|
| 1 | +//! Builds the [`BrokerExecutor`] this binary serves. Moved verbatim (Phase 1 |
| 2 | +//! extraction) from the gateway's `routes/broker.rs::default_broker_executor`. |
| 3 | +
|
| 4 | +use std::sync::Arc; |
| 5 | + |
| 6 | +use aegis_tool_broker_connectors::{ |
| 7 | + BrokerExecutor, ConnectorRegistry, FilesystemConnector, GithubConnector, GithubMode, |
| 8 | + HttpConnector, ShellConnector, |
| 9 | +}; |
| 10 | +use aegis_tool_broker_core::EnvCredentialResolver; |
| 11 | +use tracing::error; |
| 12 | + |
| 13 | +/// Builds the [`BrokerExecutor`] this process serves. GitHub runs in mock |
| 14 | +/// mode unless `AEGIS_GITHUB_API_BASE` is set (real mode); `HttpConnector` |
| 15 | +/// is always registered (HTTPS-only). The filesystem and shell connectors |
| 16 | +/// are opt-in via `AEGIS_BROKER_WORKSPACE` — with no configured workspace |
| 17 | +/// there is nothing safe to scope them to, so they're simply absent from |
| 18 | +/// the registry (an execute against `filesystem`/`shell` then fails closed |
| 19 | +/// with `UnknownConnectorType`, not a wide-open default). |
| 20 | +pub fn build_broker_executor() -> Arc<BrokerExecutor> { |
| 21 | + let github_mode = match std::env::var("AEGIS_GITHUB_API_BASE") { |
| 22 | + Ok(base_url) if !base_url.trim().is_empty() => GithubMode::Real { |
| 23 | + base_url: base_url.trim_end_matches('/').to_string(), |
| 24 | + }, |
| 25 | + _ => GithubMode::Mock, |
| 26 | + }; |
| 27 | + let mut registry = ConnectorRegistry::default() |
| 28 | + .register(Arc::new(GithubConnector::new(github_mode))) |
| 29 | + .register(Arc::new(HttpConnector::new())); |
| 30 | + |
| 31 | + if let Ok(workspace) = std::env::var("AEGIS_BROKER_WORKSPACE") { |
| 32 | + if !workspace.trim().is_empty() { |
| 33 | + match FilesystemConnector::new(&workspace) { |
| 34 | + Ok(fs) => registry = registry.register(Arc::new(fs)), |
| 35 | + Err(e) => error!( |
| 36 | + "AEGIS_BROKER_WORKSPACE {:?} unusable for filesystem connector: {}", |
| 37 | + workspace, e |
| 38 | + ), |
| 39 | + } |
| 40 | + match ShellConnector::new(&workspace) { |
| 41 | + Ok(shell) => registry = registry.register(Arc::new(shell)), |
| 42 | + Err(e) => error!( |
| 43 | + "AEGIS_BROKER_WORKSPACE {:?} unusable for shell connector: {}", |
| 44 | + workspace, e |
| 45 | + ), |
| 46 | + } |
| 47 | + } |
| 48 | + } |
| 49 | + |
| 50 | + Arc::new(BrokerExecutor::new( |
| 51 | + registry, |
| 52 | + Arc::new(EnvCredentialResolver), |
| 53 | + )) |
| 54 | +} |
| 55 | + |
| 56 | +#[cfg(test)] |
| 57 | +mod tests { |
| 58 | + use super::*; |
| 59 | + |
| 60 | + #[tokio::test] |
| 61 | + async fn github_defaults_to_mock_mode_when_api_base_unset() { |
| 62 | + std::env::remove_var("AEGIS_GITHUB_API_BASE"); |
| 63 | + std::env::remove_var("AEGIS_BROKER_WORKSPACE"); |
| 64 | + let executor = build_broker_executor(); |
| 65 | + // Mock mode never makes a real network call; a benign read must |
| 66 | + // succeed synchronously without any credential configured. |
| 67 | + let output = executor |
| 68 | + .execute( |
| 69 | + &aegis_tool_broker_connectors::BrokerToolBinding { |
| 70 | + tool_name: "gh".to_string(), |
| 71 | + connector_type: "github".to_string(), |
| 72 | + credential_ref: None, |
| 73 | + status: "active".to_string(), |
| 74 | + }, |
| 75 | + &aegis_tool_broker_core::BrokerAction { |
| 76 | + tool: "gh".to_string(), |
| 77 | + action: "read".to_string(), |
| 78 | + resource: None, |
| 79 | + mutates_state: false, |
| 80 | + parameters: serde_json::json!({"path": "/repos/acme/api/issues"}), |
| 81 | + }, |
| 82 | + None, |
| 83 | + ) |
| 84 | + .await; |
| 85 | + assert!(output.is_ok()); |
| 86 | + } |
| 87 | + |
| 88 | + #[tokio::test] |
| 89 | + async fn filesystem_and_shell_are_absent_without_a_configured_workspace() { |
| 90 | + std::env::remove_var("AEGIS_BROKER_WORKSPACE"); |
| 91 | + let executor = build_broker_executor(); |
| 92 | + let err = executor |
| 93 | + .execute( |
| 94 | + &aegis_tool_broker_connectors::BrokerToolBinding { |
| 95 | + tool_name: "fs".to_string(), |
| 96 | + connector_type: "filesystem".to_string(), |
| 97 | + credential_ref: None, |
| 98 | + status: "active".to_string(), |
| 99 | + }, |
| 100 | + &aegis_tool_broker_core::BrokerAction { |
| 101 | + tool: "fs".to_string(), |
| 102 | + action: "read".to_string(), |
| 103 | + resource: None, |
| 104 | + mutates_state: false, |
| 105 | + parameters: serde_json::json!({}), |
| 106 | + }, |
| 107 | + None, |
| 108 | + ) |
| 109 | + .await |
| 110 | + .expect_err("filesystem must be unregistered without AEGIS_BROKER_WORKSPACE"); |
| 111 | + assert!(matches!( |
| 112 | + err, |
| 113 | + aegis_tool_broker_connectors::ExecuteError::UnknownConnectorType { .. } |
| 114 | + )); |
| 115 | + } |
| 116 | + |
| 117 | + #[tokio::test] |
| 118 | + async fn filesystem_and_shell_are_registered_with_a_configured_workspace() { |
| 119 | + let dir = tempfile::tempdir().unwrap(); |
| 120 | + std::env::set_var("AEGIS_BROKER_WORKSPACE", dir.path()); |
| 121 | + let executor = build_broker_executor(); |
| 122 | + let output = executor |
| 123 | + .execute( |
| 124 | + &aegis_tool_broker_connectors::BrokerToolBinding { |
| 125 | + tool_name: "shell".to_string(), |
| 126 | + connector_type: "shell".to_string(), |
| 127 | + credential_ref: None, |
| 128 | + status: "active".to_string(), |
| 129 | + }, |
| 130 | + &aegis_tool_broker_core::BrokerAction { |
| 131 | + tool: "shell".to_string(), |
| 132 | + action: "run".to_string(), |
| 133 | + resource: None, |
| 134 | + mutates_state: false, |
| 135 | + parameters: serde_json::json!({"command": ["/usr/bin/env"]}), |
| 136 | + }, |
| 137 | + None, |
| 138 | + ) |
| 139 | + .await; |
| 140 | + assert!(output.is_ok()); |
| 141 | + std::env::remove_var("AEGIS_BROKER_WORKSPACE"); |
| 142 | + } |
| 143 | +} |
0 commit comments