openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-07 15:40:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

tests: use permission profile fixtures in config checks

Browse Source
This commit is contained in:
Michael Bolin
2026-04-30 01:49:07 -07:00
parent 86c725348b
commit 2cbbd03783
2 changed files with 37 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
codex-rs/config/src/config_requirements.rs
View File

@@ -1198,8 +1198,7 @@ mod tests {
use codex_execpolicy::Decision;
use codex_execpolicy::Evaluation;
use codex_execpolicy::RuleMatch;
use codex_protocol::protocol::NetworkAccess;
use codex_protocol::protocol::SandboxPolicy;
use codex_protocol::permissions::NetworkSandboxPolicy;
use codex_utils_absolute_path::AbsolutePathBuf;
use codex_utils_absolute_path::AbsolutePathBufGuard;
use pretty_assertions::assert_eq;
@@ -1215,10 +1214,6 @@ mod tests {
)?)
}
fn profile_from_sandbox_policy(sandbox_policy: &SandboxPolicy) -> PermissionProfile {
PermissionProfile::from_legacy_sandbox_policy(sandbox_policy)
}
fn with_unknown_source(toml: ConfigRequirementsToml) -> ConfigRequirementsWithSources {
let ConfigRequirementsToml {
allowed_approval_policies,
@@ -1767,9 +1762,7 @@ allowed_approvals_reviewers = ["user"]
assert_eq!(
requirements
.permission_profile
.can_set(&profile_from_sandbox_policy(
&SandboxPolicy::DangerFullAccess,
)),
.can_set(&PermissionProfile::Disabled),
Err(ConstraintError::InvalidValue {
field_name: "sandbox_mode",
candidate: "DangerFullAccess".into(),
@@ -1914,9 +1907,7 @@ allowed_approvals_reviewers = ["user"]
assert!(
requirements
.permission_profile
.can_set(&profile_from_sandbox_policy(
&SandboxPolicy::new_read_only_policy()
))
.can_set(&PermissionProfile::read_only())
.is_ok()
);
@@ -1999,29 +1990,25 @@ allowed_approvals_reviewers = ["user"]
assert!(
requirements
.permission_profile
.can_set(&profile_from_sandbox_policy(
&SandboxPolicy::new_read_only_policy()
))
.can_set(&PermissionProfile::read_only())
.is_ok()
);
let workspace_write_policy = SandboxPolicy::WorkspaceWrite {
writable_roots: vec![AbsolutePathBuf::from_absolute_path(root)?],
network_access: false,
exclude_tmpdir_env_var: false,
exclude_slash_tmp: false,
};
let workspace_write_profile = PermissionProfile::workspace_write_with(
&[AbsolutePathBuf::from_absolute_path(root)?],
NetworkSandboxPolicy::Restricted,
/*exclude_tmpdir_env_var*/ false,
/*exclude_slash_tmp*/ false,
);
assert!(
requirements
.permission_profile
.can_set(&profile_from_sandbox_policy(&workspace_write_policy))
.can_set(&workspace_write_profile)
.is_ok()
);
assert_eq!(
requirements
.permission_profile
.can_set(&profile_from_sandbox_policy(
&SandboxPolicy::DangerFullAccess,
)),
.can_set(&PermissionProfile::Disabled),
Err(ConstraintError::InvalidValue {
field_name: "sandbox_mode",
candidate: "DangerFullAccess".into(),
@@ -2032,11 +2019,9 @@ allowed_approvals_reviewers = ["user"]
assert_eq!(
requirements
.permission_profile
.can_set(&profile_from_sandbox_policy(
&SandboxPolicy::ExternalSandbox {
network_access: NetworkAccess::Restricted,
}
)),
.can_set(&PermissionProfile::External {
network: NetworkSandboxPolicy::Restricted,
}),
Err(ConstraintError::InvalidValue {
field_name: "sandbox_mode",
candidate: "ExternalSandbox".into(),
@@ -2117,24 +2102,22 @@ allowed_approvals_reviewers = ["user"]
let requirements = ConfigRequirements::try_from(requirements_with_sources)?;
let root = if cfg!(windows) { "C:\\repo" } else { "/repo" };
let workspace_write_policy = SandboxPolicy::WorkspaceWrite {
writable_roots: vec![AbsolutePathBuf::from_absolute_path(root)?],
network_access: false,
exclude_tmpdir_env_var: false,
exclude_slash_tmp: false,
};
let workspace_write_profile = PermissionProfile::workspace_write_with(
&[AbsolutePathBuf::from_absolute_path(root)?],
NetworkSandboxPolicy::Restricted,
/*exclude_tmpdir_env_var*/ false,
/*exclude_slash_tmp*/ false,
);
assert!(
requirements
.permission_profile
.can_set(&profile_from_sandbox_policy(&workspace_write_policy))
.can_set(&workspace_write_profile)
.is_ok()
);
assert_eq!(
requirements
.permission_profile
.can_set(&profile_from_sandbox_policy(
&SandboxPolicy::DangerFullAccess,
)),
.can_set(&PermissionProfile::Disabled),
Err(ConstraintError::InvalidValue {
field_name: "sandbox_mode",
candidate: "DangerFullAccess".into(),
@@ -2165,9 +2148,7 @@ allowed_approvals_reviewers = ["user"]
assert_eq!(
requirements
.permission_profile
.can_set(&profile_from_sandbox_policy(
&SandboxPolicy::DangerFullAccess,
)),
.can_set(&PermissionProfile::Disabled),
Err(ConstraintError::InvalidValue {
field_name: "sandbox_mode",
candidate: "DangerFullAccess".into(),
@@ -2206,9 +2187,7 @@ allowed_approvals_reviewers = ["user"]
assert_eq!(
requirements
.permission_profile
.can_set(&profile_from_sandbox_policy(
&SandboxPolicy::new_workspace_write_policy(),
)),
.can_set(&PermissionProfile::workspace_write()),
Err(ConstraintError::InvalidValue {
field_name: "sandbox_mode",
candidate: "WorkspaceWrite".into(),

