harn-vm 0.10.162

Async bytecode virtual machine for the Harn programming language
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84

//! Authority negotiation must not inherit permission to perform concrete effects.

use super::super::{
    evaluate_authority_request, PolicyAuthorityRequest, ToolApprovalPolicy, ToolApprovalRequest,
    ToolApprovalWorkspaceBoundary,
};

#[test]
fn authority_acquisition_does_not_admit_a_concrete_external_effect() {
    let workspace = tempfile::tempdir().unwrap();
    let external = tempfile::tempdir().unwrap();
    let args = serde_json::json!({"path": external.path(), "access": "read"});
    let policy: ToolApprovalPolicy = serde_json::from_value(serde_json::json!({
        "allow_external_paths": false,
        "allow_sensitive_paths": true,
        "rules": [{"id": "acquire", "ask": {"tool": "prepared_run.filesystem"}}]
    }))
    .unwrap();
    let authority = PolicyAuthorityRequest {
        authority_name: "prepared_run.filesystem".into(),
        arguments: args.clone(),
    };
    let acquisition = evaluate_authority_request(&policy, &authority).unwrap();
    assert!(acquisition.is_ask(), "{acquisition:?}");
    assert_eq!(acquisition.receipt["matched_rule"]["id"], "acquire");

    let effect = ToolApprovalRequest {
        tool_name: authority.authority_name,
        arguments: args,
        workspace_boundary: Some(ToolApprovalWorkspaceBoundary {
            root: workspace.path().to_string_lossy().into_owned(),
        }),
        ..Default::default()
    };
    let refusal = policy.evaluate_request(&effect);
    assert!(refusal.is_deny(), "{refusal:?}");
    assert!(
        refusal
            .risk_labels
            .iter()
            .any(|label| label == "external_path"),
        "{refusal:?}"
    );
}

#[test]
fn literal_invocation_approval_cannot_grant_authority_acquisition() {
    let workspace = tempfile::tempdir().unwrap();
    let args = serde_json::json!({"path": "notes.txt", "access": "read"});
    let policy: ToolApprovalPolicy = serde_json::from_value(serde_json::json!({
        "allow_sensitive_paths": true,
        "rules": [
            {"id": "remembered-effect", "source": "user", "identity_match": "literal",
                "allow": {"tool": "prepared_run.filesystem", "path": "notes.txt"}},
            {"id": "acquire", "source": "mode", "ask": {"tool": "prepared_run.filesystem"}}
        ]
    }))
    .unwrap();
    let effect = ToolApprovalRequest {
        tool_name: "prepared_run.filesystem".into(),
        arguments: args.clone(),
        workspace_boundary: Some(ToolApprovalWorkspaceBoundary {
            root: workspace.path().to_string_lossy().into_owned(),
        }),
        ..Default::default()
    };
    let remembered = policy.evaluate_request(&effect);
    assert!(remembered.is_allow(), "{remembered:?}");
    assert_eq!(
        remembered.receipt["matched_rule"]["id"],
        "remembered-effect"
    );

    let acquisition = evaluate_authority_request(
        &policy,
        &PolicyAuthorityRequest {
            authority_name: effect.tool_name,
            arguments: args,
        },
    )
    .unwrap();
    assert!(acquisition.is_ask(), "{acquisition:?}");
    assert_eq!(acquisition.receipt["matched_rule"]["id"], "acquire");
}