blomios/IdeA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(templates): nom d'agent par défaut + permissions système et MCP outils sur AgentTemplate — #242

Browse Source 
AgentTemplate étendu (defaultAgentName, systemPermissions, mcpToolPermissions),
CreateTemplate/UpdateTemplate/CreateAgentFromTemplate projetés vers l'agent créé,
DTO/MCP tools et persistance store complétés. Correctif modèle par défaut:
UpdateTemplate ne persistait pas defaultProfileId (profil stale à la création
d'agent). Backfill best-effort des templates existants depuis les agents du
projet au open_project, overrides explicites uniquement.
This commit is contained in:
Blomios
2026-08-23 10:59:55 +02:00
parent ed5c5f73d6
commit d6c80be56d
11 changed files with 809 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

114
crates/application/src/template/usecases.rs
View File

@ -13,10 +13,14 @@
use std::sync::Arc;
use domain::ports::{AgentContextStore, EventBus, IdGenerator, StoreError, TemplateStore};
use domain::ports::{
AgentContextStore, EventBus, IdGenerator, McpToolPermissionStore, StoreError,
SystemPermissionStore, TemplateStore,
};
use domain::{
Agent, AgentId, AgentManifest, AgentOrigin, AgentTemplate, DomainEvent, ManifestEntry,
MarkdownDoc, ProfileId, Project, TemplateId, TemplateVersion,
MarkdownDoc, McpToolPolicy, ProfileId, Project, SystemPermissionSet, TemplateId,
TemplateVersion,
};
use crate::agent::unique_md_path;
@ -35,6 +39,12 @@ pub struct CreateTemplateInput {
pub content: String,
/// Default runtime profile for agents created from this template.
pub default_profile_id: ProfileId,
/// Optional default agent name for agents created from this template.
pub default_agent_name: Option<String>,
/// Optional agent-level system permission override applied at creation time.
pub default_system_permissions: Option<SystemPermissionSet>,
/// Optional agent-level MCP tool permission override applied at creation time.
pub default_mcp_tool_policy: Option<McpToolPolicy>,
}
/// Output of [`CreateTemplate::execute`].
@ -69,10 +79,19 @@ impl CreateTemplate {
let id = TemplateId::from_uuid(self.ids.new_uuid());
let template = AgentTemplate::new(
id,
input.name,
input.name.clone(),
MarkdownDoc::new(input.content),
input.default_profile_id,
)
.and_then(|template| {
template.with_metadata(
input.name,
input.default_profile_id,
input.default_agent_name,
input.default_system_permissions,
input.default_mcp_tool_policy,
)
})
.map_err(|e| AppError::Invalid(e.to_string()))?;
self.templates.save(&template).await?;
Ok(CreateTemplateOutput { template })
@ -88,8 +107,21 @@ impl CreateTemplate {
pub struct UpdateTemplateInput {
/// Template to update.
pub template_id: TemplateId,
/// New Markdown content.
pub content: String,
/// New Markdown content. `None` leaves content and version untouched.
pub content: Option<String>,
/// New display name. `None` leaves the current value.
pub name: Option<String>,
/// New default runtime profile. `None` leaves the current value.
pub default_profile_id: Option<ProfileId>,
/// New default agent name. Outer `None` leaves the current value; inner
/// `None` clears the default so agent creation falls back to template name.
pub default_agent_name: Option<Option<String>>,
/// New default system permissions. Outer `None` leaves the current value;
/// inner `None` preserves project inheritance for future agents.
pub default_system_permissions: Option<Option<SystemPermissionSet>>,
/// New default MCP tool policy. Outer `None` leaves the current value; inner
/// `None` preserves project inheritance for future agents.
pub default_mcp_tool_policy: Option<Option<McpToolPolicy>>,
}
/// Output of [`UpdateTemplate::execute`].
