ValidateProtectionConfig checks the effective posture before any write, so a caller gets a clean error rather than a raw CHECK-constraint violation. Levels are valid-by-construction (they map to a valid threshold ladder), so no threshold-ladder check is needed here.
(c ProtectionConfig)
| 72 | // are valid-by-construction (they map to a valid threshold ladder), so no |
| 73 | // threshold-ladder check is needed here. |
| 74 | func ValidateProtectionConfig(c ProtectionConfig) error { |
| 75 | if !inboundGatePolicyValid(c.InboundGatePolicy) { |
| 76 | return fmt.Errorf("inbound gate policy must be open, allowlist, or domain") |
| 77 | } |
| 78 | if !validOutboundPolicy(c.OutboundGatePolicy) { |
| 79 | return fmt.Errorf("outbound gate policy must be open, allowlist, or domain") |
| 80 | } |
| 81 | if !validScanAction(c.InboundGateAction) { |
| 82 | return fmt.Errorf("inbound gate action must be flag, review, or block") |
| 83 | } |
| 84 | if !validScanAction(c.OutboundGateAction) { |
| 85 | return fmt.Errorf("outbound gate action must be flag, review, or block") |
| 86 | } |
| 87 | if !validSensitivity(c.InboundScanSensitivity) { |
| 88 | return fmt.Errorf("inbound scan sensitivity must be off, low, medium, or high") |
| 89 | } |
| 90 | if !validSensitivity(c.OutboundScanSensitivity) { |
| 91 | return fmt.Errorf("outbound scan sensitivity must be off, low, medium, or high") |
| 92 | } |
| 93 | if len(c.InboundAllowlist) > maxInboundAllowlist { |
| 94 | return fmt.Errorf("inbound allowlist has %d entries, max %d", len(c.InboundAllowlist), maxInboundAllowlist) |
| 95 | } |
| 96 | if len(c.OutboundAllowlist) > maxInboundAllowlist { |
| 97 | return fmt.Errorf("outbound allowlist has %d entries, max %d", len(c.OutboundAllowlist), maxInboundAllowlist) |
| 98 | } |
| 99 | if c.HITLTTLSeconds < 0 { |
| 100 | return fmt.Errorf("holds ttl_seconds must be >= 0") |
| 101 | } |
| 102 | if c.HITLExpirationAction != HITLExpirationApprove && c.HITLExpirationAction != HITLExpirationReject { |
| 103 | return fmt.Errorf("holds on_expiry must be approve or reject") |
| 104 | } |
| 105 | return nil |
| 106 | } |
| 107 | |
| 108 | // UpdateAgentProtection writes the full protection posture for an agent owned by |
| 109 | // userID in a single statement, validating first. It writes the sensitivity |
no test coverage detected