feat(agent): expose active package policy

crates/now-package-broker/Cargo.toml

@@ -31,8 +31,8 @@ hyper = { version = "1", features = ["http1", "server"] }
 hyper-util = { version = "0.1", features = ["tokio", "server", "server-auto", "service"] }
 notify = { version = "7", default-features = false }
 now-policy = "0.2"
-now-policy-api = { version = "0.3", features = ["policy-compat"] }
-now-policy-server-template = { version = "0.3", features = ["policy-compat"] }
+now-policy-api = "0.3"
+now-policy-server-template = "0.3"
 parking_lot = "0.12"
 regex = "1"
 semver = "1"

crates/now-package-broker/src/auth.rs

@@ -31,6 +31,10 @@ impl PipeClient {
     /// unauthenticated work a connection flood can trigger.
     pub(crate) fn from_connected_pipe(server: &NamedPipeServer) -> anyhow::Result<Self> {
         let process_id = connected_pipe_client_process_id(server).context("failed to query pipe client process id")?;
+        Self::from_process_id(process_id)
+    }
+
+    fn from_process_id(process_id: u32) -> anyhow::Result<Self> {
         let process = Process::get_by_pid(process_id, PROCESS_QUERY_LIMITED_INFORMATION)
             .with_context(|| format!("failed to open pipe client process {process_id}"))?;
         let executable_path = process
@@ -50,6 +54,11 @@ impl PipeClient {
         })
     }
 
+    #[cfg(test)]
+    pub(crate) fn from_current_process() -> anyhow::Result<Self> {
+        Self::from_process_id(std::process::id())
+    }
+
     /// Security identifier of the authenticated pipe client user, captured at connect.
     pub(crate) fn user_sid(&self) -> &Sid {
         &self.user_sid
@@ -61,7 +70,7 @@ impl PipeClient {
         skip_signature_validation: bool,
     ) -> anyhow::Result<()> {
         self.validate_client_context(&request.client)?;
-        self.validate_signature(skip_signature_validation)
+        self.validate_connection(skip_signature_validation)
     }
 
     pub(crate) fn validate_status_request(
@@ -70,7 +79,7 @@ impl PipeClient {
         skip_signature_validation: bool,
     ) -> anyhow::Result<()> {
         self.validate_client_context(&request.client)?;
-        self.validate_signature(skip_signature_validation)
+        self.validate_connection(skip_signature_validation)
     }
 
     pub(crate) fn validate_cancel_request(
@@ -79,15 +88,15 @@ impl PipeClient {
         skip_signature_validation: bool,
     ) -> anyhow::Result<()> {
         self.validate_client_context(&request.client)?;
-        self.validate_signature(skip_signature_validation)
+        self.validate_connection(skip_signature_validation)
     }
 
     fn validate_client_context(&self, client: &ClientContext) -> anyhow::Result<()> {
         self.validate_effective_user(&client.effective_user)?;
         self.validate_executable_path(&client.client_executable_path)
     }
 
-    fn validate_signature(&self, skip_signature_validation: bool) -> anyhow::Result<()> {
+    pub(crate) fn validate_connection(&self, skip_signature_validation: bool) -> anyhow::Result<()> {
         if signature_validation_skipped(skip_signature_validation) {
             warn!("DEBUG MODE: Skipping package broker client signature validation");
             return Ok(());
@@ -364,7 +373,7 @@ mod tests {
                 user_sid: client_user_sid(),
             };
 
-            assert!(client.validate_signature(true).is_err());
+            assert!(client.validate_connection(true).is_err());
         }
     }
 

crates/now-package-broker/src/evaluator/matching.rs

@@ -3,7 +3,7 @@
 use std::collections::BTreeSet;
 
 use now_policy::{Architecture, Elevation, ManagerName, Operation, PolicyRule, Scope};
-use now_policy_api::PackageRequest;
+use now_policy_api::{self as api, PackageRequest};
 
 use super::RequestFlags;
 use super::constraints::constraints_pass;
@@ -18,16 +18,16 @@ pub(super) fn rule_matches(
 ) -> bool {
     let m = &rule.match_criteria;
 
