bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-13 22:37:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Enforce trusted-agent policy conditions (#72)

Browse source
This commit is contained in:
lazyGPT07 2026-06-13 23:44:00 -06:00 • committed by GitHub
parent 8f4691584c
commit 7d6a033b41
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 32 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

28
packages/account-core/src/index.test.ts
View file

@ -41,6 +41,34 @@ describe("account-core", () => {
expect(result.decision).toBe("approval_required"); expect(result.decision).toBe("approval_required");
}); });
it.each([
{ principal: { type: "agent" as const, id: "trusted-agent", trusted: true }, expected: "allow" },
{ principal: { type: "agent" as const, id: "untrusted-agent", trusted: false }, expected: "approval_required" },
{ principal: undefined, expected: "approval_required" }
])("enforces trusted-agent policies for $expected decisions", ({ principal, expected }) => {
const result = evaluateAccountPolicy({
action: "social:profile:read",
principal,
grant: {
id: "grant_trusted_agent",
accountId: "account_1",
principal: { type: "agent", id: "trusted-agent" },
permissions: ["social:profile:read"],
policy: [
{
id: "trusted_read",
resource: "social:profile",
action: "social:profile:read",
default: "allow_if_trusted_agent"
}
],
createdAt: new Date(0).toISOString()
}
});
expect(result.decision).toBe(expected);
});
it("redacts secret-like audit previews", () => { it("redacts secret-like audit previews", () => {
const event = createAccountAuditEvent({ const event = createAccountAuditEvent({
provider: "gmail", provider: "gmail",

6
packages/account-core/src/policy.ts
View file

@ -70,8 +70,10 @@ export function evaluateAccountPolicy(input: LogicSrcPolicyEvaluationInput): Log
if (policy?.default === "approval_required") { if (policy?.default === "approval_required") {
return { decision: "approval_required", riskScore, reason: `policy ${policy.id} requires approval` }; return { decision: "approval_required", riskScore, reason: `policy ${policy.id} requires approval` };
} }
if (policy?.default === "allow_if_trusted_agent" && input.principal?.trusted) { if (policy?.default === "allow_if_trusted_agent") {
return { decision: "allow", riskScore, reason: `policy ${policy.id} allows trusted principal` }; return input.principal?.trusted
? { decision: "allow", riskScore, reason: `policy ${policy.id} allows trusted principal` }
: { decision: "approval_required", riskScore, reason: `policy ${policy.id} requires a trusted principal` };
} }
if (policy?.default === "allow_if_below_risk_score") { if (policy?.default === "allow_if_below_risk_score") {
const maxRiskScore = typeof policy.conditions?.maxRiskScore === "number" ? policy.conditions.maxRiskScore : 0.25; const maxRiskScore = typeof policy.conditions?.maxRiskScore === "number" ? policy.conditions.maxRiskScore : 0.25;