feat(permissions): expose network permission state (#103)

crates/app-tauri/src/commands.rs

@@ -14,19 +14,21 @@ use application::{
     CloseProjectInput, CreateAgentInput, CreateLayoutInput, CreateMemoryInput, CreateSkillInput,
     DeleteAgentInput, DeleteEmbedderProfileInput, DeleteLayoutInput, DeleteMemoryInput,
     DeleteSkillInput, DeleteTemplateInput, DetectAgentDriftInput, GetMemoryInput,
-    GetProjectWorkStateInput, GitBranchesInput, GitCheckoutInput, GitCommitInput, GitGraphInput,
-    GitInitInput, GitLogInput, GitStagePathInput, GitStatusInput, InspectConversationInput,
-    LaunchAgentInput, ListAgentsInput, ListDevicesInput, ListLayoutsInput, ListMemoriesInput,
-    ListResumableAgentsInput, ListSkillsInput, LiveSessions, LoadLayoutInput, McpRuntime,
-    MutateLayoutInput, OpenProjectInput, ReadAgentContextInput, ReadConversationPageInput,
-    ReadMcpToolPermissionsInput, ReadMemoryIndexInput, ReadProjectContextInput, RecallMemoryInput,
-    ReconcileLayoutsInput, ReconcileLiveStateInput, RenameDeviceInput, RenameLayoutInput,
-    ResolveAgentPermissionsInput, ResolveMemoryLinksInput, RevokeDeviceInput,
+    GetProjectSystemPermissionsInput, GetProjectWorkStateInput, GitBranchesInput, GitCheckoutInput,
+    GitCommitInput, GitGraphInput, GitInitInput, GitLogInput, GitStagePathInput, GitStatusInput,
+    InspectConversationInput, LaunchAgentInput, ListAgentsInput, ListDevicesInput,
+    ListLayoutsInput, ListMemoriesInput, ListResumableAgentsInput, ListSkillsInput, LiveSessions,
+    LoadLayoutInput, McpRuntime, MutateLayoutInput, OpenProjectInput, ReadAgentContextInput,
+    ReadConversationPageInput, ReadMcpToolPermissionsInput, ReadMemoryIndexInput,
+    ReadProjectContextInput, RecallMemoryInput, ReconcileLayoutsInput, ReconcileLiveStateInput,
+    RenameDeviceInput, RenameLayoutInput, ResolveAgentPermissionsInput,
+    ResolveAgentSystemPermissionsInput, ResolveMemoryLinksInput, RevokeDeviceInput,
     RotateConversationLogInput, SetActiveLayoutInput, SnapshotRunningAgentsInput,
     StopLiveAgentInput, SyncAgentWithTemplateInput, UnassignSkillFromAgentInput,
     UpdateAgentContextInput, UpdateAgentMcpToolPermissionsInput, UpdateAgentPermissionsInput,
-    UpdateMemoryInput, UpdateProjectContextInput, UpdateProjectMcpToolPermissionsInput,
-    UpdateProjectPermissionsInput, UpdateSkillInput,
+    UpdateAgentSystemPermissionsInput, UpdateMemoryInput, UpdateProjectContextInput,
+    UpdateProjectMcpToolPermissionsInput, UpdateProjectPermissionsInput,
+    UpdateProjectSystemPermissionsInput, UpdateSkillInput,
 };
 use domain::ports::ModelServerRuntime;
 use domain::ports::PtyHandle;
@@ -52,19 +54,22 @@ use crate::dto::{
     MemoryDto, MemoryIndexDto, MemoryLinksDto, MemoryListDto, ModelServerConfigDto,
     ModelServerConfigListDto, OpenCodeProviderListDto, OpenTerminalRequestDto,
     PreviewModelServerCommandDto, ProfileDto, ProfileListDto, ProjectDto, ProjectListDto,
-    ProjectMcpToolPermissionsDto, ProjectPermissionsDto, ProjectWorkStateDto,
-    ReadAgentContextResponseDto, ReadConversationPageRequestDto, ReattachChatDto,
-    ReattachResultDto, RecallMemoryRequestDto, RenameLayoutRequestDto, ReplyChunk,
-    ResizeTerminalRequestDto, ResolveAgentPermissionsRequestDto, ResumableAgentListDto,
-    SaveEmbedderProfileRequestDto, SaveModelServerRequestDto,
+    ProjectMcpToolPermissionsDto, ProjectPermissionsDto, ProjectSystemPermissionsDto,
+    ProjectWorkStateDto, ReadAgentContextResponseDto, ReadConversationPageRequestDto,
+    ReattachChatDto, ReattachResultDto, RecallMemoryRequestDto, RenameLayoutRequestDto, ReplyChunk,
+    ResizeTerminalRequestDto, ResolveAgentPermissionsRequestDto,
+    ResolveAgentSystemPermissionsRequestDto, ResolvedAgentSystemPermissionsDto,
+    ResumableAgentListDto, SaveEmbedderProfileRequestDto, SaveModelServerRequestDto,
     SaveOpenCodeProviderProfileRequestDto, SaveProfileRequestDto, SetActiveLayoutRequestDto,
     SetActiveLayoutResultDto, SkillDto, SkillListDto, StopLiveAgentRequestDto,
     StopLiveAgentResponseDto, SyncAgentWithTemplateRequestDto, SyncResultDto, TemplateDto,
     TemplateListDto, TerminalClosedDto, TerminalSessionDto, TurnPageDto, UnassignSkillRequestDto,
     UpdateAgentContextRequestDto, UpdateAgentMcpToolPermissionsRequestDto,
-    UpdateAgentPermissionsRequestDto, UpdateMemoryRequestDto, UpdateProjectContextRequestDto,
+    UpdateAgentPermissionsRequestDto, UpdateAgentSystemPermissionsRequestDto,
+    UpdateMemoryRequestDto, UpdateProjectContextRequestDto,
     UpdateProjectMcpToolPermissionsRequestDto, UpdateProjectPermissionsRequestDto,
-    UpdateSkillRequestDto, UpdateTemplateRequestDto, WriteTerminalRequestDto,
+    UpdateProjectSystemPermissionsRequestDto, UpdateSkillRequestDto, UpdateTemplateRequestDto,
+    WriteTerminalRequestDto,
 };
 use crate::embedded_server::{
     EmbeddedServerStatusDto, ServerExposurePreviewDto, ServerExposureSettingsDto,
@@ -549,6 +554,87 @@ pub async fn resolve_agent_permissions(
         .map_err(ErrorDto::from)
 }
 
