Package com.tnsai.quality.security

Class ToolFilter

java.lang.Object
com.tnsai.quality.security.ToolFilter
public final class ToolFilter extends Object
Glob-based tool filtering with allow/deny patterns.

Supports glob patterns for bulk tool permission rules. Deny patterns always take precedence over allow patterns.

Pattern Syntax

  • * matches any sequence of characters (except separator)
  • ? matches exactly one character
  • Matching is case-insensitive (via Locale.ROOT)

Evaluation Rules

  1. If tool matches any deny pattern: DENIED
  2. If allow patterns are configured and tool matches one: ALLOWED
  3. If allow patterns are configured but tool matches none: DENIED
  4. If no allow patterns configured: ALLOWED (open by default)

Usage


 ToolFilter filter = ToolFilter.builder()
     .allow("search_*", "file_read")
     .deny("file_delete", "shell_*")
     .build();

 filter.isAllowed("search_web");    // true
 filter.isAllowed("file_delete");   // false (deny takes precedence)
 filter.isAllowed("shell_exec");    // false (matches shell_*)
 filter.isAllowed("file_write");    // false (not in allow list)
Since:
0.2.3

  • Method Details

    • allowAll

      public static ToolFilter allowAll()
      Creates an open filter that allows everything.
      Returns:
      permissive filter

    • builder

      public static ToolFilter.Builder builder()
      Creates a builder for ToolFilter.
      Returns:
      new builder

    • isAllowed

      public boolean isAllowed(String toolName)
      Checks if a tool is allowed by this filter.
      Parameters:
      toolName - the tool name to check
      Returns:
      true if the tool is allowed

    • isDenied

      public boolean isDenied(String toolName)
      Checks if a tool is denied by this filter.
      Parameters:
      toolName - the tool name to check
      Returns:
      true if the tool is denied

    • filterAllowed

      public List<String> filterAllowed(List<String> toolNames)
      Filters a list of tool names, returning only the allowed ones.
      Parameters:
      toolNames - the tool names to filter
      Returns:
      list of allowed tool names

    • getAllowGlobs

      public List<String> getAllowGlobs()
      Returns the configured allow globs.
      Returns:
      unmodifiable list of allow glob patterns

    • getDenyGlobs

      public List<String> getDenyGlobs()
      Returns the configured deny globs.
      Returns:
      unmodifiable list of deny glob patterns

    • hasAllowPatterns

      public boolean hasAllowPatterns()
      Returns true if this filter has any allow patterns configured.
      Returns:
      true if allowlist is non-empty

    • hasDenyPatterns

      public boolean hasDenyPatterns()
      Returns true if this filter has any deny patterns configured.
      Returns:
      true if denylist is non-empty