add support for sshTests (#30)

https://tailscale.com/kb/1337/policy-syntax#sshtests

Author: nitper

Makefile

@@ -5,4 +5,4 @@ testdata:
 		-f testdata/input-parent.hujson \
 		-d testdata/departments/ \
 		-o testdata/output-file-to-compare-to.hujson \
-		-allow=acls,autoApprovers,grants,groups,ipsets,ssh,tests
+		-allow=acls,autoApprovers,grants,groups,ipsets,ssh,tests,sshTests

main.go

@@ -36,6 +36,7 @@ var (
 		"ssh":             handleArray(),
 		"tagOwners":       handleObject(),
 		"tests":           handleArray(),
+		"sshTests":        handleArray(),
 		"hosts":           handleObject(),
 	}
 )

testdata/departments/engineering/acls.json

@@ -2,15 +2,24 @@
 	"acls": [
 		{
 			"action": "accept",
-			"src": [
-				"[email protected]"
-			],
-			"dst": [
-				"tag:json-rule:22"
-			],
-			"srcPosture": [
-				"posture:latestMac"
-			]
+			"src": ["[email protected]"],
+			"dst": ["tag:json-rule:22"],
+			"srcPosture": ["posture:latestMac"]
+		}
+	],
+	"ssh": [
+		{
+			"action": "accept",
+			"src": ["[email protected]"],
+			"dst": ["autogroup:self"],
+			"users": ["root", "autogroup:nonroot"]
+		}
+	],
+	"sshTests": [
+		{
+			"src": ["[email protected]"],
+			"dst": ["autogroup:self"],
+			"accept": ["root", "autogroup:nonroot"]
 		}
 	]
 }

testdata/input-parent.hujson

@@ -56,6 +56,14 @@
 		},
 	],
 
+	"sshTests": [
+		{
+			"src":    ["autogroup:member"],
+			"dst":    ["autogroup:self"],
+			"accept":  ["root", "autogroup:nonroot"],
+		},
+	],
+
 	"tagOwners": {
 		"tag:parent": [],
 		"tag:user1": [

testdata/output-file-to-compare-to.hujson

@@ -152,6 +152,13 @@
       "dst":    ["autogroup:self"],
       "users":  ["root", "autogroup:nonroot"],
     },
+    // from `testdata/departments/engineering/acls.json`
+    {
+      "action": "accept",
+      "src":    ["[email protected]"],
+      "dst":    ["autogroup:self"],
+      "users":  ["root", "autogroup:nonroot"],
+    },
     // from `testdata/departments/finance/ssh.hujson`
     {
       "action": "accept",
@@ -167,6 +174,21 @@
     },
   ],
 
+  "sshTests": [
+    // from `testdata/input-parent.hujson`
+    {
+      "src":    ["autogroup:member"],
+      "dst":    ["autogroup:self"],
+      "accept": ["root", "autogroup:nonroot"],
+    },
+    // from `testdata/departments/engineering/acls.json`
+    {
+      "src":    ["[email protected]"],
+      "dst":    ["autogroup:self"],
+      "accept": ["root", "autogroup:nonroot"],
+    },
+  ],
+
   "tagOwners": {
     // from `testdata/input-parent.hujson`
     "tag:parent": [],