mirror of
https://github.com/openai/codex.git
synced 2026-10-23 04:23:49 +00:00
viyatb-oai
d838ea0f64
## What changed - Define the `network/policyRequest` RPC payloads for associating a network request with a process and returning an `allow`, `deny`, or `ask` decision. - Cover HTTP, HTTPS CONNECT, and SOCKS5 TCP/UDP requests, with shared size limits for callback fields. - Add the backward-compatible `requestPolicyDecisions` remote proxy option so executors can opt in to sending policy decisions to clients. - Re-export the new protocol types from `codex-exec-server`. ## Testing - Verify the request and decision JSON shapes. - Verify that the proxy opt-in is omitted and defaults to `false` for legacy configurations, while an enabled value round-trips. GitOrigin-RevId: 65b0a0723d1abb6e4f504a41d3a0dd41f5f21bf7
76 lines
2.4 KiB
Rust
76 lines
2.4 KiB
Rust
use pretty_assertions::assert_eq;
|
|
|
|
use super::ExecServerNetworkPolicyDecision;
|
|
use super::ExecServerNetworkPolicyRequest;
|
|
use super::ExecServerNetworkProtocol;
|
|
use super::NetworkPolicyRequestParams;
|
|
use super::NetworkPolicyRequestResponse;
|
|
use crate::ProcessId;
|
|
|
|
#[test]
|
|
fn network_policy_request_uses_stable_json_shapes() {
|
|
let request = NetworkPolicyRequestParams {
|
|
process_id: ProcessId::from("process-1"),
|
|
request: ExecServerNetworkPolicyRequest {
|
|
protocol: ExecServerNetworkProtocol::HttpsConnect,
|
|
host: "example.com".to_string(),
|
|
port: 443,
|
|
},
|
|
};
|
|
let request_json = serde_json::json!({
|
|
"processId": "process-1",
|
|
"request": {
|
|
"protocol": "https_connect",
|
|
"host": "example.com",
|
|
"port": 443,
|
|
},
|
|
});
|
|
assert_eq!(
|
|
serde_json::to_value(&request).expect("serialize policy request"),
|
|
request_json
|
|
);
|
|
let decoded_request: NetworkPolicyRequestParams =
|
|
serde_json::from_value(request_json.clone()).expect("deserialize policy request");
|
|
assert_eq!(
|
|
serde_json::to_value(decoded_request).expect("reserialize policy request"),
|
|
request_json
|
|
);
|
|
|
|
let decision = NetworkPolicyRequestResponse {
|
|
decision: ExecServerNetworkPolicyDecision::Allow,
|
|
};
|
|
let decision_json = serde_json::json!({
|
|
"decision": {"type": "allow"},
|
|
});
|
|
assert_eq!(
|
|
serde_json::to_value(&decision).expect("serialize policy decision"),
|
|
decision_json
|
|
);
|
|
assert_eq!(
|
|
serde_json::from_value::<NetworkPolicyRequestResponse>(decision_json)
|
|
.expect("deserialize policy decision"),
|
|
decision
|
|
);
|
|
|
|
for (decision, decision_json) in [
|
|
(
|
|
ExecServerNetworkPolicyDecision::Deny {
|
|
reason: "not_allowed".to_string(),
|
|
},
|
|
serde_json::json!({"type": "deny", "reason": "not_allowed"}),
|
|
),
|
|
(
|
|
ExecServerNetworkPolicyDecision::Ask {
|
|
reason: "not_allowed".to_string(),
|
|
},
|
|
serde_json::json!({"type": "ask", "reason": "not_allowed"}),
|
|
),
|
|
] {
|
|
let response = NetworkPolicyRequestResponse { decision };
|
|
assert_eq!(
|
|
serde_json::to_value(&response).expect("serialize policy decision"),
|
|
serde_json::json!({"decision": decision_json})
|
|
);
|
|
}
|
|
}
|