wasm_capability_contract/capability/vo/
capability_scope.rs

1//! [`CapabilityScope`] — what a granted capability is actually allowed to reach.
2
3use serde::{Deserialize, Serialize};
4
5use crate::EgressIdentity;
6
7/// Per-capability-kind scope, carried on a [`crate::CapabilityGrant`].
8///
9/// Each variant's allowlist is the deny-by-default boundary a real
10/// `ComponentValidator` implementor enforces (ADR-001): a capability call
11/// naming a target outside its own allowlist is rejected, checked again on
12/// every call, not just once at grant-registration time.
13///
14/// `["*"]` is a real, explicit opt-in to "unrestricted" for `Http`/`Grpc`/
15/// `Complete`/`Mcp` only. **`Database`/`Secrets` never accept a wildcard,
16/// under any circumstance** — every entry in `allowed_queries`/
17/// `allowed_secrets` must individually name one specific, deployer-
18/// pre-registered query or secret. This is a permanent security boundary
19/// of the design (no raw-SQL capability is ever offered to a guest, and no
20/// blanket secret-store access), not a v1 limitation a future grant format
21/// might relax.
22#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
23#[serde(tag = "type", rename_all = "snake_case")]
24pub enum CapabilityScope {
25    /// Scopes `http-egress`: the hostnames this grant may reach, and which
26    /// identity mechanism to present.
27    Http {
28        /// Hostnames this grant may reach. `["*"]` opts into unrestricted.
29        allowed_hosts: Vec<String>,
30        /// Which identity mechanism the call presents to `allowed_hosts`.
31        identity: EgressIdentity,
32    },
33    /// Scopes `grpc-egress`: the fully-qualified `"pkg.Service/Method"`
34    /// names this grant may invoke, and which identity mechanism to present.
35    Grpc {
36        /// Methods this grant may invoke. `["*"]` opts into unrestricted.
37        allowed_methods: Vec<String>,
38        /// Which identity mechanism the call presents to the bound target.
39        identity: EgressIdentity,
40    },
41    /// Scopes `llm-complete`: the model ids this grant may call.
42    Complete {
43        /// Model ids this grant may call. `["*"]` opts into unrestricted.
44        allowed_models: Vec<String>,
45    },
46    /// Scopes `mcp-egress`: the remote tool names this grant may call.
47    Mcp {
48        /// Tool names this grant may call. `["*"]` opts into unrestricted.
49        allowed_tools: Vec<String>,
50    },
51    /// Scopes `database`: the deployer-pre-registered, parameterized query
52    /// names this grant may invoke. Never accepts a wildcard — see this
53    /// type's own doc comment.
54    Database {
55        /// Named queries this grant may invoke. No wildcard, ever.
56        allowed_queries: Vec<String>,
57    },
58    /// Scopes `secrets`: the individually-named secrets this grant may
59    /// read. Never accepts a wildcard — see this type's own doc comment.
60    Secrets {
61        /// Secret names this grant may read. No wildcard, ever.
62        allowed_secrets: Vec<String>,
63    },
64}
wasm_capability_contract/capability/vo/capability_scope.rs

wasm_capability_contract/capability/vo/
capability_scope.rs
