Function apply_operation

crates/openshell-policy/src/merge.rs:312–379

(
    policy: &mut SandboxPolicy,
    operation: &PolicyMergeOp,
    warnings: &mut Vec<PolicyMergeWarning>,
)

}

fn apply_operation(
    policy: &mut SandboxPolicy,
    operation: &PolicyMergeOp,
    warnings: &mut Vec<PolicyMergeWarning>,
) -> Result<(), PolicyMergeError> {
    match operation {
        PolicyMergeOp::AddRule { rule_name, rule } => {
            add_rule(policy, rule_name, rule, warnings)?;
        }
        PolicyMergeOp::RemoveEndpoint {
            rule_name,
            host,
            port,
        } => {
            remove_endpoint(policy, rule_name.as_deref(), host, *port);
        }
        PolicyMergeOp::RemoveRule { rule_name } => {
            policy.network_policies.remove(rule_name);
        }
        PolicyMergeOp::AddDenyRules {
            host,
            port,
            deny_rules,
        } => {
            let endpoint = find_endpoint_mut(policy, host, *port).ok_or_else(|| {
                PolicyMergeError::EndpointNotFound {
                    host: host.clone(),
                    port: *port,
                }
            })?;
            ensure_method_path_endpoint(endpoint, host, *port)?;
            if endpoint.access.is_empty() && endpoint.rules.is_empty() {
                return Err(PolicyMergeError::EndpointHasNoAllowBase {
                    host: host.clone(),
                    port: *port,
                });
            }
            append_unique_deny_rules(&mut endpoint.deny_rules, deny_rules);
        }
        PolicyMergeOp::AddAllowRules { host, port, rules } => {
            let endpoint = find_endpoint_mut(policy, host, *port).ok_or_else(|| {
                PolicyMergeError::EndpointNotFound {
                    host: host.clone(),
                    port: *port,
                }
            })?;
            ensure_method_path_endpoint(endpoint, host, *port)?;
            expand_existing_access(endpoint, host, *port, warnings)?;
            append_unique_l7_rules(&mut endpoint.rules, rules);
        }
        PolicyMergeOp::RemoveBinary {
            rule_name,
            binary_path,
        } => {
            let should_remove = if let Some(rule) = policy.network_policies.get_mut(rule_name) {
                let original_len = rule.binaries.len();
                rule.binaries.retain(|binary| binary.path != *binary_path);
                original_len != rule.binaries.len() && rule.binaries.is_empty()