stacklok / toolhive / 24207554936

66%

Build Type

push

github

Committed by web-flow

Commit Message

Registry policy gates with type-safe configs (#4711)

Separate runner and registry policy gates with type-safe configs

The previous commit extracted PolicyGate to a shared pkg/policy package,
but this mixed runner and registry concerns in a single interface and
forced CheckCreateServer to use `any` to avoid a circular dependency.

Instead, keep each policy gate in the package it guards:
- pkg/runner keeps its original PolicyGate with type-safe *RunConfig
- pkg/registry gets a new PolicyGate with CheckUpdateRegistry and
  CheckDeleteRegistry, each receiving a dedicated config struct
  (UpdateRegistryConfig, DeleteRegistryConfig) that both CLI and API
  callers populate with the information available at their call site

The registry gate uses sync.RWMutex (read-heavy, write-once pattern),
NoopPolicyGate as the default (no separate allowAllGate), and exports
SnapshotPolicyGate for test cleanup across packages.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

43 of 63 new or added lines in 4 files covered. (68.25%)

33 existing lines in 3 files now uncovered.

56569 of 86955 relevant lines covered (65.06%)

61.75 hits per line