Function from_proto

crates/openshell-policy/src/lib.rs:786–918

(policy: &SandboxPolicy)

// ---------------------------------------------------------------------------

fn from_proto(policy: &SandboxPolicy) -> PolicyFile {
    let filesystem_policy = policy.filesystem.as_ref().map(|fs| FilesystemDef {
        include_workdir: fs.include_workdir,
        read_only: fs.read_only.clone(),
        read_write: fs.read_write.clone(),
    });

    let landlock = policy.landlock.as_ref().map(|ll| LandlockDef {
        compatibility: ll.compatibility.clone(),
    });

    let process = policy.process.as_ref().and_then(|p| {
        if p.run_as_user.is_empty() && p.run_as_group.is_empty() {
            None
        } else {
            Some(ProcessDef {
                run_as_user: p.run_as_user.clone(),
                run_as_group: p.run_as_group.clone(),
            })
        }
    });

    let network_policies = policy
        .network_policies
        .iter()
        .map(|(key, rule)| {
            let yaml_rule = NetworkPolicyRuleDef {
                name: rule.name.clone(),
                endpoints: rule
                    .endpoints
                    .iter()
                    .map(|e| {
                        // Use compact form: if ports has exactly 1 element,
                        // emit port (scalar). If >1, emit ports (array).
                        // Proto uses u32; YAML uses u16. Clamp at boundary.
                        let clamp = |v: u32| -> u16 { v.min(65535) as u16 };
                        let (port, ports) = if e.ports.len() > 1 {
                            (0, e.ports.iter().map(|&p| clamp(p)).collect())
                        } else {
                            (clamp(e.ports.first().copied().unwrap_or(e.port)), vec![])
                        };
                        let protocol = e.protocol.clone();
                        let mcp_allow_all_known_mcp_methods = !is_mcp_protocol(&protocol)
                            || e.mcp
                                .as_ref()
                                .and_then(|options| options.allow_all_known_mcp_methods)
                                .unwrap_or(false);
                        let rules = e
                            .rules
                            .iter()
                            .map(|r| L7RuleDef {
                                allow: allow_proto_to_def(
                                    &protocol,
                                    r.allow.clone().unwrap_or_default(),
                                    mcp_allow_all_known_mcp_methods,
                                ),
                            })
                            .collect();