add a per-agent egress log mode

swarm-queue-client/src/agent_permissions.rs

@@ -59,6 +59,34 @@ pub fn unrestricted(record: &AgentPermissions) -> bool {
     record.unrestricted_internet.unwrap_or(true)
 }
 
+/// How squid treats an agent's requests to names its lists do not allow.
+#[cfg(feature = "agent-permissions")]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum InternetMode {
+    /// Any destination the safety denies leave.
+    Unrestricted,
+    /// As `Restricted`, except that a request to an unlisted name goes through
+    /// and squid logs it as `would_deny`.
+    Log,
+    /// Only the listed names.
+    Restricted,
+}
+
+/// The mode `record` puts the agent in. `Log` needs an explicit `false` on
+/// `unrestricted_internet`: an absent flag is [`InternetMode::Unrestricted`]
+/// whatever `internet_log` says.
+#[cfg(feature = "agent-permissions")]
+#[must_use]
+pub fn internet_mode(record: &AgentPermissions) -> InternetMode {
+    if unrestricted(record) {
+        InternetMode::Unrestricted
+    } else if record.internet_log == Some(true) {
+        InternetMode::Log
+    } else {
+        InternetMode::Restricted
+    }
+}
+
 /// Read `agent`'s current permissions with one direct get: the one subject
 /// an agent's own grant covers, and one of those a hive's covers.
 ///
@@ -150,6 +178,31 @@ mod tests {
         assert!(unrestricted(&decode(Some("DEL"), b"").unwrap()));
     }
 
+    /// `Log` takes `unrestricted_internet: false` and `internet_log: true`
+    /// together; either alone, or the pair on an unrestricted record, is not it.
+    #[test]
+    fn log_needs_the_old_flag_off_and_the_new_one_on() {
+        let mode = |json: &str| internet_mode(&serde_json::from_str(json).unwrap());
+        assert_eq!(
+            mode(r#"{"unrestricted_internet":false,"internet_log":true}"#),
+            InternetMode::Log
+        );
+        assert_eq!(
+            mode(r#"{"unrestricted_internet":false}"#),
+            InternetMode::Restricted
+        );
+        assert_eq!(
+            mode(r#"{"unrestricted_internet":false,"internet_log":false}"#),
+            InternetMode::Restricted
+        );
+        assert_eq!(mode(r#"{"internet_log":true}"#), InternetMode::Unrestricted);
+        assert_eq!(
+            mode(r#"{"unrestricted_internet":true,"internet_log":true}"#),
+            InternetMode::Unrestricted
+        );
+        assert_eq!(mode("{}"), InternetMode::Unrestricted);
+    }
+
     /// A decoder built before the flag existed has no such field and ignores
     /// unknown ones; it reads a record carrying the flag.
     #[test]