|
| 1 | +use std::collections::HashSet; |
| 2 | + |
| 3 | +use tracing::debug; |
| 4 | + |
| 5 | +use crate::util::MCP_SERVER_TOOL_DELIMITER; |
| 6 | +use crate::util::pattern_matching::matches_any_pattern; |
| 7 | + |
| 8 | +/// Checks if a tool is allowed based on the agent's allowed_tools configuration. |
| 9 | +/// This function handles both native tools and MCP tools with wildcard pattern support. |
| 10 | +pub fn is_tool_in_allowlist(allowed_tools: &HashSet<String>, tool_name: &str, server_name: Option<&str>) -> bool { |
| 11 | + let filter_patterns = |predicate: fn(&str) -> bool| -> HashSet<String> { |
| 12 | + allowed_tools |
| 13 | + .iter() |
| 14 | + .filter(|pattern| predicate(pattern)) |
| 15 | + .cloned() |
| 16 | + .collect() |
| 17 | + }; |
| 18 | + |
| 19 | + match server_name { |
| 20 | + // Native tool |
| 21 | + None => { |
| 22 | + let patterns = filter_patterns(|p| !p.starts_with('@')); |
| 23 | + debug!("Native patterns: {:?}", patterns); |
| 24 | + let result = matches_any_pattern(&patterns, tool_name); |
| 25 | + debug!("Native tool '{}' permission check result: {}", tool_name, result); |
| 26 | + result |
| 27 | + }, |
| 28 | + // MCP tool |
| 29 | + Some(server) => { |
| 30 | + let patterns = filter_patterns(|p| p.starts_with('@')); |
| 31 | + debug!("MCP patterns: {:?}", patterns); |
| 32 | + |
| 33 | + // Check server-level permission first: @server_name |
| 34 | + let server_pattern = format!("@{}", server); |
| 35 | + debug!("Checking server-level pattern: '{}'", server_pattern); |
| 36 | + if matches_any_pattern(&patterns, &server_pattern) { |
| 37 | + debug!("Server-level permission granted for '{}'", server_pattern); |
| 38 | + return true; |
| 39 | + } |
| 40 | + |
| 41 | + // Check tool-specific permission: @server_name/tool_name |
| 42 | + let tool_pattern = format!("@{}{}{}", server, MCP_SERVER_TOOL_DELIMITER, tool_name); |
| 43 | + debug!("Checking tool-specific pattern: '{}'", tool_pattern); |
| 44 | + let result = matches_any_pattern(&patterns, &tool_pattern); |
| 45 | + debug!("Tool-specific permission result for '{}': {}", tool_pattern, result); |
| 46 | + result |
| 47 | + }, |
| 48 | + } |
| 49 | +} |
| 50 | + |
| 51 | +#[cfg(test)] |
| 52 | +mod tests { |
| 53 | + use std::collections::HashSet; |
| 54 | + |
| 55 | + use super::*; |
| 56 | + |
| 57 | + #[test] |
| 58 | + fn test_native_vs_mcp_separation() { |
| 59 | + let mut allowed = HashSet::new(); |
| 60 | + allowed.insert("fs_*".to_string()); |
| 61 | + allowed.insert("@git".to_string()); |
| 62 | + |
| 63 | + // Native patterns only apply to native tools |
| 64 | + assert!(is_tool_in_allowlist(&allowed, "fs_read", None)); |
| 65 | + assert!(!is_tool_in_allowlist(&allowed, "fs_read", Some("server"))); |
| 66 | + |
| 67 | + // MCP patterns only apply to MCP tools |
| 68 | + assert!(is_tool_in_allowlist(&allowed, "status", Some("git"))); |
| 69 | + assert!(!is_tool_in_allowlist(&allowed, "git", None)); |
| 70 | + } |
| 71 | + |
| 72 | + #[test] |
| 73 | + fn test_mcp_wildcard_patterns() { |
| 74 | + let mut allowed = HashSet::new(); |
| 75 | + allowed.insert("@*quip*".to_string()); |
| 76 | + allowed.insert("@git/read_*".to_string()); |
| 77 | + |
| 78 | + assert!(is_tool_in_allowlist(&allowed, "tool", Some("quip-server"))); |
| 79 | + assert!(is_tool_in_allowlist(&allowed, "read_file", Some("git"))); |
| 80 | + assert!(!is_tool_in_allowlist(&allowed, "write_file", Some("git"))); |
| 81 | + } |
| 82 | +} |
0 commit comments