actrpc-interceptor 0.1.0

Concrete interceptors for ActRPC.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106

use actrpc_core::{
    action::ActionSpec,
    interception::{InterceptionRequest, InterceptorContinuation},
    json_rpc::{
        JsonRpcId, JsonRpcMessage, JsonRpcParams, JsonRpcRequest, JsonRpcResponse,
        JsonRpcSingleMessage, JsonRpcSuccessResponse, JsonRpcVersion,
    },
    participant::{Participant, ParticipantType},
};
use actrpc_interceptor::interceptors::policy::{
    PolicyInterceptor,
    config::{
        MatchExpr, PolicyApply, PolicyConfig, PolicyEffect, PolicyMatcher, PolicyRule,
        RejectCallEffect,
    },
};
use actrpc_orchestrator::{action::actions::reject_call::RejectCall, interceptor::Interceptor};
use serde_json::json;

#[tokio::test]
async fn phase_fact_matches_outbound_only() {
    let interceptor = PolicyInterceptor::new(outbound_write_reject_policy()).unwrap();

    let request = outbound_request("write_file", json!({ "path": "/tmp/a.txt" }));

    let response = interceptor.intercept(&request).await.unwrap();

    assert_eq!(response.continuation, InterceptorContinuation::Stop);
    assert_eq!(response.actions.len(), 1);
    assert_eq!(response.actions[0].kind, RejectCall::action_kind());
}

#[tokio::test]
async fn outbound_phase_rule_does_not_match_inbound_response() {
    let interceptor = PolicyInterceptor::new(outbound_write_reject_policy()).unwrap();

    let request = inbound_success_response(json!({ "ok": true }));

    let response = interceptor.intercept(&request).await.unwrap();

    assert_eq!(response.continuation, InterceptorContinuation::Stop);
    assert!(response.actions.is_empty());
}

fn outbound_write_reject_policy() -> PolicyConfig {
    PolicyConfig {
        rules: vec![PolicyRule {
            name: "reject_outbound_write".to_owned(),
            match_expr: MatchExpr::all(vec![
                MatchExpr::condition("phase", PolicyMatcher::exact("outbound")),
                MatchExpr::condition("message.method", PolicyMatcher::exact("write_file")),
            ]),
            apply: PolicyApply {
                immediate: vec![PolicyEffect::RejectCall {
                    reject_call: RejectCallEffect {
                        error: actrpc_core::json_rpc::JsonRpcError {
                            code: -32010,
                            message: "outbound write denied".to_owned(),
                            data: None,
                        },
                    },
                }],
                review: None,
            },
        }],
    }
}

fn outbound_request(method: &str, params: serde_json::Value) -> InterceptionRequest {
    let params = match params {
        serde_json::Value::Array(values) => Some(JsonRpcParams::Array(values)),
        serde_json::Value::Object(map) => Some(JsonRpcParams::Object(map)),
        other => panic!("test params must be array or object, got {other}"),
    };

    InterceptionRequest {
        origin: Participant {
            kind: ParticipantType::Orchestrator,
            id: "orchestrator".to_owned(),
        },
        message: JsonRpcMessage::Single(JsonRpcSingleMessage::Request(JsonRpcRequest {
            jsonrpc: JsonRpcVersion::V2_0,
            id: JsonRpcId::Number(1.into()),
            method: method.to_owned(),
            params,
        })),
        resolved_action_history: vec![],
    }
}

fn inbound_success_response(result: serde_json::Value) -> InterceptionRequest {
    InterceptionRequest {
        origin: Participant {
            kind: ParticipantType::Orchestrator,
            id: "orchestrator".to_owned(),
        },
        message: JsonRpcMessage::Single(JsonRpcSingleMessage::Response(JsonRpcResponse::Success(
            JsonRpcSuccessResponse {
                jsonrpc: JsonRpcVersion::V2_0,
                id: JsonRpcId::Number(1.into()),
                result,
            },
        ))),
        resolved_action_history: vec![],
    }
}