| 1 | //! Normalization for Runtime mode and permission-posture wires. |
| 2 | //! |
| 3 | //! Older clients can still send mode aliases and the legacy `auto_approve` |
| 4 | //! bit. New callers send a named posture. Keep those inputs readable, but |
| 5 | //! persist and execute one contract: Plan / Act / Operate plus Ask / |
| 6 | //! Auto-Review / Full Access. |
| 7 | |
| 8 | use anyhow::{Result, bail}; |
| 9 | |
| 10 | use codewhale_config::AppMode; |
| 11 | use codewhale_execpolicy::ApprovalMode; |
| 12 | |
| 13 | #[derive(Debug, Clone, Copy, PartialEq, Eq)] |
| 14 | pub(crate) struct RuntimePolicyProjection { |
| 15 | pub(crate) mode: AppMode, |
| 16 | pub(crate) permission: ApprovalMode, |
| 17 | } |
| 18 | |
| 19 | impl RuntimePolicyProjection { |
| 20 | /// Read a persisted compatibility shape. Unknown historical values fail |
| 21 | /// closed to Act + Ask unless the old bypass bit is explicitly present. |
| 22 | #[must_use] |
| 23 | pub(crate) fn from_persisted( |
| 24 | mode: &str, |
| 25 | permission_posture: Option<&str>, |
| 26 | auto_approve: bool, |
| 27 | ) -> Self { |
| 28 | let parsed_mode = parse_runtime_mode(mode).unwrap_or(AppMode::Agent); |
| 29 | let permission = permission_posture |
| 30 | .and_then(ApprovalMode::from_config_value) |
| 31 | .filter(|permission| *permission != ApprovalMode::Never) |
| 32 | .unwrap_or_else(|| { |
| 33 | if legacy_yolo_alias(mode) || auto_approve { |
| 34 | ApprovalMode::Bypass |
| 35 | } else { |
| 36 | ApprovalMode::Suggest |
| 37 | } |
| 38 | }); |
| 39 | Self { |
| 40 | mode: parsed_mode, |
| 41 | permission, |
| 42 | } |
| 43 | } |
| 44 | |
| 45 | /// Validate and normalize a new Runtime request. Legacy aliases are |
| 46 | /// accepted as one-way inputs, but only current values are persisted. |
| 47 | pub(crate) fn from_request( |
| 48 | mode: &str, |
| 49 | permission_posture: Option<&str>, |
| 50 | auto_approve: Option<bool>, |
| 51 | ) -> Result<Self> { |
| 52 | let parsed_mode = parse_runtime_mode(mode).ok_or_else(|| { |
| 53 | anyhow::anyhow!("unsupported Runtime mode {mode:?}; expected plan, act, or operate") |
| 54 | })?; |
| 55 | let permission = match permission_posture { |
| 56 | Some(value) => ApprovalMode::from_config_value(value).ok_or_else(|| { |
| 57 | anyhow::anyhow!( |
| 58 | "unsupported permission posture {value:?}; expected ask, auto-review, or full-access" |
| 59 | ) |
| 60 | })?, |
| 61 | None if legacy_yolo_alias(mode) || auto_approve.unwrap_or(false) => ApprovalMode::Bypass, |
| 62 | None => ApprovalMode::Suggest, |
| 63 | }; |
| 64 | if permission == ApprovalMode::Never { |
| 65 | bail!("permission posture 'never' is not part of the Runtime product contract"); |
| 66 | } |
| 67 | Ok(Self { |
| 68 | mode: parsed_mode, |
| 69 | permission, |
| 70 | }) |
| 71 | } |
| 72 | |
| 73 | #[must_use] |
| 74 | pub(crate) fn mode_setting(self) -> &'static str { |
| 75 | self.mode.as_setting() |
| 76 | } |
| 77 | |
| 78 | #[must_use] |
| 79 | pub(crate) fn permission_wire(self) -> &'static str { |
| 80 | match self.permission { |
| 81 | ApprovalMode::Suggest => "ask", |
| 82 | ApprovalMode::Auto => "auto_review", |
| 83 | ApprovalMode::Bypass => "full_access", |
