Function parse_policy_str

crates/openshell-prover/src/policy.rs:348–415

Parse a policy YAML string into a [`PolicyModel`].

(yaml: &str)

/// Parse a policy YAML string into a [`PolicyModel`].
pub fn parse_policy_str(yaml: &str) -> Result<PolicyModel> {
    let raw: PolicyFile = serde_yml::from_str(yaml)
        .into_diagnostic()
        .wrap_err("parsing policy YAML")?;

    let fs = match raw.filesystem_policy {
        Some(fs_def) => FilesystemPolicy {
            include_workdir: fs_def.include_workdir,
            read_only: fs_def.read_only,
            read_write: fs_def.read_write,
        },
        None => FilesystemPolicy::default(),
    };

    let mut network_policies = BTreeMap::new();
    if let Some(np) = raw.network_policies {
        for (key, rule_raw) in np {
            let endpoints = rule_raw
                .endpoints
                .into_iter()
                .map(|ep_raw| {
                    let rules = ep_raw
                        .rules
                        .into_iter()
                        .map(|r| L7Rule {
                            method: r.allow.method,
                            path: r.allow.path,
                            command: r.allow.command,
                        })
                        .collect();
                    Endpoint {
                        host: ep_raw.host,
                        port: ep_raw.port,
                        ports: ep_raw.ports,
                        protocol: ep_raw.protocol,
                        tls: ep_raw.tls,
                        enforcement: ep_raw.enforcement,
                        access: ep_raw.access,
                        rules,
                        allowed_ips: ep_raw.allowed_ips,
                    }
                })
                .collect();

            let binaries = rule_raw
                .binaries
                .into_iter()
                .map(|b| Binary { path: b.path })
                .collect();

            let name = rule_raw.name.unwrap_or_else(|| key.clone());
            network_policies.insert(
                key,
                NetworkPolicyRule {
                    name,
                    endpoints,
                    binaries,
                },