agent_graph_mcp/
auth.rs

1use std::collections::BTreeSet;
2
3#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
4pub enum Capability {
5    GraphRead,
6    GraphCreate,
7    GraphRun,
8    GraphCancel,
9    WitnessCapture,
10    WitnessRead,
11    CheckpointRequest,
12    CheckpointRead,
13    ApprovalDecide,
14    GraphDelete,
15    DatabaseMigration,
16    ConfigInstall,
17}
18
19#[derive(Debug, Clone, Copy, PartialEq, Eq)]
20pub enum Principal {
21    ModelClient,
22    StdioProxy,
23    Daemon,
24    LocalOperator,
25}
26
27#[derive(Debug, Clone)]
28pub struct CapabilityPolicy {
29    principal: Principal,
30    capabilities: BTreeSet<Capability>,
31}
32
33impl CapabilityPolicy {
34    pub fn model() -> Self {
35        Self {
36            principal: Principal::ModelClient,
37            capabilities: [
38                Capability::GraphRead,
39                Capability::GraphCreate,
40                Capability::GraphRun,
41                Capability::GraphCancel,
42                Capability::WitnessCapture,
43                Capability::WitnessRead,
44                Capability::CheckpointRequest,
45                Capability::CheckpointRead,
46            ]
47            .into_iter()
48            .collect(),
49        }
50    }
51    pub fn allows(&self, capability: Capability) -> bool {
52        self.capabilities.contains(&capability)
53    }
54    pub fn principal(&self) -> Principal {
55        self.principal
56    }
57    pub fn require(&self, capability: Capability) -> Result<(), &'static str> {
58        if self.allows(capability) {
59            Ok(())
60        } else {
61            Err("FORBIDDEN")
62        }
63    }
64}
agent_graph_mcp/auth.rs

agent_graph_mcp/
auth.rs
