feat(templates): nom d'agent par défaut + permissions système et MCP outils sur AgentTemplate — #242
AgentTemplate étendu (defaultAgentName, systemPermissions, mcpToolPermissions), CreateTemplate/UpdateTemplate/CreateAgentFromTemplate projetés vers l'agent créé, DTO/MCP tools et persistance store complétés. Correctif modèle par défaut: UpdateTemplate ne persistait pas defaultProfileId (profil stale à la création d'agent). Backfill best-effort des templates existants depuis les agents du projet au open_project, overrides explicites uniquement.
This commit is contained in:
@ -10,10 +10,15 @@ use domain::events::DomainEvent;
|
||||
use domain::ids::{AgentId, ProfileId, ProjectId, TemplateId};
|
||||
use domain::markdown::MarkdownDoc;
|
||||
use domain::ports::{
|
||||
AgentContextStore, EventBus, EventStream, IdGenerator, StoreError, TemplateStore,
|
||||
AgentContextStore, EventBus, EventStream, IdGenerator, McpToolPermissionStore, StoreError,
|
||||
SystemPermissionStore, TemplateStore,
|
||||
};
|
||||
use domain::template::{AgentTemplate, TemplateVersion};
|
||||
use domain::{AgentManifest, ManifestEntry, Project, ProjectPath, RemoteRef};
|
||||
use domain::{
|
||||
AgentManifest, AgentMcpToolPolicyOverride, AgentSystemPermissionOverride, ManifestEntry,
|
||||
McpToolPolicy, NetworkPolicy, Project, ProjectMcpToolPermissions, ProjectPath,
|
||||
ProjectSystemPermissions, RemoteRef, SystemPermissionSet,
|
||||
};
|
||||
use uuid::Uuid;
|
||||
|
||||
use application::{
|
||||
@ -147,6 +152,62 @@ impl SeqIds {
|
||||
Self(Mutex::new(1))
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone)]
|
||||
struct FakeSystemPermissions(Arc<Mutex<ProjectSystemPermissions>>);
|
||||
|
||||
impl Default for FakeSystemPermissions {
|
||||
fn default() -> Self {
|
||||
Self(Arc::new(Mutex::new(ProjectSystemPermissions::default())))
|
||||
}
|
||||
}
|
||||
|
||||
#[async_trait]
|
||||
impl SystemPermissionStore for FakeSystemPermissions {
|
||||
async fn load_system_permissions(
|
||||
&self,
|
||||
_project: &Project,
|
||||
) -> Result<ProjectSystemPermissions, StoreError> {
|
||||
Ok(self.0.lock().unwrap().clone())
|
||||
}
|
||||
|
||||
async fn save_system_permissions(
|
||||
&self,
|
||||
_project: &Project,
|
||||
permissions: &ProjectSystemPermissions,
|
||||
) -> Result<(), StoreError> {
|
||||
*self.0.lock().unwrap() = permissions.clone();
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone)]
|
||||
struct FakeMcpToolPermissions(Arc<Mutex<ProjectMcpToolPermissions>>);
|
||||
|
||||
impl Default for FakeMcpToolPermissions {
|
||||
fn default() -> Self {
|
||||
Self(Arc::new(Mutex::new(ProjectMcpToolPermissions::default())))
|
||||
}
|
||||
}
|
||||
|
||||
#[async_trait]
|
||||
impl McpToolPermissionStore for FakeMcpToolPermissions {
|
||||
async fn load_mcp_tool_permissions(
|
||||
&self,
|
||||
_project: &Project,
|
||||
) -> Result<ProjectMcpToolPermissions, StoreError> {
|
||||
Ok(self.0.lock().unwrap().clone())
|
||||
}
|
||||
|
||||
async fn save_mcp_tool_permissions(
|
||||
&self,
|
||||
_project: &Project,
|
||||
permissions: &ProjectMcpToolPermissions,
|
||||
) -> Result<(), StoreError> {
|
||||
*self.0.lock().unwrap() = permissions.clone();
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
impl IdGenerator for SeqIds {
|
||||
fn new_uuid(&self) -> Uuid {
|
||||
let mut n = self.0.lock().unwrap();
|
||||
@ -216,6 +277,9 @@ async fn create_template_starts_at_initial_version() {
|
||||
name: "Backend".to_owned(),
|
||||
content: "# ctx".to_owned(),
|
||||
default_profile_id: pid(7),
|
||||
default_agent_name: None,
|
||||
default_system_permissions: None,
|
||||
default_mcp_tool_policy: None,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
@ -254,7 +318,12 @@ async fn update_template_bumps_version_and_publishes_event() {
|
||||
let out = UpdateTemplate::new(Arc::new(store.clone()), Arc::new(bus.clone()))
|
||||
.execute(UpdateTemplateInput {
|
||||
template_id: tid(1),
|
||||
content: "v2".to_owned(),
|
||||
content: Some("v2".to_owned()),
|
||||
name: None,
|
||||
default_profile_id: None,
|
||||
default_agent_name: None,
|
||||
default_system_permissions: None,
|
||||
default_mcp_tool_policy: None,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
@ -278,13 +347,74 @@ async fn update_unknown_template_is_not_found() {
|
||||
)
|
||||
.execute(UpdateTemplateInput {
|
||||
template_id: tid(404),
|
||||
content: "x".to_owned(),
|
||||
content: Some("x".to_owned()),
|
||||
name: None,
