Function validate_policy_safety

crates/openshell-server/src/grpc/validation.rs:622–631

Validate that a policy does not contain unsafe content. Delegates to [`openshell_policy::validate_sandbox_policy`] and converts violations into a gRPC `INVALID_ARGUMENT` status.

(policy: &ProtoSandboxPolicy)

/// Delegates to [`openshell_policy::validate_sandbox_policy`] and converts
/// violations into a gRPC `INVALID_ARGUMENT` status.
pub(super) fn validate_policy_safety(policy: &ProtoSandboxPolicy) -> Result<(), Status> {
    if let Err(violations) = openshell_policy::validate_sandbox_policy(policy) {
        let messages: Vec<String> = violations.iter().map(ToString::to_string).collect();
        return Err(Status::invalid_argument(format!(
            "policy contains unsafe content: {}",
            messages.join("; ")
        )));
    }
    Ok(())
}

/// Validate that user-authored policy does not use provider-derived rule keys.
pub(super) fn validate_no_reserved_provider_policy_keys(