@ -123,7 +155,28 @@ impl UpdateTemplate {
input: UpdateTemplateInput,
) -> Result<UpdateTemplateOutput, AppError> {
let current = self.templates.get(input.template_id).await?;
let updated = current.with_updated_content(MarkdownDoc::new(input.content));
let mut updated = if let Some(content) = input.content {
current.with_updated_content(MarkdownDoc::new(content))
} else {
current
};
updated = updated
.with_metadata(
input.name.unwrap_or_else(|| updated.name.clone()),
input
.default_profile_id
.unwrap_or(updated.default_profile_id),
input
.default_agent_name
.unwrap_or_else(|| updated.default_agent_name.clone()),
input
.default_system_permissions
.unwrap_or_else(|| updated.default_system_permissions.clone()),
input
.default_mcp_tool_policy
.unwrap_or_else(|| updated.default_mcp_tool_policy.clone()),
)
.map_err(|e| AppError::Invalid(e.to_string()))?;
self.templates.save(&updated).await?;
self.events.publish(DomainEvent::TemplateUpdated {
template_id: updated.id,
@ -271,6 +324,8 @@ pub struct CreateAgentFromTemplate {
contexts: Arc<dyn AgentContextStore>,
ids: Arc<dyn IdGenerator>,
events: Arc<dyn EventBus>,
system_permissions: Option<Arc<dyn SystemPermissionStore>>,
mcp_tool_permissions: Option<Arc<dyn McpToolPermissionStore>>,
}
impl CreateAgentFromTemplate {
@ -287,9 +342,30 @@ impl CreateAgentFromTemplate {
contexts,
ids,
events,
system_permissions: None,
mcp_tool_permissions: None,
}
}
/// Injects the project system permission store used to project template
/// agent overrides at creation time.
#[must_use]
pub fn with_system_permission_store(mut self, store: Arc<dyn SystemPermissionStore>) -> Self {
self.system_permissions = Some(store);
self
}
/// Injects the project MCP tool permission store used to project template
/// agent overrides at creation time.
#[must_use]
pub fn with_mcp_tool_permission_store(
mut self,
store: Arc<dyn McpToolPermissionStore>,
) -> Self {
self.mcp_tool_permissions = Some(store);
self
}
/// Executes creation from a template.
///
/// # Errors
@ -303,7 +379,10 @@ impl CreateAgentFromTemplate {
let template = self.templates.get(input.template_id).await?;
let manifest = self.contexts.load_manifest(&input.project).await?;
let name = input.name.unwrap_or_else(|| template.name.clone());
let name = input
.name
.or_else(|| template.default_agent_name.clone())
.unwrap_or_else(|| template.name.clone());
let id = AgentId::from_uuid(self.ids.new_uuid());
let md_path = unique_md_path(&name, &manifest);
let origin = AgentOrigin::FromTemplate {
@ -333,6 +412,27 @@ impl CreateAgentFromTemplate {
.write_context(&input.project, &agent.id, &template.content_md)
.await?;
if let Some(permissions) = template.default_system_permissions.clone() {
if let Some(store) = &self.system_permissions {
let mut doc = store.load_system_permissions(&input.project).await?;
doc.set_agent_permissions(agent.id, Some(permissions));
store.save_system_permissions(&input.project, &doc).await?;
}
}
if let Some(policy) = template.default_mcp_tool_policy.clone() {
if let Some(store) = &self.mcp_tool_permissions {
let mut doc = store.load_mcp_tool_permissions(&input.project).await?;
doc.agents
.retain(|override_| override_.agent_id != agent.id);
doc.agents
.push(domain::AgentMcpToolPolicyOverride::new(agent.id, policy));
store
.save_mcp_tool_permissions(&input.project, &doc)
.await?;
}
}
self.events.publish(DomainEvent::LayoutChanged {
project_id: input.project.id,
});

