Authorization: cross-account access is refused

Status

illustrative

Industry

Cross-industry

Language

Robot Framework

Framework

RequestsLibrary

CI

any

Fulfilment

BUILD_DATASET

Profile

banking-regression

About this example

All data is synthetic. DataNivra provisions approved test data into a customer-controlled target; it does not run these tests. Credentials for the target are never returned by DataNivra — your runner holds its own.

Why test data matters

Access-control tests need two owners with similar accounts so a leaked id would be noticed.

What is requested

200 everyday banking records.

Policy gates

Within the profile; synthetic-only.

What is provisioned

A certified synthetic dataset.

Expected output

AUTO_APPROVED; then your suite asserts 403/404 for the other owner's account ids.

Cleanup

Suite teardown releases the request.

Files

• request.yaml
• cross_account.robot

Run

1. A tenant administrator defines and a second person approves the profile (datanivra test-data define ../../profiles/banking-regression.yaml --submit, then datanivra policies approve).
2. datanivra test-data validate request.yaml && datanivra test-data plan request.yaml
3. Run the example with DATANIVRA_BASE_URL and a session or workload token.

{
  "profile": {
    "name": "banking-regression",
    "version": 1
  },
  "scenarios": [
    {
      "scenario_code": "FS_EVERYDAY_BANKING",
      "count": 200
    }
  ]
}

# yaml-language-server: $schema=../../../../packages/contracts/schemas/v1/manifests/test-data-request.schema.json
# DataNivra test-data-request manifest (apiVersion datanivra.io/v1alpha1). Validate: datanivra test-data validate <file>
apiVersion: datanivra.io/v1alpha1
kind: TestDataRequest
metadata:
  name: cross-account
spec:
  profile: { name: banking-regression, version: 1 }
  scenarios:
    - { scenario_code: FS_EVERYDAY_BANKING, count: 200 }

*** Settings ***
Documentation     Cross-account authorization with approved synthetic data (REST; RequestsLibrary).
...               DataNivra provisions the data; this suite tests your API's access control.
Library           RequestsLibrary
Library           OperatingSystem
Suite Setup       Acquire Test Data
Suite Teardown    Release Test Data

*** Variables ***
${API}            %{DATANIVRA_BASE_URL}/v1/test-data/requests

*** Keywords ***
Acquire Test Data
    ${headers}=    Create Dictionary    Authorization=Bearer %{DATANIVRA_TOKEN}
    Create Session    dn    %{DATANIVRA_BASE_URL}    headers=${headers}
    ${body}=    Get File    request.json
    ${created}=    POST On Session    dn    /v1/test-data/requests    data=${body}    expected_status=201
    Set Suite Variable    ${REQUEST_ID}    ${created.json()}[id]
    Wait Until Keyword Succeeds    10 min    5 s    Request Is Ready

Request Is Ready
    ${current}=    GET On Session    dn    /v1/test-data/requests/${REQUEST_ID}
    Should Be Equal    ${current.json()}[state]    READY

Release Test Data
    POST On Session    dn    /v1/test-data/requests/${REQUEST_ID}/release    json=${{ {"reason_code": "TEST_RUN_FINISHED"} }}

*** Test Cases ***
Other Owner's Account Is Not Visible
    # Call your API as owner A with an account id of owner B and expect 403 or 404.
    Log    Test data request ${REQUEST_ID} is READY

# yaml-language-server: $schema=../../../packages/contracts/schemas/v1/manifests/test-data-profile.schema.json
# DataNivra test-data-profile manifest (apiVersion datanivra.io/v1alpha1). Validate: datanivra test-data validate <file>
# Placeholder ids (00000000-0000-4000-8000-0000000000NN): replace with your ids.
# 01 = approved target environment, 11 = certified dataset, 21 = customer agent,
# 99 = workload identity trust (datanivra workload-identities list).
apiVersion: datanivra.io/v1alpha1
kind: TestDataProfile
metadata:
  name: banking-regression
  description: Synthetic accounts, payments and their failure modes
spec:
  fulfilment: BUILD_DATASET
  build:
    business_domain: accounts and payments
    pack_id: financial-services
    dataset_kind: SYNTHETIC_ONLY
    target_environment_id: 00000000-0000-4000-8000-000000000001
    retention_days: 1
    max_total_records: 3000
    scenarios:
      - {
          pack_id: financial-services,
          scenario_code: FS_EVERYDAY_BANKING,
          kind: NORMAL,
          default_count: 1000,
          max_count: 2000,
        }
      - {
          pack_id: financial-services,
          scenario_code: FS_FAILED_PAYMENTS,
          kind: RARE,
          default_count: 100,
          max_count: 500,
        }
      - {
          pack_id: financial-services,
          scenario_code: FS_DUPLICATE_TRANSACTIONS,
          kind: DUPLICATE,
          default_count: 50,
          max_count: 200,
          included_by_default: false,
        }
      - {
          pack_id: financial-services,
          scenario_code: FS_CHARGEBACKS,
          kind: RARE,
          default_count: 50,
          max_count: 200,
          included_by_default: false,
        }
      - {
          pack_id: financial-services,
          scenario_code: FS_RECONCILIATION_BREAKS,
          kind: RARE,
          default_count: 50,
          max_count: 200,
          included_by_default: false,
        }
      - {
          pack_id: financial-services,
          scenario_code: FS_BALANCE_BOUNDARIES,
          kind: BOUNDARY,
          default_count: 50,
          max_count: 200,
          included_by_default: false,
        }
  automation:
    workload_identity_ids: [00000000-0000-4000-8000-000000000099]
    max_total_records: 1500
    escalate_out_of_envelope: false