blomios/IdeA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(backend): MCP d'édition de templates (#81)

Browse Source 
Ajoute le MCP dédié à l'édition de templates : catalogue et classification
des templates (mcp/templates.rs infrastructure + app-tauri), use cases et
provider (application/template), enforcement de la policy des tools (mod.rs,
server.rs, tools.rs), avec la parité côté chemin OpenAI-compatible
(openai_tools.rs x2).

Lots B1 (catalogue/classification), B2 (use cases/provider) et B3
(enforcement policy) livrés en un seul commit cohérent.

QA vert (seul l'échec de bind loopback #80, connu et non-régression, écarté).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Blomios
2026-07-20 18:45:02 +02:00
parent 448edfc364
commit ef84d5cc49
17 changed files with 1171 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

163
crates/app-tauri/src/openai_tools.rs
View File

@ -14,7 +14,7 @@ use domain::ports::{
ToolSpec,
};
use domain::{AgentId, AgentToolPolicy, IssueRef, McpToolPolicy, Project};
use infrastructure::TicketToolProvider;
use infrastructure::{TemplateToolProvider, TicketToolProvider};
use serde_json::Value;
const PROJECT_ROOT_ARG: &str = "__ideaProjectRoot";
@ -27,6 +27,7 @@ pub struct AppOpenAiToolInvoker {
policies: Arc<dyn AgentToolPolicyStore>,
mcp_tool_permissions: Arc<dyn McpToolPermissionStore>,
ticket_tools: Arc<dyn TicketToolProvider>,
template_tools: Arc<dyn TemplateToolProvider>,
}
/// Proxy injecté avant que l'orchestrateur soit construit, puis lié dans la
@ -83,6 +84,7 @@ impl AppOpenAiToolInvoker {
policies: Arc<dyn AgentToolPolicyStore>,
mcp_tool_permissions: Arc<dyn McpToolPermissionStore>,
ticket_tools: Arc<dyn TicketToolProvider>,
template_tools: Arc<dyn TemplateToolProvider>,
) -> Self {
Self {
orchestrator,
@ -90,6 +92,7 @@ impl AppOpenAiToolInvoker {
policies,
mcp_tool_permissions,
ticket_tools,
template_tools,
}
}
}
@ -170,6 +173,19 @@ impl ToolInvoker for AppOpenAiToolInvoker {
return serde_json::to_string(&value)
.map_err(|e| ToolInvocationError::Execution(format!("JSON ticket tool: {e}")));
}
if infrastructure::orchestrator::mcp::tools::is_template_tool(name) {
let value = self
.template_tools
.handle_template_tool(&project, &requester, name, value)
.await
.map_err(|e| {
let detail =
serde_json::to_string(&e.to_value()).unwrap_or_else(|_| e.to_string());
ToolInvocationError::Execution(detail)
})?;
return serde_json::to_string(&value)
.map_err(|e| ToolInvocationError::Execution(format!("JSON template tool: {e}")));
}
let command = infrastructure::orchestrator::mcp::map_tool_call(name, &value, &requester)
.map_err(|e| match e {
infrastructure::orchestrator::mcp::ToolMapError::UnknownTool(tool) => {
@ -312,7 +328,7 @@ mod tests {
AgentId, AgentMcpToolPolicyOverride, McpToolPolicy, Project, ProjectId,
ProjectMcpToolPermissions, ProjectPath, RemoteRef, StoreError, Workspace,
};
use infrastructure::TicketToolError;
use infrastructure::{TemplateToolError, TicketToolError};
use serde_json::json;
use uuid::Uuid;
@ -436,6 +452,33 @@ mod tests {
}
}
#[derive(Default)]
struct FakeTemplateTools {
calls: Mutex<Vec<(String, String, Value)>>,
}
#[async_trait]
impl TemplateToolProvider for FakeTemplateTools {
async fn handle_template_tool(
&self,
_project: &Project,
requester: &str,
name: &str,
arguments: Value,
) -> Result<Value, TemplateToolError> {
self.calls.lock().unwrap().push((
requester.to_owned(),
name.to_owned(),
arguments.clone(),
));
Ok(json!({
"ok": true,
"requester": requester,
"templateId": arguments.get("templateId").and_then(Value::as_str).unwrap_or_default(),
}))
}
}
fn project() -> Project {
Project::new(
ProjectId::from_uuid(Uuid::from_u128(1)),
@ -484,25 +527,29 @@ mod tests {
let core = backend::BackendCore::build(temp.clone());
let requester = AgentId::from_uuid(Uuid::from_u128(82)).to_string();
let ticket_tools = Arc::new(FakeTicketTools::default());
let template_tools = Arc::new(FakeTemplateTools::default());
let invoker = AppOpenAiToolInvoker::new(
Arc::clone(&core.orchestrator_service),
Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
Arc::new(FakePolicies::default()),
mcp_permissions(ProjectMcpToolPermissions::default()),
ticket_tools.clone(),
template_tools.clone(),
);
invoker
.call(
"idea_ticket_list",
&json!({
PROJECT_ROOT_ARG: "/tmp/project",
REQUESTER_ARG: requester,
})
