Ilker ManapandClaude Opus 5.5
13e6f19301
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
85 lines
2.8 KiB
Go
85 lines
2.8 KiB
Go
package cli
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/spf13/cobra"
|
|
|
|
"gitea.mynodes.xyz/ilker/llmgw/internal/control/adminapi"
|
|
)
|
|
|
|
func newGuardCmd(client func() *ctlClient, asJSON *bool) *cobra.Command {
|
|
c := &cobra.Command{
|
|
Use: "guard",
|
|
Short: "Guardrail policies: which apply where",
|
|
Long: "Policies are defined in server.yaml under guard.policies — what requests and\n" +
|
|
"answers are checked for (personal data, secrets, prompt injection, patterns,\n" +
|
|
"tools) and what is done: flag, redact or block. guard.default applies to\n" +
|
|
"every request; attach others to an organization, team, project, user or\n" +
|
|
"key, and everything below is judged by them too. Policies narrow: one\n" +
|
|
"attached lower can tighten, never loosen, what applies above it.\n\n" +
|
|
"Targets are written org:Acme, team:Acme/ml, project:Acme/ml/training (or\n" +
|
|
"with IDs), key:KEY-ID or user:USER-ID. An attachment applies at once.",
|
|
}
|
|
c.AddCommand(&cobra.Command{
|
|
Use: "list",
|
|
Short: "The policies, and where each is attached",
|
|
Args: cobra.NoArgs,
|
|
RunE: func(cmd *cobra.Command, _ []string) error {
|
|
var v adminapi.GuardView
|
|
if err := client().get(cmd.Context(), "/api/v1/guard", &v); err != nil {
|
|
return err
|
|
}
|
|
if *asJSON {
|
|
return json.NewEncoder(cmd.OutOrStdout()).Encode(v)
|
|
}
|
|
out := cmd.OutOrStdout()
|
|
fmt.Fprintf(out, "Policies: %s\n", strings.Join(v.Policies, ", "))
|
|
def := strings.Join(v.Default, ", ")
|
|
if def == "" {
|
|
def = "none"
|
|
}
|
|
fmt.Fprintf(out, "Applied to every request: %s\n", def)
|
|
if len(v.Attachments) == 0 {
|
|
fmt.Fprintln(out, "Attached nowhere else.")
|
|
return nil
|
|
}
|
|
fmt.Fprintln(out)
|
|
w := tab()
|
|
fmt.Fprintln(w, "SCOPE\tWHO\tPOLICY")
|
|
for _, a := range v.Attachments {
|
|
who := a.ScopeID
|
|
if a.Name != "" {
|
|
who = a.Name + " (" + a.ScopeID + ")"
|
|
}
|
|
fmt.Fprintf(w, "%s\t%s\t%s\n", a.Scope, who, a.Policy)
|
|
}
|
|
return w.Flush()
|
|
},
|
|
})
|
|
for _, verb := range []struct {
|
|
use, short, method, done string
|
|
}{
|
|
{"attach", "Apply a policy to a scope and everything below it", "POST", "attached to"},
|
|
{"detach", "Stop applying a policy to a scope", "DELETE", "detached from"},
|
|
} {
|
|
c.AddCommand(&cobra.Command{
|
|
Use: verb.use + " TARGET POLICY",
|
|
Short: verb.short,
|
|
Example: " llmgw ctl guard " + verb.use + " project:Acme/finance/payroll finance",
|
|
Args: cobra.ExactArgs(2),
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
body, _ := json.Marshal(map[string]string{"target": args[0], "policy": args[1]})
|
|
if err := client().do(cmd.Context(), verb.method, "/api/v1/guard/attachments", json.RawMessage(body), nil); err != nil {
|
|
return err
|
|
}
|
|
fmt.Fprintf(cmd.OutOrStdout(), "%s %s %s\n", args[1], verb.done, args[0])
|
|
return nil
|
|
},
|
|
})
|
|
}
|
|
return c
|
|
}
|