194
crates/application/tests/template_usecases.rs
View File

@ -10,10 +10,15 @@ use domain::events::DomainEvent;
use domain::ids::{AgentId, ProfileId, ProjectId, TemplateId};
use domain::markdown::MarkdownDoc;
use domain::ports::{
AgentContextStore, EventBus, EventStream, IdGenerator, StoreError, TemplateStore,
AgentContextStore, EventBus, EventStream, IdGenerator, McpToolPermissionStore, StoreError,
SystemPermissionStore, TemplateStore,
};
use domain::template::{AgentTemplate, TemplateVersion};
use domain::{AgentManifest, ManifestEntry, Project, ProjectPath, RemoteRef};
use domain::{
AgentManifest, AgentMcpToolPolicyOverride, AgentSystemPermissionOverride, ManifestEntry,
McpToolPolicy, NetworkPolicy, Project, ProjectMcpToolPermissions, ProjectPath,
ProjectSystemPermissions, RemoteRef, SystemPermissionSet,
};
use uuid::Uuid;
use application::{
@ -147,6 +152,62 @@ impl SeqIds {
Self(Mutex::new(1))
}
}
#[derive(Clone)]
struct FakeSystemPermissions(Arc<Mutex<ProjectSystemPermissions>>);
impl Default for FakeSystemPermissions {
fn default() -> Self {
Self(Arc::new(Mutex::new(ProjectSystemPermissions::default())))
}
}
#[async_trait]
impl SystemPermissionStore for FakeSystemPermissions {
async fn load_system_permissions(
&self,
_project: &Project,
) -> Result<ProjectSystemPermissions, StoreError> {
Ok(self.0.lock().unwrap().clone())
}
async fn save_system_permissions(
&self,
_project: &Project,
permissions: &ProjectSystemPermissions,
) -> Result<(), StoreError> {
*self.0.lock().unwrap() = permissions.clone();
Ok(())
}
}
#[derive(Clone)]
struct FakeMcpToolPermissions(Arc<Mutex<ProjectMcpToolPermissions>>);
impl Default for FakeMcpToolPermissions {
fn default() -> Self {
Self(Arc::new(Mutex::new(ProjectMcpToolPermissions::default())))
}
}
#[async_trait]
impl McpToolPermissionStore for FakeMcpToolPermissions {
async fn load_mcp_tool_permissions(
&self,
_project: &Project,
) -> Result<ProjectMcpToolPermissions, StoreError> {
Ok(self.0.lock().unwrap().clone())
}
async fn save_mcp_tool_permissions(
&self,
_project: &Project,
permissions: &ProjectMcpToolPermissions,
) -> Result<(), StoreError> {
*self.0.lock().unwrap() = permissions.clone();
Ok(())
}
}
impl IdGenerator for SeqIds {
fn new_uuid(&self) -> Uuid {
let mut n = self.0.lock().unwrap();
@ -216,6 +277,9 @@ async fn create_template_starts_at_initial_version() {
name: "Backend".to_owned(),
content: "# ctx".to_owned(),
default_profile_id: pid(7),
default_agent_name: None,
default_system_permissions: None,
default_mcp_tool_policy: None,
})
.await
.unwrap();
@ -254,7 +318,12 @@ async fn update_template_bumps_version_and_publishes_event() {
let out = UpdateTemplate::new(Arc::new(store.clone()), Arc::new(bus.clone()))
.execute(UpdateTemplateInput {
template_id: tid(1),
content: "v2".to_owned(),
content: Some("v2".to_owned()),
name: None,
default_profile_id: None,
default_agent_name: None,
default_system_permissions: None,
default_mcp_tool_policy: None,
})
.await
.unwrap();
@ -278,13 +347,74 @@ async fn update_unknown_template_is_not_found() {
)
.execute(UpdateTemplateInput {
template_id: tid(404),
content: "x".to_owned(),
content: Some("x".to_owned()),
name: None,
default_profile_id: None,
default_agent_name: None,
default_system_permissions: None,
default_mcp_tool_policy: None,
})
.await
.unwrap_err();
assert_eq!(err.code(), "NOT_FOUND", "got {err:?}");
}
#[tokio::test]
async fn update_template_updates_default_profile_for_future_agents() {
