sen_plugin_host/permission/
mod.rs

1//! Permission system for plugin capabilities
2//!
3//! This module provides a flexible, customizable permission system for controlling
4//! what capabilities plugins can access. It's designed as a framework that
5//! application developers can customize to fit their needs.
6//!
7//! # Architecture
8//!
9//! ```text
10//! ┌─────────────────────────────────────────────────────────────────────────┐
11//! │                         PermissionConfig                                 │
12//! │  ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────────────┐│
13//! │  │  Strategy   │ │    Store    │ │   Prompt    │ │       Audit         ││
14//! │  │             │ │             │ │             │ │                     ││
15//! │  │ - Default   │ │ - File      │ │ - Terminal  │ │ - File (JSONL)      ││
16//! │  │ - Strict    │ │ - Memory    │ │ - Auto      │ │ - Memory            ││
17//! │  │ - Permissive│ │ - ReadOnly  │ │ - Recording │ │ - Null              ││
18//! │  │ - CI        │ │             │ │             │ │ - Composite         ││
19//! │  │ - TrustAll  │ │             │ │             │ │                     ││
20//! │  └─────────────┘ └─────────────┘ └─────────────┘ └─────────────────────┘│
21//! └─────────────────────────────────────────────────────────────────────────┘
22//! ```
23//!
24//! # Quick Start
25//!
26//! ## Using Presets
27//!
28//! ```rust,ignore
29//! use sen_plugin_host::permission::PermissionPresets;
30//!
31//! // Interactive development
32//! let config = PermissionPresets::interactive("myapp")?;
33//!
34//! // CI/CD pipeline
35//! let config = PermissionPresets::ci("myapp", None)?;
36//!
37//! // Testing
38//! let config = PermissionPresets::testing();
39//! ```
40//!
41//! ## Custom Configuration
42//!
43//! ```rust,ignore
44//! use sen_plugin_host::permission::{
45//!     PermissionConfigBuilder,
46//!     DefaultPermissionStrategy,
47//!     MemoryPermissionStore,
48//!     TerminalPromptHandler,
49//!     TrustFlagConfig,
50//! };
51//! use sen_plugin_host::audit::NullAuditSink;
52//!
53//! let config = PermissionConfigBuilder::new()
54//!     .app_name("myapp")
55//!     .strategy(DefaultPermissionStrategy)
56//!     .store(MemoryPermissionStore::new())
57//!     .prompt(TerminalPromptHandler::new())
58//!     .audit(NullAuditSink)
59//!     .trust_flags(TrustFlagConfig::default())
60//!     .build()?;
61//! ```
62//!
63//! # Components
64//!
65//! ## Strategy
66//!
67//! Controls how permission decisions are made:
68//!
69//! | Strategy | Granularity | Prompts | Best For |
70//! |----------|-------------|---------|----------|
71//! | Default | Plugin | When needed | General use |
72//! | Strict | Command | Always (interactive) | Security |
73//! | Permissive | Plugin | Network only | Development |
74//! | CI | Plugin | Never | CI/CD |
75//! | TrustAll | Plugin | Never | Testing only |
76//!
77//! ## Store
78//!
79//! Persists granted permissions:
80//!
81//! - `FilePermissionStore`: JSON file in config directory
82//! - `MemoryPermissionStore`: In-memory (session only)
83//! - `ReadOnlyPermissionStore`: Wrapper that prevents writes
84//!
85//! ## Prompt
86//!
87//! Handles user interaction:
88//!
89//! - `TerminalPromptHandler`: Interactive terminal prompts
90//! - `AutoPromptHandler`: Automatic approve/deny
91//! - `RecordingPromptHandler`: Records prompts (testing)
92//!
93//! ## Trust Flags
94//!
95//! Configurable CLI flags for explicit trust:
96//!
97//! ```bash
98//! # Default format
99//! myapp --trust-plugin=hello run
100//!
101//! # Allow-style (configurable)
102//! myapp --allow-plugin=hello run
103//!
104//! # Custom aliases
105//! myapp --yolo run  # Trust all (if configured)
106//! ```
107
108pub mod presets;
109pub mod prompt;
110pub mod store;
111pub mod strategy;
112pub mod trust;
113
114// Re-exports for convenience
115pub use presets::{PermissionConfig, PermissionConfigBuilder, PermissionPresets, PresetError};
116pub use prompt::{AutoPromptHandler, RecordingPromptHandler, TerminalPromptHandler};
117pub use prompt::{PromptError, PromptHandler, PromptResult};
118pub use store::{FilePermissionStore, MemoryPermissionStore, ReadOnlyPermissionStore};
119pub use store::{PermissionStore, StoreError, StoredPermission, StoredTrustLevel};
120pub use strategy::{
121    CiPermissionStrategy, DefaultPermissionStrategy, PermissivePermissionStrategy,
122    StrictPermissionStrategy, TrustAllStrategy,
123};
124pub use strategy::{
125    PermissionContext, PermissionDecision, PermissionGranularity, PermissionStrategy,
126};
127pub use trust::{
128    TrustDirectives, TrustEffect, TrustFlagAlias, TrustFlagConfig, TrustFlagPresets, TrustTarget,
129};
sen_plugin_host/permission/mod.rs

sen_plugin_host/permission/
mod.rs
