@wlfi-agent/cli 1.4.17 → 1.4.18

package/crates/vault-policy/src/engine.rs

@@ -4,6 +4,54 @@ use vault_domain::{AgentAction, PolicyAttachment, PolicyType, SpendEvent, Spendi
 
 use crate::{PolicyDecision, PolicyError, PolicyEvaluation, PolicyExplanation};
 
+pub(crate) fn increment_counter_or_mark_overflow(counter: &mut u128) -> bool {
+    match counter.checked_add(1) {
+        Some(next) => {
+            *counter = next;
+            false
+        }
+        None => {
+            *counter = u128::MAX;
+            true
+        }
+    }
+}
+
+pub(crate) fn enforce_priority_fee_limit(
+    policy: &SpendingPolicy,
+    action: &AgentAction,
+) -> Result<(), PolicyError> {
+    if let Some(requested_max_priority_fee_per_gas_wei) = action.max_priority_fee_per_gas_wei() {
+        if requested_max_priority_fee_per_gas_wei > policy.max_amount_wei {
+            return Err(PolicyError::PriorityFeePerGasLimitExceeded {
+                policy_id: policy.id,
+                max_priority_fee_per_gas_wei: policy.max_amount_wei,
+                requested_max_priority_fee_per_gas_wei,
+            });
+        }
+    }
+
+    Ok(())
+}
+
+pub(crate) fn enforce_calldata_bytes_limit(
+    policy: &SpendingPolicy,
+    action: &AgentAction,
+) -> Result<(), PolicyError> {
+    if let Some(requested_calldata_bytes) = action.calldata_len_bytes() {
+        let requested_calldata_bytes = requested_calldata_bytes as u128;
+        if requested_calldata_bytes > policy.max_amount_wei {
+            return Err(PolicyError::CalldataBytesLimitExceeded {
+                policy_id: policy.id,
+                max_calldata_bytes: policy.max_amount_wei,
+                requested_calldata_bytes,
+            });
+        }
+    }
+
+    Ok(())
+}
+
 /// Stateless policy evaluator.
 #[derive(Debug, Default)]
 pub struct PolicyEngine;
@@ -140,29 +188,10 @@ impl PolicyEngine {
                 }
             }
             PolicyType::PerTxMaxPriorityFeePerGas => {
-                if let Some(requested_max_priority_fee_per_gas_wei) =
-                    action.max_priority_fee_per_gas_wei()
-                {
-                    if requested_max_priority_fee_per_gas_wei > policy.max_amount_wei {
-                        return Err(PolicyError::PriorityFeePerGasLimitExceeded {
-                            policy_id: policy.id,
-                            max_priority_fee_per_gas_wei: policy.max_amount_wei,
-                            requested_max_priority_fee_per_gas_wei,
-                        });
-                    }
-                }
+                enforce_priority_fee_limit(policy, action)?;
             }
             PolicyType::PerTxMaxCalldataBytes => {
-                if let Some(requested_calldata_bytes) = action.calldata_len_bytes() {
-                    let requested_calldata_bytes = requested_calldata_bytes as u128;
-                    if requested_calldata_bytes > policy.max_amount_wei {
-                        return Err(PolicyError::CalldataBytesLimitExceeded {
-                            policy_id: policy.id,
-                            max_calldata_bytes: policy.max_amount_wei,
-                            requested_calldata_bytes,
-                        });
-                    }
-                }
+                enforce_calldata_bytes_limit(policy, action)?;
             }
             PolicyType::DailyMaxSpending => self.enforce_window_limit(
                 policy,
@@ -223,23 +252,17 @@ impl PolicyEngine {
         window_start: OffsetDateTime,
     ) -> Result<(), PolicyError> {
         let mut used_tx_count = 0u128;
-        for _event in spend_history.iter().filter(|event| {
+        let overflowed = spend_history.iter().filter(|event| {
             event.agent_key_id == agent_key_id
                 && event.at >= window_start
                 && policy.assets.allows(&event.asset)
                 && policy.recipients.allows(&event.recipient)
                 && policy.networks.allows(&event.chain_id)
-        }) {
-            match used_tx_count.checked_add(1) {
-                Some(next) => used_tx_count = next,
-                None => {
-                    used_tx_count = u128::MAX;
-                    break;
-                }
-            }
-        }
+        })
+        .any(|_| increment_counter_or_mark_overflow(&mut used_tx_count));
 
-        let exceeds_window = used_tx_count
+        let exceeds_window = overflowed
+            || used_tx_count
             .checked_add(1)
             .is_none_or(|total| total > policy.max_amount_wei);
         if exceeds_window {

package/crates/vault-policy/src/tests.rs

@@ -8,6 +8,10 @@ use vault_domain::{
     SpendEvent, SpendingPolicy,
 };
 
+use crate::engine::{
+    enforce_calldata_bytes_limit, enforce_priority_fee_limit, increment_counter_or_mark_overflow,
+};
+
 use super::{PolicyEngine, PolicyError};
 
 fn addr(x: &str) -> EvmAddress {
@@ -768,6 +772,197 @@ fn fee_policy_is_not_applicable_when_action_lacks_metadata() {
     assert!(result.is_ok());
 }
 