.to_string(),
)
.await
.expect("read tool must pass the durable read-only policy");
for tool in ["idea_ticket_list", "idea_template_list"] {
invoker
.call(
tool,
&json!({
PROJECT_ROOT_ARG: "/tmp/project",
REQUESTER_ARG: requester,
})
.to_string(),
)
.await
.expect("read tool must pass the durable read-only policy");
}
for (tool, arguments) in [
(
@ -521,6 +568,18 @@ mod tests {
"idea_run_in_background",
json!({ "label": "task", "command": "echo" }),
),
(
"idea_template_create",
json!({ "name": "Base", "content": "body", "defaultProfileId": Uuid::new_v4() }),
),
(
"idea_template_update",
json!({ "templateId": Uuid::new_v4(), "content": "body" }),
),
(
"idea_template_delete",
json!({ "templateId": Uuid::new_v4() }),
),
] {
let mut payload = arguments.as_object().unwrap().clone();
payload.insert(PROJECT_ROOT_ARG.to_owned(), json!("/tmp/project"));
@ -538,6 +597,13 @@ mod tests {
let calls = ticket_tools.calls.lock().unwrap();
assert_eq!(calls.len(), 1, "only the read ticket tool should run");
assert_eq!(calls[0].1, "idea_ticket_list");
let template_calls = template_tools.calls.lock().unwrap();
assert_eq!(
template_calls.len(),
1,
"only the read template tool should run"
);
assert_eq!(template_calls[0].1, "idea_template_list");
let _ = std::fs::remove_dir_all(temp);
}
@ -552,12 +618,14 @@ mod tests {
let agent = AgentId::from_uuid(Uuid::from_u128(83));
let requester = agent.to_string();
let ticket_tools = Arc::new(FakeTicketTools::default());
let template_tools = Arc::new(FakeTemplateTools::default());
let invoker = AppOpenAiToolInvoker::new(
Arc::clone(&core.orchestrator_service),
Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
Arc::new(FakePolicies::default()),
mcp_permissions(allow_doc(agent, &["idea_ticket_update_carnet"])),
ticket_tools.clone(),
template_tools,
);
let result = invoker
@ -585,6 +653,73 @@ mod tests {
let _ = std::fs::remove_dir_all(temp);
}
#[tokio::test]
async fn openai_durable_agent_override_allows_only_explicit_template_write_tool() {
let temp = std::env::temp_dir().join(format!(
"idea-app-tauri-openai-template-permissions-{}",
Uuid::new_v4()
));
let core = backend::BackendCore::build(temp.clone());
let agent = AgentId::from_uuid(Uuid::from_u128(84));
let requester = agent.to_string();
let ticket_tools = Arc::new(FakeTicketTools::default());
let template_tools = Arc::new(FakeTemplateTools::default());
let template_id = Uuid::from_u128(7).to_string();
let invoker = AppOpenAiToolInvoker::new(
Arc::clone(&core.orchestrator_service),
Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
Arc::new(FakePolicies::default()),
mcp_permissions(allow_doc(agent, &["idea_template_update"])),
ticket_tools,
template_tools.clone(),
);
let result = invoker
.call(
"idea_template_update",
&json!({
PROJECT_ROOT_ARG: "/tmp/project",
REQUESTER_ARG: requester,
"templateId": template_id,
"content": "body",
})
.to_string(),
)
.await
.expect("explicit durable override should reach template provider");
let result: Value = serde_json::from_str(&result).unwrap();
assert_eq!(result["requester"], requester);
assert_eq!(result["templateId"], template_id);
for tool in ["idea_template_create", "idea_template_delete"] {
let err = invoker
.call(
tool,
&json!({
PROJECT_ROOT_ARG: "/tmp/project",
REQUESTER_ARG: requester,
"templateId": template_id,
"name": "Base",
"content": "body",
"defaultProfileId": Uuid::from_u128(9),
})
.to_string(),
)
.await
.expect_err("non-allowlisted template write must be rejected");
assert!(
matches!(err, ToolInvocationError::Rejected(ref message) if message.contains(tool)),
"expected readable rejection for {tool}, got {err:?}"
);
}
let calls = template_tools.calls.lock().unwrap();
assert_eq!(calls.len(), 1);
assert_eq!(calls[0].1, "idea_template_update");
let _ = std::fs::remove_dir_all(temp);
}
#[tokio::test]
async fn openai_ticket_assistant_policy_still_bounds_ticket() {
let temp = std::env::temp_dir().join(format!(
@ -603,12 +738,14 @@ mod tests {
),
);
let ticket_tools = Arc::new(FakeTicketTools::default());
let template_tools = Arc::new(FakeTemplateTools::default());
let invoker = AppOpenAiToolInvoker::new(
Arc::clone(&core.orchestrator_service),
Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
policies,
mcp_permissions(ProjectMcpToolPermissions::default()),
ticket_tools.clone(),
template_tools,
);
let denied = invoker