systemprompt_models/profile/
mod.rs

1//! Profile configuration models — the deserialized shape of a
2//! `.systemprompt/profiles/<name>/profile.yaml` document.
3//!
4//! Covers server, database, paths, secrets, security, rate limits,
5//! gateway, governance, and runtime sections, plus validation rules and
6//! environment-variable interpolation.
7
8mod cloud;
9mod database;
10mod error;
11mod from_env;
12mod gateway;
13mod governance;
14mod info;
15mod paths;
16mod rate_limits;
17mod runtime;
18mod secrets;
19mod security;
20mod server;
21mod site;
22mod style;
23mod validation;
24
25pub use cloud::{CloudConfig, CloudValidationMode};
26pub use database::DatabaseConfig;
27pub use error::{ProfileError, ProfileResult};
28pub use gateway::{
29    GatewayCatalog, GatewayCatalogSource, GatewayConfig, GatewayConfigSpec, GatewayModel,
30    GatewayProfileError, GatewayProvider, GatewayResult, GatewayRoute, GatewayState,
31    slugify_pattern, synthesize_route_id,
32};
33pub use governance::{
34    AuthzConfig, AuthzHookConfig, AuthzMode, GovernanceConfig, UNRESTRICTED_ACKNOWLEDGEMENT,
35};
36pub use info::ProfileInfo;
37pub use paths::{PathsConfig, expand_home, resolve_path, resolve_with_home};
38pub use rate_limits::{
39    RateLimitsConfig, TierMultipliers, default_a2a_multiplier, default_admin_multiplier,
40    default_agent_registry, default_agents, default_anon_multiplier, default_artifacts,
41    default_burst, default_content, default_contexts, default_mcp, default_mcp_multiplier,
42    default_mcp_registry, default_oauth_auth, default_oauth_public, default_service_multiplier,
43    default_stream, default_tasks, default_user_multiplier,
44};
45pub use runtime::{Environment, LogLevel, OutputFormat, RuntimeConfig};
46pub use secrets::{SecretsConfig, SecretsSource, SecretsValidationMode};
47pub use security::{GATEWAY_REQUIRED_RESOURCE_AUDIENCES, SecurityConfig, TrustedIssuer};
48pub use server::{ContentNegotiationConfig, SecurityHeadersConfig, ServerConfig};
49pub use site::SiteConfig;
50pub use style::ProfileStyle;
51
52use serde::{Deserialize, Serialize};
53use std::path::Path;
54
55use crate::env::{interpolate, read_env_optional};
56
57#[derive(Debug, Clone, Default, Serialize, Deserialize, schemars::JsonSchema)]
58#[serde(deny_unknown_fields)]
59pub struct ExtensionsConfig {
60    #[serde(default)]
61    pub disabled: Vec<String>,
62}
63
64impl ExtensionsConfig {
65    pub fn is_disabled(&self, extension_id: &str) -> bool {
66        self.disabled.iter().any(|id| id == extension_id)
67    }
68}
69
70#[derive(
71    Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default, schemars::JsonSchema,
72)]
73#[serde(rename_all = "lowercase")]
74pub enum ProfileType {
75    #[default]
76    Local,
77    Cloud,
78}
79
80impl ProfileType {
81    pub const fn is_cloud(&self) -> bool {
82        matches!(self, Self::Cloud)
83    }
84
85    pub const fn is_local(&self) -> bool {
86        matches!(self, Self::Local)
87    }
88}
89
90#[derive(Debug, Clone, Serialize, Deserialize, schemars::JsonSchema)]
91#[serde(deny_unknown_fields)]
92pub struct Profile {
93    pub name: String,
94
95    pub display_name: String,
96
97    #[serde(default)]
98    pub target: ProfileType,
99
100    pub site: SiteConfig,
101
102    pub database: DatabaseConfig,
103
104    pub server: ServerConfig,
105
106    pub paths: PathsConfig,
107
108    pub security: SecurityConfig,
109
110    pub rate_limits: RateLimitsConfig,
111
112    pub system_admin: crate::services::SystemAdminConfig,
113
114    #[serde(default)]
115    pub runtime: RuntimeConfig,
116
117    #[serde(default)]
118    pub cloud: Option<CloudConfig>,
119
120    #[serde(default)]
121    pub secrets: Option<SecretsConfig>,
122
123    #[serde(default)]
124    pub extensions: ExtensionsConfig,
125
126    #[serde(default)]
127    pub gateway: Option<GatewayState>,
128
129    #[serde(default)]
130    pub governance: Option<GovernanceConfig>,
131}
132
133impl Profile {
134    #[must_use]
135    pub fn is_local_trial(&self) -> bool {
136        self.cloud.as_ref().is_none_or(CloudConfig::is_local_trial)
137    }
138
139    pub fn from_yaml(content: &str, profile_path: &Path) -> ProfileResult<Self> {
140        let content = interpolate(content, &|name| read_env_optional(name));
141
142        let mut profile: Self =
143            serde_yaml::from_str(&content).map_err(|source| ProfileError::ParseYaml {
144                path: profile_path.to_path_buf(),
145                source,
146            })?;
147
148        let profile_dir =
149            profile_path
150                .parent()
151                .ok_or_else(|| ProfileError::InvalidProfilePath {
152                    path: profile_path.to_path_buf(),
153                })?;
154
155        profile.paths.resolve_relative_to(profile_dir);
156
157        Ok(profile)
158    }
159
160    pub fn to_yaml(&self) -> ProfileResult<String> {
161        serde_yaml::to_string(self).map_err(ProfileError::SerializeYaml)
162    }
163
164    pub fn profile_style(&self) -> ProfileStyle {
165        match self.name.to_lowercase().as_str() {
166            "dev" | "development" | "local" => ProfileStyle::Development,
167            "prod" | "production" => ProfileStyle::Production,
168            "staging" | "stage" => ProfileStyle::Staging,
169            "test" | "testing" => ProfileStyle::Test,
170            _ => ProfileStyle::Custom,
171        }
172    }
173
174    pub fn mask_secret(value: &str, visible_chars: usize) -> String {
175        if value.is_empty() {
176            return "(not set)".to_owned();
177        }
178        if value.len() <= visible_chars {
179            return "***".to_owned();
180        }
181        format!("{}...", &value[..visible_chars])
182    }
183
184    pub fn mask_database_url(url: &str) -> String {
185        if let Some(at_pos) = url.find('@') {
186            if let Some(colon_pos) = url[..at_pos].rfind(':') {
187                let prefix = &url[..=colon_pos];
188                let suffix = &url[at_pos..];
189                return format!("{}***{}", prefix, suffix);
190            }
191        }
192        url.to_owned()
193    }
194
195    pub fn is_masked_database_url(url: &str) -> bool {
196        url.contains(":***@") || url.contains(":********@")
197    }
198}
systemprompt_models/profile/mod.rs

systemprompt_models/profile/
mod.rs
