Class: Insika::Policy::Builtin::WorkflowAllowlist

Inherits:
Insika::Policy::Base show all
Defined in:
lib/insika/policy/policy.rb

Overview

Enforcement of the workflows_allow field. Neutral outside :trigger_workflow; denies the turn when the workflow is not in the allowlist.

Instance Method Summary collapse

Methods inherited from Insika::Policy::Base

#id

Instance Method Details

#decide(request) ⇒ Object 



96
97
98
99
100
101
102
103
104
105
 
# File 'lib/insika/policy/policy.rb', line 96

def decide(request)
  command = request.command
  return Decision.allow if command.nil? || command.type != :trigger_workflow

  name = (command.payload[:workflow] || command.payload["workflow"]).to_s
  allow = request.profile.workflows_allow
  return Decision.allow if allow.nil? || Array(allow).map(&:to_s).include?(name)

  Decision.deny(reason: "workflow '#{name}' not in the allowlist of agent '#{request.profile.id}'")
end