eln_plugin_sdk/
permissions.rs

1//! Tool 호출 권한 비트 모음.
2//!
3//! `ADMIN`은 별도 비트 자리 없이 `READ | WRITE | MODIFY` OR alias.
4//! 새 권한 비트를 추가하면 `ADMIN` 정의를 명시적으로 갱신할 것 — 권한 표면의
5//! 묵시적 확장을 막기 위함.
6//!
7//! S2: transport-level grant derivation (ApiKey → Permissions)은 S3 scope.
8//! 현재 stdio 진입은 `Permissions::ADMIN`을 hard-code로 부여, HTTP는 `READ`만.
9
10use bitflags::bitflags;
11
12bitflags! {
13    #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
14    pub struct Permissions: u32 {
15        const READ   = 1 << 0;
16        const WRITE  = 1 << 1;
17        const MODIFY = 1 << 2;
18    }
19}
20
21impl Permissions {
22    pub const ADMIN: Self = Self::READ
23        .union(Self::WRITE)
24        .union(Self::MODIFY);
25}
26
27#[cfg(test)]
28mod tests {
29    use super::*;
30
31    #[test]
32    fn admin_is_read_write_modify() {
33        assert!(Permissions::ADMIN.contains(Permissions::READ));
34        assert!(Permissions::ADMIN.contains(Permissions::WRITE));
35        assert!(Permissions::ADMIN.contains(Permissions::MODIFY));
36        assert_eq!(
37            Permissions::ADMIN,
38            Permissions::READ | Permissions::WRITE | Permissions::MODIFY
39        );
40    }
41
42    #[test]
43    fn empty_grants_nothing() {
44        let p = Permissions::empty();
45        assert!(!p.contains(Permissions::READ));
46        assert!(!p.contains(Permissions::WRITE));
47        assert!(!p.contains(Permissions::MODIFY));
48    }
49}
eln_plugin_sdk/permissions.rs

eln_plugin_sdk/
permissions.rs
