Expand `access` presets into explicit `rules` in the policy data. This preprocesses the JSON data so Rego only needs to handle explicit rules.
(data: &mut serde_json::Value)
| 1458 | /// |
| 1459 | /// This preprocesses the JSON data so Rego only needs to handle explicit rules. |
| 1460 | pub fn expand_access_presets(data: &mut serde_json::Value) { |
| 1461 | let Some(policies) = data |
| 1462 | .get_mut("network_policies") |
| 1463 | .and_then(|v| v.as_object_mut()) |
| 1464 | else { |
| 1465 | return; |
| 1466 | }; |
| 1467 | |
| 1468 | for (_name, policy) in policies.iter_mut() { |
| 1469 | let Some(endpoints) = policy.get_mut("endpoints").and_then(|v| v.as_array_mut()) else { |
| 1470 | continue; |
| 1471 | }; |
| 1472 | |
| 1473 | for ep in endpoints.iter_mut() { |
| 1474 | let protocol = ep |
| 1475 | .get("protocol") |
| 1476 | .and_then(|v| v.as_str()) |
| 1477 | .unwrap_or("rest"); |
| 1478 | let has_rules = ep |
| 1479 | .get("rules") |
| 1480 | .and_then(|v| v.as_array()) |
| 1481 | .is_some_and(|a| !a.is_empty()); |
| 1482 | let access = ep |
| 1483 | .get("access") |
| 1484 | .and_then(|v| v.as_str()) |
| 1485 | .unwrap_or("") |
| 1486 | .to_string(); |
| 1487 | |
| 1488 | let mcp_allow_all_known_mcp_methods = ep |
| 1489 | .get("mcp_allow_all_known_mcp_methods") |
| 1490 | .and_then(serde_json::Value::as_bool) |
| 1491 | .unwrap_or(false); |
| 1492 | |
| 1493 | if protocol == "mcp" |
| 1494 | && access.is_empty() |
| 1495 | && !has_rules |
| 1496 | && mcp_allow_all_known_mcp_methods |
| 1497 | { |
| 1498 | ep.as_object_mut().unwrap().insert( |
| 1499 | "rules".to_string(), |
| 1500 | serde_json::Value::Array(vec![jsonrpc_rule_json("*")]), |
| 1501 | ); |
| 1502 | continue; |
| 1503 | } |
| 1504 | |
| 1505 | if access.is_empty() { |
| 1506 | continue; |
| 1507 | } |
| 1508 | |
| 1509 | // Don't expand if rules already exist (validation will catch this) |
| 1510 | if has_rules { |
| 1511 | continue; |
| 1512 | } |
| 1513 | |
| 1514 | let rules = if protocol == "graphql" { |
| 1515 | match access.as_str() { |
| 1516 | "read-only" => vec![graphql_rule_json("query")], |
| 1517 | "read-write" => vec![graphql_rule_json("query"), graphql_rule_json("mutation")], |