|
||||
default_profile_id: None,
|
||||
default_agent_name: None,
|
||||
default_system_permissions: None,
|
||||
default_mcp_tool_policy: None,
|
||||
})
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert_eq!(err.code(), "NOT_FOUND", "got {err:?}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn update_template_updates_default_profile_for_future_agents() {
|
||||
let store = FakeTemplates::with(vec![template(tid(1), "T", "v1", 1)]);
|
||||
|
||||
let updated = UpdateTemplate::new(Arc::new(store.clone()), Arc::new(SpyBus::default()))
|
||||
.execute(UpdateTemplateInput {
|
||||
template_id: tid(1),
|
||||
content: Some("v2".to_owned()),
|
||||
name: Some("Renamed".to_owned()),
|
||||
default_profile_id: Some(pid(42)),
|
||||
default_agent_name: Some(Some("Agent Name".to_owned())),
|
||||
default_system_permissions: Some(Some(SystemPermissionSet::new(Some(
|
||||
NetworkPolicy::Deny,
|
||||
)))),
|
||||
default_mcp_tool_policy: Some(Some(McpToolPolicy {
|
||||
allowed_tools: vec!["idea_template_read".to_owned()],
|
||||
})),
|
||||
})
|
||||
.await
|
||||
.unwrap()
|
||||
.template;
|
||||
|
||||
assert_eq!(updated.name, "Renamed");
|
||||
assert_eq!(updated.default_profile_id, pid(42));
|
||||
assert_eq!(updated.default_agent_name.as_deref(), Some("Agent Name"));
|
||||
assert_eq!(
|
||||
updated.default_system_permissions,
|
||||
Some(SystemPermissionSet::new(Some(NetworkPolicy::Deny)))
|
||||
);
|
||||
assert_eq!(
|
||||
updated.default_mcp_tool_policy,
|
||||
Some(McpToolPolicy {
|
||||
allowed_tools: vec!["idea_template_read".to_owned()]
|
||||
})
|
||||
);
|
||||
|
||||
let contexts = FakeContexts::new(vec![]);
|
||||
let out = CreateAgentFromTemplate::new(
|
||||
Arc::new(store),
|
||||
Arc::new(contexts),
|
||||
Arc::new(SeqIds::new()),
|
||||
Arc::new(SpyBus::default()),
|
||||
)
|
||||
.execute(CreateAgentFromTemplateInput {
|
||||
project: project(),
|
||||
template_id: tid(1),
|
||||
name: None,
|
||||
synchronized: true,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
assert_eq!(out.agent.name, "Agent Name");
|
||||
assert_eq!(out.agent.profile_id, pid(42));
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// CreateAgentFromTemplate
|
||||
// ---------------------------------------------------------------------------
|
||||
@ -327,6 +457,62 @@ async fn create_agent_from_template_links_origin_and_seeds_context() {
|
||||
assert_eq!(contexts.manifest().entries.len(), 1);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn create_agent_from_template_projects_template_permission_overrides() {
|
||||
let mut template = template(tid(1), "Backend Template", "# body", 1);
|
||||
template = template
|
||||
.with_metadata(
|
||||
"Backend Template".to_owned(),
|
||||
pid(7),
|
||||
Some("Backend".to_owned()),
|
||||
Some(SystemPermissionSet::new(Some(NetworkPolicy::Allow))),
|
||||
Some(McpToolPolicy {
|
||||
allowed_tools: vec!["idea_template_read".to_owned()],
|
||||
}),
|
||||
)
|
||||
.unwrap();
|
||||
let store = FakeTemplates::with(vec![template]);
|
||||
let contexts = FakeContexts::new(vec![]);
|
||||
let system_permissions = FakeSystemPermissions::default();
|
||||
let mcp_tool_permissions = FakeMcpToolPermissions::default();
|
||||
|
||||
let out = CreateAgentFromTemplate::new(
|
||||
Arc::new(store),
|
||||
Arc::new(contexts),
|
||||
Arc::new(SeqIds::new()),
|
||||
Arc::new(SpyBus::default()),
|
||||
)
|
||||
.with_system_permission_store(Arc::new(system_permissions.clone()))
|
||||
.with_mcp_tool_permission_store(Arc::new(mcp_tool_permissions.clone()))
|
||||
.execute(CreateAgentFromTemplateInput {
|
||||
project: project(),
|
||||
template_id: tid(1),
|
||||
name: None,
|
||||
synchronized: true,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
assert_eq!(out.agent.name, "Backend");
|
||||
assert_eq!(out.agent.profile_id, pid(7));
|
||||
assert_eq!(
|
||||
system_permissions.0.lock().unwrap().agents,
|
||||
vec![AgentSystemPermissionOverride::new(
|
||||
out.agent.id,
|
||||
SystemPermissionSet::new(Some(NetworkPolicy::Allow))
|
||||
)]
|
||||
);
|
||||
assert_eq!(
|
||||
mcp_tool_permissions.0.lock().unwrap().agents,
|
||||
vec![AgentMcpToolPolicyOverride::new(
|
||||
out.agent.id,
|
||||
McpToolPolicy {
|
||||
allowed_tools: vec!["idea_template_read".to_owned()]
|
||||
}
|
||||
)]
|
||||
);
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// DetectAgentDrift
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
Reference in New Issue
Block a user