Repository navigation
Commit b1b8db5
committed
refactor(policy): extract shared L7 endpoint validation
Move L7 endpoint semantic checks into the openshell-policy crate so both
profile lint and the runtime validator share one implementation. This
eliminates drift between the two validation paths.
The shared validator covers 9 checks: unknown protocol, rules/access
mutual exclusivity, JSON-RPC family access rejection, json-rpc requires
rules, non-JSON-RPC protocol requires rules or access, MCP requires
rules when allow_all is false, rules-would-deny-all detection,
deny_rules require protocol, and deny_rules require base allow set.
Changes rules/deny_rules fields to Option<Vec<...>> so absent vs empty
is distinguishable at lint time. Adds is_effectively_empty() to
L7AllowProfile for deny-all detection of allow: {} objects. Makes
rules_would_deny_all MCP-aware by checking tool/params.name selectors
before classifying a rule as deny-all. Adds params field to
L7AllowProfile so MCP tool selectors survive proto round-trip.
Signed-off-by: Grace Smith <[email protected]>
Signed-off-by: Grace Smith <[email protected]>1 parent 9a4f8a8 commit b1b8db5
8 files changed
Lines changed: 1688 additions & 161 deletions
File tree
- crates
- openshell-policy/src
- openshell-providers
- src
- openshell-server/src/grpc
- openshell-supervisor-network/src/l7
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments