test(agent): cover policy management end to end

.github/workflows/ci.yml

@@ -1377,6 +1377,16 @@ jobs:
             exit $LASTEXITCODE
           }
 
+      - name: Run Agent policy tester as standard user
+        shell: pwsh
+        run: |
+          ./crates/agent-policy-tester/run-unelevated.ps1
+          $exitCode = $LASTEXITCODE
+          Get-Content -Path ./crates/agent-policy-tester/agent-policy-tester-unelevated.out
+          if ($exitCode -ne 0) {
+            exit $exitCode
+          }
+
       - name: Run Agent policy tester as LocalSystem
         shell: pwsh
         run: |
@@ -1388,6 +1398,10 @@ jobs:
             exit $exitCode
           }
 
+      - name: Run policy route authorization tests
+        shell: pwsh
+        run: cargo test --locked -p now-package-broker --features dev-skip-broker-signature
+
       - name: Show sccache stats
         if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
         shell: pwsh

crates/agent-policy-tester/Cargo.toml

@@ -12,6 +12,8 @@ fastrand = "2"
 serde_json = "1"
 tempfile = "3"
 tokio = { version = "1", features = ["io-util", "macros", "net", "process", "rt-multi-thread", "time"] }
+win-api-wrappers = { path = "../win-api-wrappers" }
+windows = { version = "0.61", features = ["Win32_Security", "Win32_System_Threading"] }
 
 [lints]
 workspace = true

crates/agent-policy-tester/run-as-system.ps1

@@ -76,7 +76,7 @@ public static class AgentPolicyTesterNativeDirectory
     "Staged policy tester at $stagedTesterPath" | Out-File $outputPath -Append
     Get-Acl -LiteralPath $stagingPath | Format-List Owner, Sddl | Out-File $outputPath -Append
     Get-Acl -LiteralPath $stagedTesterPath | Format-List Owner, Sddl | Out-File $outputPath -Append
-    & $stagedTesterPath $agentPath 2>&1 | Out-File $outputPath -Append
+    & $stagedTesterPath $agentPath elevated 2>&1 | Out-File $outputPath -Append
     $exitCode = $LASTEXITCODE
 } catch {
     $_ | Out-File $outputPath -Append