use crate::config::schema::{InstallSpec, NetworkPolicy};
use crate::error::ForgeError;
use crate::model::BackendKind;
pub(crate) fn enforce_network_policy(
network: NetworkPolicy,
specification: &InstallSpec,
) -> Result<(), ForgeError> {
if network == NetworkPolicy::Online {
return Ok(());
}
let backend = match specification {
InstallSpec::Apt(_) => Some(BackendKind::Apt),
InstallSpec::Brew(_) => Some(BackendKind::Brew),
InstallSpec::Rustup(_) => Some(BackendKind::Rustup),
InstallSpec::Npm(_) => Some(BackendKind::Npm),
InstallSpec::Pip(_) => Some(BackendKind::Pip),
InstallSpec::UvTool(_) => Some(BackendKind::UvTool),
InstallSpec::Winget(_) => Some(BackendKind::Winget),
InstallSpec::Git(_) => Some(BackendKind::Git),
InstallSpec::Shell(shell)
if shell.resources.iter().any(|resource| resource == "network") =>
{
Some(BackendKind::Shell)
}
_ => None,
};
if let Some(backend) = backend {
return Err(ForgeError::Config(format!(
"network={} forbids a potentially networked {} backend",
match network {
NetworkPolicy::CacheOnly => "cache-only",
NetworkPolicy::Offline => "offline",
NetworkPolicy::Online => unreachable!(),
},
backend.as_str()
)));
}
Ok(())
}