GenAI.Approval.Permission (GenAI Approval v0.1.0)

Copy Markdown View Source

Allow/block command rules and their resolution (PRD §8).

Resolution order (normative, §8.2):

  1. More specific pattern wins — "github:issues.create" beats "github:issues.*" beats "github:*" beats "*:*". Command specificity dominates endpoint specificity.
  2. Block beats allow at equal specificity.
  3. Narrower scope beats wider at equal specificity + effect (:call > :session > {:until, _} > :always).
  4. No matching rule ⇒ :ask (default-deny: never default-allow).
  5. Expired {:until, t} rules never match (and stores prune them lazily).

Summary

Functions

decide(rules, endpoint, command, now \\ DateTime.utc_now())

Decide the outcome for endpoint:command given candidate rules.

expired?(rule, now)

True when the rule's time scope has lapsed.

matches?(pattern, endpoint, command)

Does a rule pattern match the given endpoint + command?

new(fields)

Build a rule with generated id + timestamp.

Functions

decide(rules, endpoint, command, now \\ DateTime.utc_now())

@spec decide(
  [GenAI.Approval.Permission.Rule.t()],
  String.t(),
  String.t(),
  DateTime.t()
) ::
  {:allow, GenAI.Approval.Permission.Rule.t()}
  | {:block, GenAI.Approval.Permission.Rule.t()}
  | :ask

Decide the outcome for endpoint:command given candidate rules.

Returns {:allow, rule}, {:block, rule}, or :ask.

expired?(rule, now)

@spec expired?(GenAI.Approval.Permission.Rule.t(), DateTime.t()) :: boolean()

True when the rule's time scope has lapsed.

matches?(pattern, endpoint, command)

@spec matches?(String.t(), String.t(), String.t()) :: boolean()

Does a rule pattern match the given endpoint + command?

new(fields)

@spec new(keyword()) :: GenAI.Approval.Permission.Rule.t()

Build a rule with generated id + timestamp.