Skip to content
Kward Search API index

Class: Kward::Sandbox::Policy

Inherits:
Object
  • Object
show all
Defined in:
lib/kward/sandbox/policy.rb

Overview

Immutable, user-configured restrictions for a command worker.

Constant Summary collapse

MODES = 
%w[off read_only workspace_write].freeze
NETWORK_MODES = 
%w[deny allow].freeze

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(mode: "off", network: "deny", workspace_root:, writable_roots: [], protect_git_metadata: true) ⇒ Policy

Returns a new instance of Policy.



13
14
15
16
17
18
19
 
# File 'lib/kward/sandbox/policy.rb', line 13

def initialize(mode: "off", network: "deny", workspace_root:, writable_roots: [], protect_git_metadata: true)
  @mode = normalize_mode(mode)
  @network = normalize_network(network)
  @workspace_root = canonical_path(workspace_root)
  @writable_roots = normalize_writable_roots(writable_roots)
  @protect_git_metadata = protect_git_metadata != false
end

Instance Attribute Details

#mode ⇒ Object (readonly)

Returns the value of attribute mode.



11
12
13
 
# File 'lib/kward/sandbox/policy.rb', line 11

def mode
  @mode
end

#network ⇒ Object (readonly)

Returns the value of attribute network.



11
12
13
 
# File 'lib/kward/sandbox/policy.rb', line 11

def network
  @network
end

#workspace_root ⇒ Object (readonly)

Returns the value of attribute workspace_root.



11
12
13
 
# File 'lib/kward/sandbox/policy.rb', line 11

def workspace_root
  @workspace_root
end

#writable_roots ⇒ Object (readonly)

Returns the value of attribute writable_roots.



11
12
13
 
# File 'lib/kward/sandbox/policy.rb', line 11

def writable_roots
  @writable_roots
end

Instance Method Details

#child_network_allowed? ⇒ Boolean

Returns:

  • (Boolean) 


37
38
39
 
# File 'lib/kward/sandbox/policy.rb', line 37

def child_network_allowed?
  network == "allow"
end

#command_writable_roots ⇒ Object 



41
42
43
44
45
 
# File 'lib/kward/sandbox/policy.rb', line 41

def command_writable_roots
  return [] unless workspace_write?

  ([workspace_root] + writable_roots).uniq
end

#enabled? ⇒ Boolean

Returns:

  • (Boolean) 


21
22
23
 
# File 'lib/kward/sandbox/policy.rb', line 21

def enabled?
  mode != "off"
end

#protect_git_metadata? ⇒ Boolean

Returns:

  • (Boolean) 


33
34
35
 
# File 'lib/kward/sandbox/policy.rb', line 33

def protect_git_metadata?
  @protect_git_metadata
end

#read_only? ⇒ Boolean

Returns:

  • (Boolean) 


25
26
27
 
# File 'lib/kward/sandbox/policy.rb', line 25

def read_only?
  mode == "read_only"
end

#workspace_write? ⇒ Boolean

Returns:

  • (Boolean) 


29
30
31
 
# File 'lib/kward/sandbox/policy.rb', line 29

def workspace_write?
  mode == "workspace_write"
end