Class: Lemans::NetworkPolicy

Inherits:
Object
  • Object
show all
Defined in:
lib/lemans/network_policy.rb

Overview

What a phase is allowed to reach. Every phase names its policy explicitly:

network: { mode: allowlist, hosts: [openrouter.ai, "*.example.com", 10.0.0.0/8] }

Constant Summary collapse

MODES = 
%i[none allowlist public].freeze

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(mode:, hosts: [], field: "network") ⇒ NetworkPolicy

Returns a new instance of NetworkPolicy.

Raises:



22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
 
# File 'lib/lemans/network_policy.rb', line 22

def initialize(mode:, hosts: [], field: "network")
  unless MODES.include?(mode)
    raise ConfigError,
          "#{field}.mode: #{mode.inspect} is not one of #{MODES.join(", ")}"
  end

  raise ConfigError, "#{field}.hosts must be a list" unless hosts.is_a?(Array)
  if mode != :allowlist && !hosts.empty?
    raise ConfigError,
          "#{field}.hosts is only meaningful with mode: allowlist"
  end

  raise ConfigError, "#{field}.hosts cannot be empty with mode: allowlist" if mode == :allowlist && hosts.empty?

  hosts = validated_hosts(hosts, field)

  @mode = mode
  @hosts = hosts.freeze
  # Split once, at construction: backends allowlist domains and IP ranges
  # through separate APIs, and a bad entry must fail here, loudly — a
  # malformed allowlist must never launch a sandbox open.
  @ip_targets, @domains = hosts.partition { ip_target?(_1) }.map(&:freeze)
  freeze
end

Instance Attribute Details

#domains ⇒ Object (readonly)

Returns the value of attribute domains.



11
12
13
 
# File 'lib/lemans/network_policy.rb', line 11

def domains
  @domains
end

#hosts ⇒ Object (readonly)

Returns the value of attribute hosts.



11
12
13
 
# File 'lib/lemans/network_policy.rb', line 11

def hosts
  @hosts
end

#ip_targets ⇒ Object (readonly)

Returns the value of attribute ip_targets.



11
12
13
 
# File 'lib/lemans/network_policy.rb', line 11

def ip_targets
  @ip_targets
end

#mode ⇒ Object (readonly)

Returns the value of attribute mode.



11
12
13
 
# File 'lib/lemans/network_policy.rb', line 11

def mode
  @mode
end

Class Method Details

.from_config(config, field:) ⇒ Object

Raises:



13
14
15
16
17
18
 
# File 'lib/lemans/network_policy.rb', line 13

def self.from_config(config, field:)
  raise ConfigError, "#{field}: network policy is required" if config.nil?

  mode = config["mode"] or raise ConfigError, "#{field}.mode is required (#{MODES.join(", ")})"
  new(mode: mode.to_s.to_sym, hosts: config["hosts"] || [], field: field)
end

.none ⇒ Object 



20
 
# File 'lib/lemans/network_policy.rb', line 20

def self.none = new(mode: :none)

Instance Method Details

#to_h ⇒ Object 



47
 
# File 'lib/lemans/network_policy.rb', line 47

def to_h = { mode: mode, hosts: hosts }