mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-15 05:09:44 +08:00
Piotr Mlocek
aca0575a50
BREAKING CHANGE: Policy YAML and public policy APIs now use the protobuf-shaped openshell.policy.v1.PolicyDocument contract. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
57 lines
1.6 KiB
Rust
57 lines
1.6 KiB
Rust
// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
//! User-facing policy parse failures must happen before the CLI connects to a
|
|
//! gateway, with enough context to identify the protobuf shape violation.
|
|
|
|
use std::process::Command;
|
|
|
|
#[test]
|
|
fn policy_set_reports_legacy_matcher_shape_before_connecting() {
|
|
let directory = tempfile::tempdir().expect("create temp directory");
|
|
let policy_path = directory.path().join("legacy-policy.yaml");
|
|
std::fs::write(
|
|
&policy_path,
|
|
r"
|
|
version: 1
|
|
network_policies:
|
|
mcp:
|
|
endpoints:
|
|
- host: mcp.example.com
|
|
ports: [443]
|
|
protocol: mcp
|
|
rules:
|
|
- allow:
|
|
method: tools/call
|
|
tool: search_*
|
|
",
|
|
)
|
|
.expect("write legacy policy");
|
|
|
|
let output = Command::new(env!("CARGO_BIN_EXE_openshell"))
|
|
.args([
|
|
"policy",
|
|
"set",
|
|
"test-sandbox",
|
|
"--policy",
|
|
policy_path.to_str().expect("UTF-8 temp path"),
|
|
"--gateway-endpoint",
|
|
"http://127.0.0.1:1",
|
|
"--color",
|
|
"never",
|
|
])
|
|
.output()
|
|
.expect("run openshell policy set");
|
|
|
|
assert!(!output.status.success());
|
|
let stderr = String::from_utf8_lossy(&output.stderr);
|
|
assert!(
|
|
stderr.contains("failed to decode proto-shaped sandbox policy YAML"),
|
|
"unexpected stderr: {stderr}"
|
|
);
|
|
assert!(
|
|
!stderr.contains("127.0.0.1") && !stderr.contains("transport error"),
|
|
"the CLI connected before rejecting the local file: {stderr}"
|
|
);
|
|
}
|