Description
Our tests are example based. Every AttributeBag in the suite was written by someone who already knew what the code does, so they encode the same assumptions the code does. Property tests generate inputs nobody thought of, which is the point.
Two targets.
Resolvers. Given an arbitrary AttributeBag, every resolver handles every attribute type without panicking and without silently dropping a value. AttributeValue has five variants (attributes.rs:32): Bool, Int(i64), Float(f64), String, StringSet. The interesting inputs are the ones at the edges: empty StringSet, i64::MIN and i64::MAX, floats including NaN and infinity, unicode and empty strings in both keys and values, dotted keys that collide with a namespace, deeply nested flattened paths, and the types a given PDP has no native equivalent for.
Silent loss matters as much as panics. A resolver that drops an attribute it cannot represent turns into a policy that quietly stops matching, which is worse than an error because nothing surfaces.
Parsers. The APL DSL parser (ppe-apl-core/src/parser.rs) and the unified config parser must parse or reject, never panic, on arbitrary input. Where a roundtrip is meaningful, parse then render then parse should be stable.
Scope
Arbitrary implementations for AttributeValue and AttributeBag, weighted toward edge values rather than uniform random.- Proptest suites over each resolver: no panic, no silent loss, and any rejection is an explicit error naming the attribute.
- Proptest suites over both parsers: parse-don't-panic, plus roundtrip where applicable.
- A committed seed corpus so a failure found in CI is reproducible locally.
Acceptance Criteria
Description
Our tests are example based. Every
AttributeBagin the suite was written by someone who already knew what the code does, so they encode the same assumptions the code does. Property tests generate inputs nobody thought of, which is the point.Two targets.
Resolvers. Given an arbitrary
AttributeBag, every resolver handles every attribute type without panicking and without silently dropping a value.AttributeValuehas five variants (attributes.rs:32):Bool,Int(i64),Float(f64),String,StringSet. The interesting inputs are the ones at the edges: emptyStringSet,i64::MINandi64::MAX, floats includingNaNand infinity, unicode and empty strings in both keys and values, dotted keys that collide with a namespace, deeply nested flattened paths, and the types a given PDP has no native equivalent for.Silent loss matters as much as panics. A resolver that drops an attribute it cannot represent turns into a policy that quietly stops matching, which is worse than an error because nothing surfaces.
Parsers. The APL DSL parser (
ppe-apl-core/src/parser.rs) and the unified config parser must parse or reject, never panic, on arbitrary input. Where a roundtrip is meaningful, parse then render then parse should be stable.Scope
Arbitraryimplementations forAttributeValueandAttributeBag, weighted toward edge values rather than uniform random.Acceptance Criteria
ArbitraryforAttributeValueandAttributeBag, biased toward edge casesStringSet, integer bounds,NaNand infinity, unicode and empty strings in keys and values, and keys whose dots collide with a namespaceproptestregression files are committed rather than gitignored