+/// `get_project_system_permissions` — read `.ideai/system-permissions.json`.
+///
+/// # Errors
+/// Returns an [`ErrorDto`] on invalid project id or store failure.
+#[tauri::command]
+pub async fn get_project_system_permissions(
+    project_id: String,
+    state: State<'_, AppState>,
+) -> Result<ProjectSystemPermissionsDto, ErrorDto> {
+    let project = resolve_project(&project_id, &state).await?;
+    state
+        .get_project_system_permissions
+        .execute(GetProjectSystemPermissionsInput { project })
+        .await
+        .map(|out| ProjectSystemPermissionsDto(out.permissions))
+        .map_err(ErrorDto::from)
+}
+
+/// `update_project_system_permissions` — replace project default system permissions.
+///
+/// # Errors
+/// Returns an [`ErrorDto`] on invalid project id or store failure.
+#[tauri::command]
+pub async fn update_project_system_permissions(
+    request: UpdateProjectSystemPermissionsRequestDto,
+    state: State<'_, AppState>,
+) -> Result<ProjectSystemPermissionsDto, ErrorDto> {
+    let project = resolve_project(&request.project_id, &state).await?;
+    state
+        .update_project_system_permissions
+        .execute(UpdateProjectSystemPermissionsInput {
+            project,
+            permissions: request.permissions,
+        })
+        .await
+        .map(|out| ProjectSystemPermissionsDto(out.permissions))
+        .map_err(ErrorDto::from)
+}
+
+/// `update_agent_system_permissions` — replace or remove one agent system override.
+///
+/// # Errors
+/// Returns an [`ErrorDto`] on invalid ids or store failure.
+#[tauri::command]
+pub async fn update_agent_system_permissions(
+    request: UpdateAgentSystemPermissionsRequestDto,
+    state: State<'_, AppState>,
+) -> Result<ProjectSystemPermissionsDto, ErrorDto> {
+    let project = resolve_project(&request.project_id, &state).await?;
+    let agent_id = parse_agent_id(&request.agent_id)?;
+    state
+        .update_agent_system_permissions
+        .execute(UpdateAgentSystemPermissionsInput {
+            project,
+            agent_id,
+            permissions: request.permissions,
+        })
+        .await
+        .map(|out| ProjectSystemPermissionsDto(out.permissions))
+        .map_err(ErrorDto::from)
+}
+
+/// `resolve_agent_system_permissions` — resolve wanted plus runtime-constrained system permissions.
+///
+/// # Errors
+/// Returns an [`ErrorDto`] on invalid ids or store/probe failure.
+#[tauri::command]
+pub async fn resolve_agent_system_permissions(
+    request: ResolveAgentSystemPermissionsRequestDto,
+    state: State<'_, AppState>,
+) -> Result<ResolvedAgentSystemPermissionsDto, ErrorDto> {
+    let project = resolve_project(&request.project_id, &state).await?;
+    let agent_id = parse_agent_id(&request.agent_id)?;
+    state
+        .resolve_agent_system_permissions
+        .execute(ResolveAgentSystemPermissionsInput { project, agent_id })
+        .await
+        .map(|out| ResolvedAgentSystemPermissionsDto(out.permissions))
+        .map_err(ErrorDto::from)
+}
+
 /// `get_mcp_tool_permissions` — read `.ideai/mcp-tool-permissions.json` plus catalogue.
 ///
 /// # Errors