Function validate_l7_policies

crates/openshell-supervisor-network/src/l7/mod.rs:939–1455

Validate L7 policy configuration in the loaded OPA data. Returns a list of errors and warnings. Errors should prevent sandbox startup; warnings are logged but don't block.

(data_json: &serde_json::Value)

/// Returns a list of errors and warnings. Errors should prevent sandbox startup;
/// warnings are logged but don't block.
pub fn validate_l7_policies(data_json: &serde_json::Value) -> (Vec<String>, Vec<String>) {
    let mut errors = Vec::new();
    let mut warnings = Vec::new();

    let Some(policies) = data_json
        .get("network_policies")
        .and_then(|v| v.as_object())
    else {
        return (errors, warnings);
    };

    for (name, policy) in policies {
        let Some(endpoints) = policy.get("endpoints").and_then(|v| v.as_array()) else {
            continue;
        };

        for (i, ep) in endpoints.iter().enumerate() {
            let protocol = ep.get("protocol").and_then(|v| v.as_str()).unwrap_or("");
            let l7_protocol = L7Protocol::parse(protocol);
            let jsonrpc_family = l7_protocol.is_some_and(L7Protocol::is_jsonrpc_family);
            let tls = ep.get("tls").and_then(|v| v.as_str()).unwrap_or("");
            let enforcement = ep.get("enforcement").and_then(|v| v.as_str()).unwrap_or("");
            let access = ep.get("access").and_then(|v| v.as_str()).unwrap_or("");
            let has_rules = ep
                .get("rules")
                .and_then(|v| v.as_array())
                .is_some_and(|a| !a.is_empty());
            let websocket_has_graphql_policy =
                protocol == "websocket" && json_endpoint_has_graphql_policy(ep);
            let host = ep.get("host").and_then(|v| v.as_str()).unwrap_or("");
            let endpoint_path = ep.get("path").and_then(|v| v.as_str()).unwrap_or("");

            // Read ports from either "ports" array or scalar "port".
            let ports: Vec<u64> = ep.get("ports").and_then(|v| v.as_array()).map_or_else(
                || {
                    ep.get("port")
                        .and_then(serde_json::Value::as_u64)
                        .filter(|p| *p > 0)
                        .into_iter()
                        .collect()
                },
                |arr| arr.iter().filter_map(serde_json::Value::as_u64).collect(),
            );
            let loc = format!("{name}.endpoints[{i}]");

            if protocol == "mcp" {
                if host.trim().is_empty() {
                    errors.push(format!(
                        "{loc}: protocol mcp requires host; protocol alone is not a wildcard endpoint"
                    ));
                }
                if !ports.iter().any(|port| *port > 0) {
                    errors.push(format!(
                        "{loc}: protocol mcp requires port or ports; protocol alone is not a wildcard endpoint"
                    ));
                }
            }