tandem-server 0.6.9

HTTP server for Tandem engine APIs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83

use serde_json::{json, Value};

use crate::audit::append_protected_audit_event;
use crate::automation_v2::governance::GovernanceApprovalStatus;
use crate::{now_ms, AppState};

use super::governance::approval_receipt_matches_tenant;

fn action_gate_field<'a>(context: &'a Value, field: &str) -> Option<&'a Value> {
    context.get("action_gate")?.get(field)
}

pub(super) fn is_action_gate_context(context: &Value) -> bool {
    action_gate_field(context, "action_hash")
        .and_then(Value::as_str)
        .is_some()
}

pub(super) fn same_action_gate_scope(left: &Value, right: &Value) -> bool {
    ["action_hash", "session_id", "message_id", "run_id"]
        .into_iter()
        .all(|field| action_gate_field(left, field) == action_gate_field(right, field))
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub(crate) enum ActionGateApprovalState {
    Pending,
    ApprovedAndConsumed,
    Denied,
}

impl AppState {
    pub(crate) async fn consume_action_gate_approval(
        &self,
        approval_id: &str,
        tenant_context: &tandem_types::TenantContext,
    ) -> anyhow::Result<ActionGateApprovalState> {
        let now = now_ms();
        let resolution = {
            let mut guard = self.automation_governance.write().await;
            let request = guard
                .approvals
                .get_mut(approval_id)
                .filter(|request| approval_receipt_matches_tenant(request, tenant_context))
                .ok_or_else(|| anyhow::anyhow!("action-gate approval request not found"))?;

            match request.status {
                GovernanceApprovalStatus::Pending => ActionGateApprovalState::Pending,
                GovernanceApprovalStatus::Denied | GovernanceApprovalStatus::Expired => {
                    ActionGateApprovalState::Denied
                }
                GovernanceApprovalStatus::Approved => {
                    if now >= request.expires_at_ms
                        || request
                            .context
                            .pointer("/action_gate/consumed_at_ms")
                            .is_some()
                    {
                        ActionGateApprovalState::Denied
                    } else {
                        request.context["action_gate"]["consumed_at_ms"] = json!(now);
                        request.updated_at_ms = now;
                        guard.updated_at_ms = now;
                        ActionGateApprovalState::ApprovedAndConsumed
                    }
                }
            }
        };

        if resolution == ActionGateApprovalState::ApprovedAndConsumed {
            self.persist_automation_governance().await?;
            append_protected_audit_event(
                self,
                "automation.governance.approval.consumed",
                tenant_context,
                tenant_context.actor_id.clone(),
                json!({ "approvalID": approval_id }),
            )
            .await?;
        }
        Ok(resolution)
    }
}