+#[test]
+fn explain_reports_no_attached_policies_when_attachment_filters_everything() {
+    let engine = PolicyEngine;
+    let policy = policy_all_per_tx(100);
+    let attachment =
+        PolicyAttachment::policy_set(BTreeSet::from([Uuid::new_v4()])).expect("attachment");
+    let action = AgentAction::TransferNative {
+        chain_id: 1,
+        to: addr("0x2000000000000000000000000000000000000000"),
+        amount_wei: 1,
+    };
+
+    let explanation = engine.explain(
+        &[policy],
+        &attachment,
+        &action,
+        &[],
+        Uuid::new_v4(),
+        OffsetDateTime::now_utc(),
+    );
+
+    assert!(matches!(explanation.decision, super::PolicyDecision::Deny(PolicyError::NoAttachedPolicies)));
+    assert!(explanation.applicable_policy_ids.is_empty());
+    assert!(explanation.evaluated_policy_ids.is_empty());
+}
+
+#[test]
+fn fee_and_calldata_limits_allow_broadcasts_within_cap() {
+    let engine = PolicyEngine;
+    let fee_policy = SpendingPolicy::new(
+        0,
+        PolicyType::PerTxMaxPriorityFeePerGas,
+        1_000_000_000,
+        EntityScope::All,
+        EntityScope::All,
+        EntityScope::All,
+    )
+    .expect("policy");
+    let calldata_policy = SpendingPolicy::new(
+        1,
+        PolicyType::PerTxMaxCalldataBytes,
+        4,
+        EntityScope::All,
+        EntityScope::All,
+        EntityScope::All,
+    )
+    .expect("policy");
+    let action = broadcast_action_with_fees(2_000_000_000, 1_000_000_000, "0xdeadbeef");
+
+    let result = engine.evaluate(
+        &[fee_policy, calldata_policy],
+        &PolicyAttachment::AllPolicies,
+        &action,
+        &[],
+        Uuid::new_v4(),
+        OffsetDateTime::now_utc(),
+    );
+
+    assert!(result.is_ok());
+}
+
+#[test]
+fn weekly_limit_and_manual_approval_paths_are_enforced() {
+    let engine = PolicyEngine;
+    let now = OffsetDateTime::now_utc();
+    let agent_key_id = Uuid::new_v4();
+    let token = addr("0x3000000000000000000000000000000000000000");
+    let recipient = addr("0x4000000000000000000000000000000000000000");
+
+    let weekly_policy = SpendingPolicy::new(
+        0,
+        PolicyType::WeeklyMaxSpending,
+        100,
+        EntityScope::All,
+        EntityScope::All,
+        EntityScope::All,
+    )
+    .expect("policy");
+    let weekly_history = vec![SpendEvent {
+        agent_key_id,
+        chain_id: 1,
+        asset: AssetId::Erc20(token.clone()),
+        recipient: recipient.clone(),
+        amount_wei: 80,
+        at: now - Duration::days(2),
+    }];
+    let weekly_action = AgentAction::Transfer {
+        chain_id: 1,
+        token: token.clone(),
+        to: recipient.clone(),
+        amount_wei: 30,
+    };
+    assert!(matches!(
+        engine.evaluate(
+            &[weekly_policy],
+            &PolicyAttachment::AllPolicies,
+            &weekly_action,
+            &weekly_history,
+            agent_key_id,
+            now
+        ),
+        Err(PolicyError::WindowLimitExceeded { .. })
+    ));
+
+    let manual_policy = SpendingPolicy::new_manual_approval(
+        0,
+        10,
+        100,
+        EntityScope::All,
+        EntityScope::All,
+        EntityScope::All,
+    )
+    .expect("policy");
+    let in_range = AgentAction::Transfer {
+        chain_id: 1,
+        token: token.clone(),
+        to: recipient.clone(),
+        amount_wei: 50,
+    };
+    assert!(matches!(
+        engine.evaluate(
+            &[manual_policy.clone()],
+            &PolicyAttachment::AllPolicies,
+            &in_range,
+            &[],
+            agent_key_id,
+            now
+        ),
+        Err(PolicyError::ManualApprovalRequired { .. })
+    ));
+
+    let below_range = AgentAction::Transfer {
+        chain_id: 1,
+        token,
+        to: recipient,
+        amount_wei: 5,
+    };
+    assert!(engine
+        .evaluate(
+            &[manual_policy],
+            &PolicyAttachment::AllPolicies,
+            &below_range,
+            &[],
+            agent_key_id,
+            now
+        )
+        .is_ok());
+}
+
+#[test]
+fn tx_count_overflow_helper_saturates_at_max() {
+    let mut counter = u128::MAX;
+
+    assert!(increment_counter_or_mark_overflow(&mut counter));
+    assert_eq!(counter, u128::MAX);
+}
+
+#[test]
+fn optional_limit_helpers_allow_missing_or_in_range_metadata() {
+    let policy = SpendingPolicy::new(
+        0,
+        PolicyType::PerTxMaxPriorityFeePerGas,
+        1_000_000_000,
+        EntityScope::All,
+        EntityScope::All,
+        EntityScope::All,
+    )
+    .expect("policy");
+    let plain_transfer = AgentAction::TransferNative {
+        chain_id: 1,
+        to: addr("0x2000000000000000000000000000000000000000"),
+        amount_wei: 1,
+    };
+    assert!(enforce_priority_fee_limit(&policy, &plain_transfer).is_ok());
+
+    let broadcast = broadcast_action_with_fees(2_000_000_000, 1_000_000_000, "0xdeadbeef");
+    assert!(enforce_priority_fee_limit(&policy, &broadcast).is_ok());
+
+    let calldata_policy = SpendingPolicy::new(
+        0,
+        PolicyType::PerTxMaxCalldataBytes,
+        4,
+        EntityScope::All,
+        EntityScope::All,
+        EntityScope::All,
+    )
+    .expect("policy");
+    assert!(enforce_calldata_bytes_limit(&calldata_policy, &plain_transfer).is_ok());
+    assert!(enforce_calldata_bytes_limit(&calldata_policy, &broadcast).is_ok());
+}
+
 #[test]
 fn gas_policy_is_not_applicable_when_action_lacks_metadata() {
     let engine = PolicyEngine;