add a per-agent egress log mode

hive-c0re/src/agent_config/permissions.rs

@@ -17,6 +17,7 @@ use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
 
 use hive_types::Permission;
+pub use swarm_queue_client::agent_permissions::InternetMode;
 use swarm_wire::agent_permissions::AgentPermissions;
 
 const FILE: &str = "swarm-agent-permissions.json";
@@ -55,6 +56,16 @@ pub fn unrestricted_internet(record: Option<&AgentPermissions>) -> bool {
     record.is_none_or(swarm_queue_client::agent_permissions::unrestricted)
 }
 
+/// How squid treats the agent's requests to names its lists do not allow under
+/// `record`: [`InternetMode::Unrestricted`] when there is no record.
+#[must_use]
+pub fn internet_mode(record: Option<&AgentPermissions>) -> InternetMode {
+    record.map_or(
+        InternetMode::Unrestricted,
+        swarm_queue_client::agent_permissions::internet_mode,
+    )
+}
+
 /// Whether `agent` holds `perm` per the file at `path` (normally [`path`]).
 ///
 /// # Errors
@@ -96,6 +107,22 @@ mod tests {
         ))));
     }
 
+    /// `log` is the pair `false` + `internet_log`, and nothing else reads as it.
+    #[test]
+    fn internet_mode_reads_the_log_pair() {
+        let mode = |json: &str| internet_mode(Some(&record(json)));
+        assert_eq!(internet_mode(None), InternetMode::Unrestricted);
+        assert_eq!(
+            mode(r#"{"unrestricted_internet":false,"internet_log":true}"#),
+            InternetMode::Log
+        );
+        assert_eq!(
+            mode(r#"{"unrestricted_internet":false}"#),
+            InternetMode::Restricted
+        );
+        assert_eq!(mode(r#"{"internet_log":true}"#), InternetMode::Unrestricted);
+    }
+
     /// No name holds more than the default without an entry: `ruth` with no
     /// entry holds `DEFAULT`, and only an entry grants her `manage_root_agent`.
     #[test]