let store = FakeTemplates::with(vec![template(tid(1), "T", "v1", 1)]);
let updated = UpdateTemplate::new(Arc::new(store.clone()), Arc::new(SpyBus::default()))
.execute(UpdateTemplateInput {
template_id: tid(1),
content: Some("v2".to_owned()),
name: Some("Renamed".to_owned()),
default_profile_id: Some(pid(42)),
default_agent_name: Some(Some("Agent Name".to_owned())),
default_system_permissions: Some(Some(SystemPermissionSet::new(Some(
NetworkPolicy::Deny,
)))),
default_mcp_tool_policy: Some(Some(McpToolPolicy {
allowed_tools: vec!["idea_template_read".to_owned()],
})),
})
.await
.unwrap()
.template;
assert_eq!(updated.name, "Renamed");
assert_eq!(updated.default_profile_id, pid(42));
assert_eq!(updated.default_agent_name.as_deref(), Some("Agent Name"));
assert_eq!(
updated.default_system_permissions,
Some(SystemPermissionSet::new(Some(NetworkPolicy::Deny)))
);
assert_eq!(
updated.default_mcp_tool_policy,
Some(McpToolPolicy {
allowed_tools: vec!["idea_template_read".to_owned()]
})
);
let contexts = FakeContexts::new(vec![]);
let out = CreateAgentFromTemplate::new(
Arc::new(store),
Arc::new(contexts),
Arc::new(SeqIds::new()),
Arc::new(SpyBus::default()),
)
.execute(CreateAgentFromTemplateInput {
project: project(),
template_id: tid(1),
name: None,
synchronized: true,
})
.await
.unwrap();
assert_eq!(out.agent.name, "Agent Name");
assert_eq!(out.agent.profile_id, pid(42));
}
// ---------------------------------------------------------------------------
// CreateAgentFromTemplate
// ---------------------------------------------------------------------------
@ -327,6 +457,62 @@ async fn create_agent_from_template_links_origin_and_seeds_context() {
assert_eq!(contexts.manifest().entries.len(), 1);
}
#[tokio::test]
async fn create_agent_from_template_projects_template_permission_overrides() {
let mut template = template(tid(1), "Backend Template", "# body", 1);
template = template
.with_metadata(
"Backend Template".to_owned(),
pid(7),
Some("Backend".to_owned()),
Some(SystemPermissionSet::new(Some(NetworkPolicy::Allow))),
Some(McpToolPolicy {
allowed_tools: vec!["idea_template_read".to_owned()],
}),
)
.unwrap();
let store = FakeTemplates::with(vec![template]);
let contexts = FakeContexts::new(vec![]);
let system_permissions = FakeSystemPermissions::default();
let mcp_tool_permissions = FakeMcpToolPermissions::default();
let out = CreateAgentFromTemplate::new(
Arc::new(store),
Arc::new(contexts),
Arc::new(SeqIds::new()),
Arc::new(SpyBus::default()),
)
.with_system_permission_store(Arc::new(system_permissions.clone()))
.with_mcp_tool_permission_store(Arc::new(mcp_tool_permissions.clone()))
.execute(CreateAgentFromTemplateInput {
project: project(),
template_id: tid(1),
name: None,
synchronized: true,
})
.await
.unwrap();
assert_eq!(out.agent.name, "Backend");
assert_eq!(out.agent.profile_id, pid(7));
assert_eq!(
system_permissions.0.lock().unwrap().agents,
vec![AgentSystemPermissionOverride::new(
out.agent.id,
SystemPermissionSet::new(Some(NetworkPolicy::Allow))
)]
);
assert_eq!(
mcp_tool_permissions.0.lock().unwrap().agents,
vec![AgentMcpToolPolicyOverride::new(
out.agent.id,
McpToolPolicy {
allowed_tools: vec!["idea_template_read".to_owned()]
}
)]
);
}
// ---------------------------------------------------------------------------
// DetectAgentDrift
// ---------------------------------------------------------------------------