gestura_core_foundation/
permissions.rs

1//! Permission primitives shared across Gestura core.
2
3use serde::{Deserialize, Serialize};
4
5/// Permission level for tool execution in a session.
6///
7/// This determines whether tools require confirmation before execution.
8#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
9#[serde(rename_all = "lowercase")]
10pub enum PermissionLevel {
11    /// Read-only access - write operations are blocked.
12    Sandbox,
13    /// Ask before write operations (default).
14    #[default]
15    Restricted,
16    /// Full access - no confirmation required.
17    Full,
18}
19
20impl PermissionLevel {
21    /// Parse permission level from a string (case-insensitive).
22    pub fn parse(s: &str) -> Self {
23        match s.to_lowercase().as_str() {
24            "sandbox" => Self::Sandbox,
25            "restricted" => Self::Restricted,
26            "full" => Self::Full,
27            _ => Self::default(),
28        }
29    }
30
31    /// Check if a tool operation is allowed without confirmation.
32    pub fn allows_without_confirmation(&self, is_write_operation: bool) -> bool {
33        match self {
34            Self::Sandbox => !is_write_operation,
35            Self::Restricted => !is_write_operation,
36            Self::Full => true,
37        }
38    }
39
40    /// Check if a tool operation is blocked entirely.
41    pub fn blocks(&self, is_write_operation: bool) -> bool {
42        match self {
43            Self::Sandbox => is_write_operation,
44            Self::Restricted => false,
45            Self::Full => false,
46        }
47    }
48
49    /// Check if a tool operation requires confirmation.
50    pub fn requires_confirmation(&self, is_write_operation: bool) -> bool {
51        match self {
52            Self::Sandbox => false, // blocked, not confirmable
53            Self::Restricted => is_write_operation,
54            Self::Full => false,
55        }
56    }
57}
gestura_core_foundation/permissions.rs

gestura_core_foundation/
permissions.rs
