriminating input space is small.

chatgpt-codex-connector · 2026-08-11T02:54:02Z

Codex Review: Didn't find any major issues. 👍

Reviewed commit: bf0a1db706

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

juliaogris · 2026-08-11T03:59:05Z

@codex review please

chatgpt-codex-connector · 2026-08-11T04:06:35Z

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: d3a062fdfa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

juliaogris · 2026-08-11T04:36:51Z

@codex review please

chatgpt-codex-connector · 2026-08-11T04:43:56Z

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 4c9f1cc359

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

juliaogris · 2026-08-11T04:54:48Z

@codex review please

chatgpt-codex-connector · 2026-08-11T05:01:57Z

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 2569fd21e9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Exercise `maybeDowngradeRoleVersionToV8` with property tests so the guarantee holds for arbitrary roles, not just the handful of hand-written roles the example test checks. The downgrade is a security control. A pre-v19 agent cannot enforce a v9 role's `app_resources` restriction, so the downgraded v8 copy must move the role's allow app selector to the deny side and never leave one of its own apps reachable. The allow-to-deny move branches on whether a deny selector already exists, which is where a fail-open bug would go unnoticed. Generate random allow and deny label selectors and candidate apps, then assert three properties. Every app the role allowed before the downgrade is denied after. Every app it already denied stays denied. The input role comes back unmodified, because the caller passes the cache's shared role. Add apps matching each selector, and the deny expression, to every generated set, because random apps match a keyed selector in under a tenth of draws and the assertion body is otherwise skipped. Draw globs as selector values, since `services.MatchLabels` matches them as regular expressions and a downgrade that dropped them would serve a copy denying nothing. Cover the AND-to-OR downgrade in a second property, which adds a label expression on each side. An allow rule needs both `app_labels` and `app_labels_expression` to match while a deny rule needs either, so moving them across separately denies more apps than the role allowed. Add an example test for that over-deny, where a wildcard label set moved to the deny side blocks apps outside the allow rule. Use `pgregory.net/rapid`, already a direct dependency of this branch.

juliaogris · 2026-08-11T05:26:27Z

@codex review please

chatgpt-codex-connector · 2026-08-11T05:35:27Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 8852d9a52a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

juliaogris added no-changelog Indicates that a PR does not require a changelog entry no-test-plan Bypasses the test plan validation bot labels Jul 23, 2026

juliaogris force-pushed the julia/app/appresource-v9 branch from adee0b8 to 86a5496 Compare July 23, 2026 01:39

juliaogris force-pushed the julia/app/appresource-v9-proptest branch from fbc7ec1 to ff5c5bc Compare July 23, 2026 01:44

juliaogris force-pushed the julia/app/appresource-v9 branch from 86a5496 to a72ecc3 Compare July 23, 2026 02:43

juliaogris force-pushed the julia/app/appresource-v9-proptest branch from ff5c5bc to cab44d4 Compare July 23, 2026 02:43

juliaogris force-pushed the julia/app/appresource-v9 branch 2 times, most recently from 44a058e to d9a9250 Compare July 27, 2026 22:59

juliaogris force-pushed the julia/app/appresource-v9 branch from d9a9250 to 9a1d26b Compare August 4, 2026 01:22

juliaogris force-pushed the julia/app/appresource-v9-proptest branch 2 times, most recently from b6af66e to 5c48e12 Compare August 5, 2026 06:08

juliaogris force-pushed the julia/app/appresource-v9 branch from e51e750 to 8f90cef Compare August 6, 2026 08:15

Base automatically changed from julia/app/appresource-v9 to master August 7, 2026 00:43

juliaogris force-pushed the julia/app/appresource-v9-proptest branch 2 times, most recently from c3b5c78 to e63463f Compare August 10, 2026 00:57

juliaogris force-pushed the julia/app/appresource-v9-proptest branch from e63463f to ddfa498 Compare August 10, 2026 02:02

juliaogris force-pushed the julia/app/appresource-v9-proptest branch 5 times, most recently from 0358e9c to d3680c6 Compare August 10, 2026 06:03

juliaogris marked this pull request as ready for review August 11, 2026 00:29

github-actions Bot added the size/md label Aug 11, 2026

github-actions Bot requested a review from bernardjkim August 11, 2026 00:29

juliaogris requested a review from carrithers August 11, 2026 02:22

juliaogris force-pushed the julia/app/appresource-v9-proptest branch from d3680c6 to bf0a1db Compare August 11, 2026 02:44

juliaogris force-pushed the julia/app/appresource-v9-proptest branch 2 times, most recently from d44c92c to d3a062f Compare August 11, 2026 03:59

juliaogris removed the request for review from bernardjkim August 11, 2026 03:59

juliaogris force-pushed the julia/app/appresource-v9-proptest branch from d3a062f to 4c9f1cc Compare August 11, 2026 04:35

juliaogris force-pushed the julia/app/appresource-v9-proptest branch from 4c9f1cc to 2569fd2 Compare August 11, 2026 04:54

juliaogris force-pushed the julia/app/appresource-v9-proptest branch from 2569fd2 to 8852d9a Compare August 11, 2026 05:25

carrithers approved these changes Aug 12, 2026

View reviewed changes

juliaogris requested review from zmb3 and removed request for ryanclark August 12, 2026 06:31

zmb3 approved these changes Aug 12, 2026

View reviewed changes

juliaogris added this pull request to the merge queue Aug 12, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Aug 12, 2026

juliaogris added this pull request to the merge queue Aug 13, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Aug 13, 2026

juliaogris added this pull request to the merge queue Aug 13, 2026

Merged via the queue into master with commit 0d76b1d Aug 13, 2026
47 checks passed

juliaogris deleted the julia/app/appresource-v9-proptest branch August 13, 2026 02:02

Uh oh!

Conversation

juliaogris commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

juliaogris commented Aug 10, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 10, 2026

Uh oh!

juliaogris commented Aug 10, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 10, 2026

Uh oh!

carrithers commented Aug 10, 2026

Uh oh!

juliaogris commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

juliaogris commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

juliaogris commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

juliaogris commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

juliaogris commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

juliaogris commented Jul 23, 2026 •

edited

Loading