apollo/
policy.rs

1//! Shared runtime policy controls for privileged capabilities.
2
3use crate::config::PolicyConfig;
4
5#[derive(Debug, Clone)]
6pub struct ExecutionPolicy {
7    pub allow_shell: bool,
8    pub allow_dynamic_tools: bool,
9    pub allow_plugin_shell: bool,
10    pub allow_plugin_git: bool,
11    pub allow_computer_use: bool,
12}
13
14impl Default for ExecutionPolicy {
15    fn default() -> Self {
16        Self {
17            allow_shell: true,
18            allow_dynamic_tools: true,
19            allow_plugin_shell: true,
20            allow_plugin_git: true,
21            allow_computer_use: true,
22        }
23    }
24}
25
26impl ExecutionPolicy {
27    pub fn from_config(config: &PolicyConfig) -> Self {
28        Self {
29            allow_shell: config.allow_shell,
30            allow_dynamic_tools: config.allow_dynamic_tools,
31            allow_plugin_shell: config.allow_plugin_shell,
32            allow_plugin_git: config.allow_plugin_git,
33            allow_computer_use: config.allow_computer_use,
34        }
35    }
36
37    pub fn deny(message: &str) -> anyhow::Result<crate::tools::ToolResult> {
38        Ok(crate::tools::ToolResult::error(message))
39    }
40}
41
42#[cfg(test)]
43mod tests {
44    use super::*;
45
46    #[test]
47    fn test_execution_policy_defaults_to_allow_shell() {
48        let policy = ExecutionPolicy::default();
49        assert!(policy.allow_shell);
50    }
51
52    #[test]
53    fn test_execution_policy_defaults_to_allow_dynamic_tools() {
54        let policy = ExecutionPolicy::default();
55        assert!(policy.allow_dynamic_tools);
56    }
57
58    #[test]
59    fn test_execution_policy_defaults_to_allow_computer_use() {
60        let policy = ExecutionPolicy::default();
61        assert!(policy.allow_computer_use);
62    }
63}
apollo/policy.rs

apollo/
policy.rs
