Policy Compilation

[package]
name = "policy-inspector"
version = "0.1.0"
edition = "2021"

[workspace]

[dependencies]
chio-policy = { git = "https://github.com/backbay-labs/chio", rev = "5b8bec41d32f3838b880576fe6123c983ecebf8d" }
serde_json = "1"

use chio_policy::{compile_policy_with_source, resolve_from_path};
use serde_json::{json, Value};
use std::{error::Error, path::Path};

/// Inspect compiler output. This does not issue a capability or invoke a tool.
pub fn inspect(path: &Path) -> Result<Value, Box<dyn Error>> {
    let policy = resolve_from_path(path)?;
    let compiled = compile_policy_with_source(&policy, Some(path))?;
    Ok(json!({
        "guard_names": compiled.guard_names,
        "output_hooks": compiled.post_invocation.len(),
        "default_scope": compiled.default_scope,
        "threshold_approval": compiled.threshold_approval.is_some()
    }))
}

use std::{env, path::Path, process::ExitCode};

fn main() -> ExitCode {
    let args: Vec<_> = env::args_os().skip(1).collect();
    if args.len() != 1 {
        eprintln!("Usage: policy-inspector <policy.yaml>");
        return ExitCode::from(2);
    }
    match policy_inspector::inspect(Path::new(&args[0])) {
        Ok(output) => match serde_json::to_string_pretty(&output) {
            Ok(text) => {
                println!("{text}");
                ExitCode::SUCCESS
            }
            Err(error) => {
                eprintln!("Could not serialize compiler output: {error}");
                ExitCode::FAILURE
            }
        },
        Err(error) => {
            eprintln!("Could not compile policy: {error}");
            ExitCode::FAILURE
        }
    }
}

use chio_policy::{
    compile_policy, resolve_from_path, resolve_from_path_with_limits, HushSpec, ResolveLimits,
};
use policy_inspector::inspect;
use serde_json::json;
use std::path::Path;

#[test]
fn inherited_policy_builds_both_pipelines_and_one_grant() {
    let out = inspect(Path::new("policies/policy.yaml")).unwrap();
    assert_eq!(out["guard_names"], json!(["mcp-tool", "secret-leak"]));
    assert_eq!(out["output_hooks"], 1);
    assert_eq!(out["threshold_approval"], false);
    let grants = out["default_scope"]["grants"].as_array().unwrap();
    assert_eq!(grants.len(), 1);
    assert_eq!(grants[0]["server_id"], "*");
    assert_eq!(grants[0]["tool_name"], "count_words");
    assert_eq!(grants[0]["constraints"].as_array().unwrap().len(), 1);
}

#[test]
fn stricter_policy_preserves_secret_checks_and_adds_a_constraint() {
    let original = inspect(Path::new("policies/policy.yaml")).unwrap();
    let strict = inspect(Path::new("policies/attested.yaml")).unwrap();
    assert_eq!(strict["guard_names"], original["guard_names"]);
    assert_eq!(strict["output_hooks"], 1);
    let policy = resolve_from_path("policies/attested.yaml").unwrap();
    let tool_access = policy.rules.unwrap().tool_access.unwrap();
    assert_eq!(tool_access.max_args_size, Some(2048));
    assert_eq!(
        strict["default_scope"]["grants"][0]["constraints"]
            .as_array()
            .unwrap()
            .len(),
        2
    );
    assert_ne!(strict["default_scope"], original["default_scope"]);
}

#[test]
fn empty_allowlist_emits_no_default_grants() {
    let out = inspect(Path::new("policies/blocked.yaml")).unwrap();
    assert_eq!(out["default_scope"], json!({}));
    let policy = resolve_from_path("policies/blocked.yaml").unwrap();
    assert!(compile_policy(&policy)
        .unwrap()
        .default_scope
        .grants
        .is_empty());
    assert_eq!(out["guard_names"], json!(["mcp-tool", "secret-leak"]));
    assert_eq!(out["output_hooks"], 1);
}

#[test]
fn child_rule_replaces_the_entire_parent_block() {
    let parent = HushSpec::parse(include_str!("../policies/base.yaml")).unwrap();
    let child =
        HushSpec::parse("hushspec: '0.1.0'\nrules:\n  tool_access:\n    allow: [count_words]\n")
            .unwrap();
    let merged = chio_policy::merge(&parent, &child);
    assert_eq!(
        merged.rules.unwrap().tool_access.unwrap().max_args_size,
        None
    );
}

#[test]
fn depth_limit_counts_the_starting_document() {
    let error = resolve_from_path_with_limits(
        "policies/policy.yaml",
        ResolveLimits {
            max_document_bytes: 4096,
            max_extends_depth: 1,
        },
    )
    .unwrap_err();
    assert!(error.to_string().contains("maximum depth 1"));
}

#[test]
fn document_size_limit_rejects_before_compilation() {
    let error = resolve_from_path_with_limits(
        "policies/base.yaml",
        ResolveLimits {
            max_document_bytes: 8,
            max_extends_depth: 32,
        },
    )
    .unwrap_err();
    assert!(error
        .to_string()
        .contains("exceeding maximum document size 8"));
}

#[test]
fn invalid_version_is_rejected_by_the_compiler() {
    let policy = resolve_from_path("policies/invalid.yaml").unwrap();
    assert!(compile_policy(&policy)
        .err()
        .unwrap()
        .to_string()
        .contains("unsupported hushspec version"));
}

#[test]
fn missing_tool_access_is_a_wildcard_not_a_denial() {
    let policy = HushSpec::parse("hushspec: '0.1.0'\n").unwrap();
    let compiled = compile_policy(&policy).unwrap();
    assert!(compiled.guard_names.is_empty());
    assert_eq!(compiled.default_scope.grants.len(), 1);
    assert_eq!(compiled.default_scope.grants[0].tool_name, "*");
}