| 84 | ApprovalMode::Never => "ask", |
| 85 | } |
| 86 | } |
| 87 | |
| 88 | #[must_use] |
| 89 | pub(crate) fn auto_approve(self) -> bool { |
| 90 | self.permission == ApprovalMode::Bypass |
| 91 | } |
| 92 | } |
| 93 | |
| 94 | #[must_use] |
| 95 | pub(crate) fn parse_runtime_mode(value: &str) -> Option<AppMode> { |
| 96 | match value.trim().to_ascii_lowercase().as_str() { |
| 97 | "normal" => Some(AppMode::Agent), |
| 98 | other => AppMode::parse(other), |
| 99 | } |
| 100 | } |
| 101 | |
| 102 | /// Legacy mode spellings that carried the Full Access posture. `AppMode:: |
| 103 | /// parse` folds them to Agent; the posture is re-derived from the raw wire |
| 104 | /// value so old persisted shapes keep their permission meaning. |
| 105 | #[must_use] |
| 106 | fn legacy_yolo_alias(mode: &str) -> bool { |
| 107 | matches!( |
| 108 | mode.trim().to_ascii_lowercase().as_str(), |
| 109 | "yolo" | "4" | "bypass" | "bypass-permissions" | "bypasspermissions" |
| 110 | ) |
| 111 | } |
| 112 | |
| 113 | #[cfg(test)] |
| 114 | mod tests { |
| 115 | use super::*; |
| 116 | |
| 117 | #[test] |
| 118 | fn legacy_inputs_project_to_current_mode_and_permission_wires() { |
| 119 | for alias in ["normal", "agent", "auto"] { |
| 120 | let policy = RuntimePolicyProjection::from_persisted(alias, None, false); |
| 121 | assert_eq!(policy.mode_setting(), "agent", "{alias}"); |
| 122 | assert_eq!(policy.permission_wire(), "ask", "{alias}"); |
| 123 | } |
| 124 | for alias in ["yolo", "bypass"] { |
| 125 | let policy = RuntimePolicyProjection::from_persisted(alias, None, false); |
| 126 | assert_eq!(policy.mode_setting(), "agent", "{alias}"); |
| 127 | assert_eq!(policy.permission_wire(), "full_access", "{alias}"); |
| 128 | } |
| 129 | } |
| 130 | |
| 131 | #[test] |
| 132 | fn named_posture_is_normalized_and_authoritative() { |
| 133 | let auto = RuntimePolicyProjection::from_request("operate", Some("auto-review"), None) |
| 134 | .expect("compat permission"); |
| 135 | assert_eq!(auto.mode_setting(), "operate"); |
| 136 | assert_eq!(auto.permission_wire(), "auto_review"); |
| 137 | assert_eq!(auto.permission, ApprovalMode::Auto); |
| 138 | assert!(!auto.auto_approve()); |
| 139 | |
| 140 | let full = RuntimePolicyProjection::from_request("act", Some("full_access"), None) |
| 141 | .expect("current permission wire"); |
| 142 | assert_eq!(full.permission_wire(), "full_access"); |
| 143 | assert_eq!(full.permission, ApprovalMode::Bypass); |
| 144 | assert!(full.auto_approve()); |
| 145 | |
| 146 | let ask = RuntimePolicyProjection::from_request("yolo", Some("ask"), Some(true)) |
| 147 | .expect("named posture overrides legacy flags"); |
| 148 | assert_eq!(ask.mode_setting(), "agent"); |
| 149 | assert_eq!(ask.permission_wire(), "ask"); |
| 150 | assert_eq!(ask.permission, ApprovalMode::Suggest); |
| 151 | assert!(!ask.auto_approve()); |
| 152 | } |
| 153 | |
| 154 | #[test] |
| 155 | fn invalid_or_never_postures_are_rejected() { |
| 156 | assert!(RuntimePolicyProjection::from_request("act", Some("owner"), None).is_err()); |
| 157 | assert!(RuntimePolicyProjection::from_request("act", Some("never"), None).is_err()); |
| 158 | } |
| 159 | } |
| 160 |