Skip to content

refactor(policy): use most-specific-pattern-wins evaluation model#3282

Open
laststylebender14 wants to merge 11 commits into
mainfrom
fix/policy-most-specific-wins
Open

refactor(policy): use most-specific-pattern-wins evaluation model#3282
laststylebender14 wants to merge 11 commits into
mainfrom
fix/policy-most-specific-wins

Conversation

@laststylebender14
Copy link
Copy Markdown
Contributor

@laststylebender14 laststylebender14 commented May 7, 2026

fixes: #3085

@github-actions github-actions Bot added the type: refactor Code refactoring and restructuring. label May 7, 2026
@laststylebender14 laststylebender14 marked this pull request as ready for review May 7, 2026 08:31
amitksingh1490
amitksingh1490 previously approved these changes May 12, 2026
/// Returns the max specificity across child rules.
pub fn specificity(&self) -> usize {
match self {
Policy::Simple { permission: _, rule } => rule.specificity(),
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is Simple?

@amitksingh1490 amitksingh1490 dismissed their stale review May 12, 2026 16:15

need some changes

@amitksingh1490
Copy link
Copy Markdown
Contributor

this test will fail

#[test]
fn test_policy_engine_composite_specificity_ignores_non_matching_child() {
    let fixture_workflow = PolicyConfig::new()
        .add_policy(Policy::Any {
            any: vec![
                Policy::Simple {
                    permission: Permission::Allow,
                    rule: Rule::Write(WriteRule { write: "*.rs".to_string(), dir: None }),
                },
                Policy::Simple {
                    permission: Permission::Allow,
                    rule: Rule::Write(WriteRule {
                        write: "very/specific/path/that/does/not/match/*.rs".to_string(),
                        dir: None,
                    }),
                },
            ],
        })
        .add_policy(Policy::Simple {
            permission: Permission::Deny,
            rule: Rule::Write(WriteRule { write: "test.rs".to_string(), dir: None }),
        });
    let fixture = PolicyEngine::new(&fixture_workflow);
    let operation = PermissionOperation::Write {
        path: std::path::PathBuf::from("test.rs"),
        cwd: std::path::PathBuf::from("/test/cwd"),
        message: "Create/overwrite file: test.rs".to_string(),
    };

    let actual = fixture.can_perform(&operation);
    let expected = Permission::Deny;

    assert_eq!(actual, expected);
}

@github-actions
Copy link
Copy Markdown

Action required: PR inactive for 5 days.
Status update or closure in 10 days.

@github-actions github-actions Bot added the state: inactive No current action needed/possible; issue fixed, out of scope, or superseded. label May 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

state: inactive No current action needed/possible; issue fixed, out of scope, or superseded. type: refactor Code refactoring and restructuring.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Tool Permission Allow-Deny Pattern is Contradictory

2 participants