mirror of
https://github.com/openai/codex.git
synced 2026-11-11 21:10:39 +00:00
acrognale-oai
57232f111c
## What changed - Add `application.storage.default_project_parent` and `application.storage.projectless_workspace_root` requirements for new Desktop workspaces. Require absolute paths and reject unknown storage keys. - Apply managed paths to `desktop.defaultProjectParent` and `desktop.projectlessWorkspaceRoot`, overriding local preferences and rejecting writes to managed settings or their containing table while preserving unrelated Desktop settings. - Expose storage requirements through `config/requirements/read` and update generated JSON schemas, TypeScript types, and Python models. ## Testing Add coverage for storage validation, per-setting layer precedence, config overrides, write protection, and requirements API responses. Adjust daemon shutdown test deadlines and TUI test synchronization, paste handling, and future allocation. GitOrigin-RevId: 44b93fe69e6a471c3f485cbf5f9c9ebd34ac3234
74 lines
2.6 KiB
Rust
74 lines
2.6 KiB
Rust
//! Managed application destinations are independent of agent network permissions.
|
|
//! Enabled policies deny unlisted domains and use normal managed TOML precedence.
|
|
|
|
use crate::NetworkDomainPermissionToml;
|
|
use serde::Deserialize;
|
|
use serde::de::Error;
|
|
use std::collections::BTreeMap;
|
|
|
|
#[derive(Deserialize, Debug, Clone, Default, PartialEq, Eq)]
|
|
#[serde(deny_unknown_fields)]
|
|
pub struct ApplicationRequirementsToml {
|
|
pub network: Option<ApplicationNetworkRequirementsToml>,
|
|
// Keep optional storage paths out of config-loading futures' inline state.
|
|
pub storage: Option<Box<crate::ApplicationStorageRequirementsToml>>,
|
|
}
|
|
|
|
#[derive(Debug, Clone, PartialEq, Eq)]
|
|
pub struct ApplicationNetworkRequirementsToml {
|
|
pub enabled: bool,
|
|
pub domains: BTreeMap<String, NetworkDomainPermissionToml>,
|
|
}
|
|
|
|
impl<'de> Deserialize<'de> for ApplicationNetworkRequirementsToml {
|
|
fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
|
|
where
|
|
D: serde::Deserializer<'de>,
|
|
{
|
|
#[derive(Deserialize)]
|
|
#[serde(deny_unknown_fields)]
|
|
struct Network {
|
|
enabled: Option<bool>,
|
|
#[serde(default)]
|
|
domains: BTreeMap<String, NetworkDomainPermissionToml>,
|
|
}
|
|
|
|
let raw = Network::deserialize(deserializer)?;
|
|
let mut domains = BTreeMap::new();
|
|
for (domain, permission) in raw.domains {
|
|
let normalized = domain
|
|
.strip_suffix('.')
|
|
.unwrap_or(&domain)
|
|
.to_ascii_lowercase();
|
|
if normalized.len() > 253
|
|
|| normalized.split('.').any(|label| {
|
|
label.is_empty()
|
|
|| label.len() > 63
|
|
|| !label.starts_with(|c: char| c.is_ascii_alphanumeric())
|
|
|| !label.ends_with(|c: char| c.is_ascii_alphanumeric())
|
|
|| !label
|
|
.bytes()
|
|
.all(|c| c.is_ascii_alphanumeric() || c == b'-')
|
|
})
|
|
{
|
|
return Err(D::Error::custom(
|
|
"application.network.domains requires exact ASCII domain names without URLs, ports, or wildcards",
|
|
));
|
|
}
|
|
if domains.insert(normalized, permission).is_some() {
|
|
return Err(D::Error::custom(format!(
|
|
"duplicate application.network domain after normalization: {domain:?}"
|
|
)));
|
|
}
|
|
}
|
|
Ok(Self {
|
|
enabled: raw.enabled.unwrap_or(true),
|
|
domains,
|
|
})
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
#[path = "application_requirements_tests.rs"]
|
|
mod tests;
|