tenant.openagents/omega

1use serde::{Deserialize, Serialize};
2
3#[derive(Debug, PartialEq, Eq, Clone, Serialize, Deserialize)]
4#[serde(rename_all = "snake_case")]
5pub struct ProcessExecCapability {
6    /// The command to execute.
7    pub command: String,
8    /// The arguments to pass to the command. Use `*` for a single wildcard argument.
9    /// If the last element is `**`, then any trailing arguments are allowed.
10    pub args: Vec<String>,
11}
12
13impl ProcessExecCapability {
14    /// Returns whether the capability allows the given command and arguments.
15    pub fn allows(
16        &self,
17        desired_command: &str,
18        desired_args: &[impl AsRef<str> + std::fmt::Debug],
19    ) -> bool {
20        if self.command != desired_command && self.command != "*" {
21            return false;
22        }
23
24        for (ix, arg) in self.args.iter().enumerate() {
25            if arg == "**" {
26                return true;
27            }
28
29            if ix >= desired_args.len() {
30                return false;
31            }
32
33            if arg != "*" && arg != desired_args[ix].as_ref() {
34                return false;
35            }
36        }
37
38        if self.args.len() < desired_args.len() {
39            return false;
40        }
41
42        true
43    }
44}
45
46#[cfg(test)]
47mod tests {
48    use pretty_assertions::assert_eq;
49
50    use super::*;
51
52    #[test]
53    fn test_allows_with_exact_match() {
54        let capability = ProcessExecCapability {
55            command: "ls".to_string(),
56            args: vec!["-la".to_string()],
57        };
58
59        assert_eq!(capability.allows("ls", &["-la"]), true);
60        assert_eq!(capability.allows("ls", &["-l"]), false);
61        assert_eq!(capability.allows("pwd", &[] as &[&str]), false);
62    }
63
64    #[test]
65    fn test_allows_with_wildcard_arg() {
66        let capability = ProcessExecCapability {
67            command: "git".to_string(),
68            args: vec!["*".to_string()],
69        };
70
71        assert_eq!(capability.allows("git", &["status"]), true);
72        assert_eq!(capability.allows("git", &["commit"]), true);
73        // Too many args.
74        assert_eq!(capability.allows("git", &["status", "-s"]), false);
75        // Wrong command.
76        assert_eq!(capability.allows("npm", &["install"]), false);
77    }
78
79    #[test]
80    fn test_allows_with_double_wildcard() {
81        let capability = ProcessExecCapability {
82            command: "cargo".to_string(),
83            args: vec!["test".to_string(), "**".to_string()],
84        };
85
86        assert_eq!(capability.allows("cargo", &["test"]), true);
87        assert_eq!(capability.allows("cargo", &["test", "--all"]), true);
88        assert_eq!(
89            capability.allows("cargo", &["test", "--all", "--no-fail-fast"]),
90            true
91        );
92        // Wrong first arg.
93        assert_eq!(capability.allows("cargo", &["build"]), false);
94    }
95
96    #[test]
97    fn test_allows_with_mixed_wildcards() {
98        let capability = ProcessExecCapability {
99            command: "docker".to_string(),
100            args: vec!["run".to_string(), "*".to_string(), "**".to_string()],
101        };
102
103        assert_eq!(capability.allows("docker", &["run", "nginx"]), true);
104        assert_eq!(capability.allows("docker", &["run"]), false);
105        assert_eq!(
106            capability.allows("docker", &["run", "ubuntu", "bash"]),
107            true
108        );
109        assert_eq!(
110            capability.allows("docker", &["run", "alpine", "sh", "-c", "echo hello"]),
111            true
112        );
113        // Wrong first arg.
114        assert_eq!(capability.allows("docker", &["ps"]), false);
115    }
116}
117