29
codex-rs/core/src/config/network_proxy_spec_tests.rs
View File

@@ -5,13 +5,8 @@ use codex_network_proxy::NetworkDomainPermission;
use codex_protocol::models::ManagedFileSystemPermissions;
use codex_protocol::models::PermissionProfile;
use codex_protocol::permissions::NetworkSandboxPolicy;
use codex_protocol::protocol::SandboxPolicy;
use pretty_assertions::assert_eq;
fn permission_profile_for_sandbox_policy(sandbox_policy: &SandboxPolicy) -> PermissionProfile {
PermissionProfile::from_legacy_sandbox_policy(sandbox_policy)
}
fn domain_permissions(
entries: impl IntoIterator<Item = (&'static str, NetworkDomainPermissionToml)>,
) -> NetworkDomainPermissionsToml {
@@ -62,7 +57,7 @@ fn requirements_allowed_domains_are_a_baseline_for_user_allowlist() {
let spec = NetworkProxySpec::from_config_and_constraints(
config,
Some(requirements),
&permission_profile_for_sandbox_policy(&SandboxPolicy::new_read_only_policy()),
&PermissionProfile::read_only(),
)
.expect("config should stay within the managed allowlist");
@@ -97,7 +92,7 @@ fn requirements_allowed_domains_do_not_override_user_denies_for_same_pattern() {
let spec = NetworkProxySpec::from_config_and_constraints(
config,
Some(requirements),
&permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
&PermissionProfile::workspace_write(),
)
.expect("managed allowlist should not erase a user deny");
@@ -129,7 +124,7 @@ fn requirements_allowlist_expansion_keeps_user_entries_mutable() {
let spec = NetworkProxySpec::from_config_and_constraints(
config,
Some(requirements),
&permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
&PermissionProfile::workspace_write(),
)
.expect("managed baseline should still allow user edits");
@@ -207,7 +202,7 @@ fn danger_full_access_keeps_managed_allowlist_and_denylist_fixed() {
let spec = NetworkProxySpec::from_config_and_constraints(
config,
Some(requirements),
&permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
&PermissionProfile::Disabled,
)
.expect("yolo mode should pin the effective policy to the managed baseline");
@@ -241,7 +236,7 @@ fn managed_allowed_domains_only_disables_default_mode_allowlist_expansion() {
let spec = NetworkProxySpec::from_config_and_constraints(
config,
Some(requirements),
&permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
&PermissionProfile::workspace_write(),
)
.expect("managed baseline should still load");
@@ -270,7 +265,7 @@ fn managed_allowed_domains_only_ignores_user_allowlist_and_hard_denies_misses()
let spec = NetworkProxySpec::from_config_and_constraints(
config,
Some(requirements),
&permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
&PermissionProfile::workspace_write(),
)
.expect("managed-only allowlist should still load");
@@ -300,7 +295,7 @@ fn managed_allowed_domains_only_without_managed_allowlist_blocks_all_user_domain
let spec = NetworkProxySpec::from_config_and_constraints(
config,
Some(requirements),
&permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
&PermissionProfile::workspace_write(),
)
.expect("managed-only mode should treat missing managed allowlist as empty");
@@ -324,7 +319,7 @@ fn managed_allowed_domains_only_blocks_all_user_domains_in_full_access_without_m
let spec = NetworkProxySpec::from_config_and_constraints(
config,
Some(requirements),
&permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
&PermissionProfile::Disabled,
)
.expect("managed-only mode should treat missing managed allowlist as empty");
@@ -351,7 +346,7 @@ fn deny_only_requirements_do_not_create_allow_constraints_in_full_access() {
let spec = NetworkProxySpec::from_config_and_constraints(
config,
Some(requirements),
&permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
&PermissionProfile::Disabled,
)
.expect("deny-only requirements should not constrain the allowlist");
@@ -384,7 +379,7 @@ fn allow_only_requirements_do_not_create_deny_constraints_in_full_access() {
let spec = NetworkProxySpec::from_config_and_constraints(
config,
Some(requirements),
&permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
&PermissionProfile::Disabled,
)
.expect("allow-only requirements should not constrain the denylist");
@@ -417,7 +412,7 @@ fn requirements_denied_domains_are_a_baseline_for_default_mode() {
let spec = NetworkProxySpec::from_config_and_constraints(
config,
Some(requirements),
&permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
&PermissionProfile::workspace_write(),
)
.expect("default mode should merge managed and user deny entries");
@@ -452,7 +447,7 @@ fn requirements_denylist_expansion_keeps_user_entries_mutable() {
let spec = NetworkProxySpec::from_config_and_constraints(
config,
Some(requirements),
&permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
&PermissionProfile::workspace_write(),
)
.expect("managed baseline should still allow user edits");