-    operations_match(request.operation.into(), &m.operations)
-        && managers_match(request.manager.into(), &m.managers)
+    operations_match(policy_operation(request.operation), &m.operations)
+        && managers_match(policy_manager(request.manager), &m.managers)
         && wildcard_any(&request.source.name, &m.sources)
         && wildcard_any(&request.package.id, &m.package_identifiers)
         && m.package_names.is_empty()
         && string_in_set(effective_version, &m.versions)
         && version_range_matches(effective_version, &m.version_range)
-        && scopes_match(request.options.scope.map(Into::into), &m.scopes)
-        && architectures_match(request.package.architecture.map(Into::into), &m.architectures)
-        && elevation_match(request.client.requested_elevation.into(), &m.elevation)
+        && scopes_match(request.options.scope.map(policy_scope), &m.scopes)
+        && architectures_match(request.package.architecture.map(policy_architecture), &m.architectures)
+        && elevation_match(policy_elevation(request.client.requested_elevation), &m.elevation)
         && bool_in_set(request.options.interactive, &m.interactive)
         && bool_in_set(request.options.skip_hash_check, &m.skip_hash_check)
         && bool_in_set(request.options.pre_release, &m.pre_release)
@@ -39,6 +39,59 @@ pub(super) fn rule_matches(
         && constraints_pass(&rule.constraints, request, flags)
 }
 
+fn policy_operation(operation: api::Operation) -> Operation {
+    match operation {
+        api::Operation::Install => Operation::Install,
+        api::Operation::Update => Operation::Update,
+        api::Operation::Uninstall => Operation::Uninstall,
+    }
+}
+
+fn policy_manager(manager: api::ManagerName) -> ManagerName {
+    match manager {
+        api::ManagerName::Winget => ManagerName::Winget,
+        api::ManagerName::PowerShell => ManagerName::PowerShell,
+        api::ManagerName::PowerShell7 => ManagerName::PowerShell7,
+        api::ManagerName::Apt => ManagerName::Apt,
+        api::ManagerName::Bun => ManagerName::Bun,
+        api::ManagerName::Cargo => ManagerName::Cargo,
+        api::ManagerName::Chocolatey => ManagerName::Chocolatey,
+        api::ManagerName::Dnf => ManagerName::Dnf,
+        api::ManagerName::Dotnet => ManagerName::Dotnet,
+        api::ManagerName::Flatpak => ManagerName::Flatpak,
+        api::ManagerName::Homebrew => ManagerName::Homebrew,
+        api::ManagerName::Npm => ManagerName::Npm,
+        api::ManagerName::Pacman => ManagerName::Pacman,
+        api::ManagerName::Pip => ManagerName::Pip,
+        api::ManagerName::Scoop => ManagerName::Scoop,
+        api::ManagerName::Snap => ManagerName::Snap,
+        api::ManagerName::Vcpkg => ManagerName::Vcpkg,
+    }
+}
+
+fn policy_scope(scope: api::Scope) -> Scope {
+    match scope {
+        api::Scope::User => Scope::User,
+        api::Scope::Machine => Scope::Machine,
+    }
+}
+
+fn policy_architecture(architecture: api::Architecture) -> Architecture {
+    match architecture {
+        api::Architecture::X86 => Architecture::X86,
+        api::Architecture::X64 => Architecture::X64,
+        api::Architecture::Arm64 => Architecture::Arm64,
+        api::Architecture::Neutral => Architecture::Neutral,
+    }
+}
+
+fn policy_elevation(elevation: api::Elevation) -> Elevation {
+    match elevation {
+        api::Elevation::Standard => Elevation::Standard,
+        api::Elevation::Elevated => Elevation::Elevated,
+    }
+}
+
 fn operations_match(op: Operation, allowed: &BTreeSet<Operation>) -> bool {
     allowed.is_empty() || allowed.contains(&op)
 }