@girardmedia/bootspring 2.0.21 → 2.0.23

package/src/core/policies.ts

@@ -0,0 +1,81 @@
+/**
+ * Bootspring policy profiles
+ * Team-level controls for capability gating.
+ *
+ * @package bootspring
+ * @module core/policies
+ */
+
+export interface PolicyProfile {
+  id: string;
+  name: string;
+  allowExternalSkills: boolean;
+  blockedWorkflows: string[];
+}
+
+export interface PolicyOptions {
+  policyProfile?: string | undefined;
+  blockedWorkflows?: string | undefined;
+}
+
+export interface Workflow {
+  key?: string | undefined;
+  name?: string | undefined;
+  tier?: string | undefined;
+}
+
+export const DEFAULT_POLICY_PROFILE = 'startup';
+
+export const POLICY_PROFILES: Record<string, PolicyProfile> = {
+  startup: {
+    id: 'startup',
+    name: 'Startup',
+    allowExternalSkills: true,
+    blockedWorkflows: []
+  },
+  regulated: {
+    id: 'regulated',
+    name: 'Regulated',
+    allowExternalSkills: false,
+    blockedWorkflows: ['growth-pack']
+  },
+  enterprise: {
+    id: 'enterprise',
+    name: 'Enterprise',
+    allowExternalSkills: true,
+    blockedWorkflows: []
+  }
+};
+
+export function normalizeProfile(profile: string | undefined | null): string {
+  const key = String(profile || DEFAULT_POLICY_PROFILE).trim().toLowerCase();
+  return POLICY_PROFILES[key] ? key : DEFAULT_POLICY_PROFILE;
+}
+
+function parseCsvList(value: string | undefined | null): string[] {
+  if (!value) return [];
+  return String(value)
+    .split(',')
+    .map(item => item.trim())
+    .filter(Boolean);
+}
+
+export function resolvePolicyProfile(options: PolicyOptions = {}): string {
+  return normalizeProfile(options.policyProfile || process.env.BOOTSPRING_POLICY_PROFILE);
+}
+
+export function getPolicyProfile(profile: string | undefined, options: PolicyOptions = {}): PolicyProfile {
+  const key = normalizeProfile(profile);
+  const base = POLICY_PROFILES[key] || POLICY_PROFILES[DEFAULT_POLICY_PROFILE]!;
+  const blockedFromEnv = parseCsvList(options.blockedWorkflows || process.env.BOOTSPRING_POLICY_BLOCKED_WORKFLOWS);
+  return {
+    ...base,
+    blockedWorkflows: Array.from(new Set([...(base.blockedWorkflows || []), ...blockedFromEnv]))
+  };
+}
+
+export function isWorkflowBlocked(workflow: Workflow | undefined | null, profile: PolicyProfile): boolean {
+  const workflowKey = String(workflow?.key || '').trim();
+  if (!workflowKey) return false;
+  return (profile.blockedWorkflows || []).includes(workflowKey);
+}