bijux-dag-runtime 0.4.0

Execution engine, replay semantics, and runtime policy layer for Bijux DAG graphs.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118

use bijux_dag_core::{env_allowlist_pattern_is_exact, Graph, Node};
use std::collections::BTreeMap;

fn matches_pattern(key: &str, pattern: &str) -> bool {
    if let Some(prefix) = pattern.strip_suffix('*') {
        return key.starts_with(prefix);
    }
    key == pattern
}

pub fn is_allowed_env_key(key: &str, allowlist: &[String]) -> bool {
    allowlist.iter().any(|pattern| matches_pattern(key, pattern))
}

pub fn is_denied_env_key(key: &str, denylist: &[String]) -> bool {
    denylist.iter().any(|pattern| matches_pattern(key, pattern))
}

pub fn shape_environment(
    ambient: &BTreeMap<String, String>,
    clean_env: bool,
    allowlist: &[String],
    denylist: &[String],
    explicit: &BTreeMap<String, String>,
) -> BTreeMap<String, String> {
    let mut shaped = BTreeMap::new();
    if !clean_env {
        for (key, value) in ambient {
            if is_denied_env_key(key, denylist) {
                continue;
            }
            if !allowlist.is_empty() && !is_allowed_env_key(key, allowlist) {
                continue;
            }
            shaped.insert(key.clone(), value.clone());
        }
    }
    for (key, value) in explicit {
        if is_denied_env_key(key, denylist) {
            continue;
        }
        if !allowlist.is_empty() && !is_allowed_env_key(key, allowlist) {
            continue;
        }
        shaped.insert(key.clone(), value.clone());
    }
    shaped
}

pub fn effective_env_allowlist(node: &Node) -> Vec<String> {
    let mut allowlist = node.env_allowlist.clone();
    if let Some(container) = &node.container {
        allowlist.extend(container.env_allowlist.iter().cloned());
    }
    allowlist.sort();
    allowlist.dedup();
    allowlist
}

pub fn declared_environment(
    ambient: &BTreeMap<String, String>,
    clean_env: bool,
    allowlist: &[String],
    denylist: &[String],
) -> BTreeMap<String, String> {
    if allowlist.is_empty() {
        return BTreeMap::new();
    }
    let explicit = if clean_env {
        ambient
            .iter()
            .filter(|(key, _)| is_allowed_env_key(key, allowlist))
            .map(|(key, value)| (key.clone(), value.clone()))
            .collect()
    } else {
        BTreeMap::new()
    };
    shape_environment(ambient, clean_env, allowlist, denylist, &explicit)
}

pub fn missing_required_env_keys(
    ambient: &BTreeMap<String, String>,
    allowlist: &[String],
) -> Vec<String> {
    let mut missing = allowlist
        .iter()
        .filter(|pattern| {
            env_allowlist_pattern_is_exact(pattern) && !ambient.contains_key(*pattern)
        })
        .cloned()
        .collect::<Vec<_>>();
    missing.sort();
    missing.dedup();
    missing
}

pub(crate) fn validate_graph_environment_bindings(
    graph: &Graph,
    ambient: &BTreeMap<String, String>,
) -> Result<(), String> {
    let mut failures = Vec::new();
    for node in &graph.nodes {
        let allowlist = effective_env_allowlist(node);
        let missing = missing_required_env_keys(ambient, &allowlist);
        if !missing.is_empty() {
            failures.push(format!(
                "node '{}' is missing required environment bindings: {}",
                node.id,
                missing.join(", ")
            ));
        }
    }
    if failures.is_empty() {
        Ok(())
    } else {
        Err(failures.join("; "))
    }
}