brokerd: consult tool name, parse, grants

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>

crates/brokerd/tests/grants_consult.rs

@@ -0,0 +1,76 @@
+//! A `consult` grant: empty constraints, no paths or hosts. Do not edit.
+
+#[path = "support/tmp.rs"]
+mod tmp;
+
+use brokerd::args::{ToolArgs, ToolName, parse};
+use brokerd::grants::load;
+use tmp::TempDir;
+
+fn body(rest: &str) -> String {
+    format!("tool = \"consult\"\nmode = \"auto\"\nmax_taint = \"private\"\n{rest}")
+}
+
+#[test]
+fn consult_parses_and_is_not_a_container_tool() {
+    assert_eq!(ToolName::parse("consult"), Some(ToolName::Consult));
+    assert_eq!(ToolName::Consult.as_str(), "consult");
+    assert!(!ToolName::Consult.is_memory());
+    assert!(
+        !ToolName::ALL.contains(&ToolName::Consult),
+        "ALL is the container tools"
+    );
+    let args = parse(ToolName::Consult, r#"{"question":"hello"}"#).unwrap();
+    assert_eq!(args.tool(), ToolName::Consult);
+    assert_eq!(
+        args,
+        ToolArgs::Consult {
+            question: "hello".to_string()
+        }
+    );
+    assert_eq!(args.canonical_json(), r#"{"question":"hello"}"#);
+}
+
+#[test]
+fn unknown_keys_are_invalid_arguments() {
+    let err = parse(ToolName::Consult, r#"{"question":"hello","history":[]}"#).unwrap_err();
+    let detail = err.detail();
+    assert!(
+        detail.contains("unknown") || detail.contains("history"),
+        "{detail}"
+    );
+}
+
+#[test]
+fn a_consult_grant_with_empty_constraints_loads() {
+    let dir = TempDir::new("grants-consult");
+    dir.write("consult.toml", &body(""));
+    let set = load(dir.path()).unwrap();
+    assert_eq!(set.grants()[0].grant.tool, "consult");
+    assert!(set.grants()[0].grant.untrusted);
+}
+
+#[test]
+fn consult_does_not_take_paths_or_hosts() {
+    let dir = TempDir::new("grants-consult-paths");
+    dir.write("consult.toml", &body("[constraints]\npaths = [\"/tmp\"]\n"));
+    let problems = load(dir.path()).expect_err("paths");
+    assert!(
+        problems
+            .iter()
+            .any(|p| p.problem.contains("does not take paths")),
+        "{problems:?}"
+    );
+    let dir = TempDir::new("grants-consult-hosts");
+    dir.write(
+        "consult.toml",
+        &body("[constraints]\nhosts = [\"example.com\"]\n"),
+    );
+    let problems = load(dir.path()).expect_err("hosts");
+    assert!(
+        problems
+            .iter()
+            .any(|p| p.problem.contains("does not take hosts")),
+        "{problems:?}"
+    );
+}