Struct SecurityPolicy 

pub struct SecurityPolicy { /* private fields */ }

Unified security policy that coordinates all security checks

Implementations

impl SecurityPolicy

pub fn new(workspace_dir: PathBuf) -> Self

Create a new security policy with default configuration

pub fn with_config(workspace_dir: PathBuf, config: SecurityConfig) -> Self

Create a new security policy with custom configuration

pub fn from_level(workspace_dir: PathBuf, level: SecurityLevel) -> Self

Create a new security policy from a security level preset

pub fn config(&self) -> &SecurityConfig

Get the security configuration

pub fn workspace_dir(&self) -> &Path

Get the workspace directory

pub fn is_read_only(&self) -> bool

Check if read-only mode is enabled

pub fn has_shell_access(&self) -> bool

Check if shell access is allowed (always false in standard mode)

pub fn is_path_allowed(&self, path: &str) -> Result<(), SecurityError>

Layer 1-5: Basic path validation (before resolution)

Checks for:

• Null bytes
• Path traversal (../)
• URL-encoded traversal
• Tilde expansion
• Forbidden prefixes

pub fn resolve_path(&self, path: &str) -> PathBuf

Resolve a path relative to the workspace

pub fn is_resolved_path_allowed(&self, resolved: &Path) -> bool

Layer 8: Check if a resolved (canonicalized) path is within allowed roots

pub async fn validate_path(&self, path: &str) -> Result<PathBuf, SecurityError>

Full path validation: from input to resolved path

pub async fn validate_parent_directory( &self, path: &Path, ) -> Result<PathBuf, SecurityError>

Validate parent directory for write operations (TOCTOU-safe)

pub fn is_rate_limited(&self) -> bool

Check if rate limit is exceeded (without recording)

pub fn record_action(&self) -> usize

Record an action and return current count

pub fn try_record_action(&self) -> Result<(), SecurityError>

Try to record an action, returning false if rate limited

This is the main method for checking and recording in one step

pub fn action_count(&self) -> usize

Get current action count in the window

pub fn can_act(&self) -> Result<(), SecurityError>

Check if can perform an action (rate limit + read-only check)

pub fn check_file_size(&self, size: u64) -> Result<(), SecurityError>

Check if file size is within limits

Trait Implementations

impl Clone for SecurityPolicy

fn clone(&self) -> SecurityPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityPolicy

fn default() -> Self

Returns the “default value” for a type.