refactor(policy): extract shared L7 endpoint validation

[gracesmith6504]

Summary

• Extract 9 L7 endpoint semantic checks into a shared validate_l7_endpoint_semantics() function in openshell-policy
• Both profile lint (openshell-providers) and the runtime validator (openshell-supervisor-network) now call the shared function via a lightweight L7EndpointFields field bag, eliminating duplication
• Update server test fixtures that used protocol without rules or access, which the shared validator now correctly rejects

Related Issue

Fixes NVIDIA#1714

Changes

File	Change
crates/openshell-policy/src/l7_validate.rs	New shared validation module with L7Protocol enum, L7EndpointFields struct, validate_l7_endpoint_semantics() function, and 14 unit tests
crates/openshell-policy/src/lib.rs	Re-export shared validation types
crates/openshell-providers/Cargo.toml	Add openshell-policy dependency
crates/openshell-providers/src/profiles.rs	Replace inline L7 checks with shared function call; add 5 integration tests
crates/openshell-supervisor-network/src/l7/mod.rs	Replace 9 duplicated checks with shared function call
crates/openshell-server/src/grpc/policy.rs	Fix test fixture: add access: "full" to endpoint with protocol
crates/openshell-server/src/grpc/provider.rs	Fix 3 test fixtures: add access: "full" to endpoints with protocol

Testing

• All 145 openshell-policy tests pass (14 new)
• All 85 openshell-providers tests pass (5 new)
• All 948 openshell-supervisor-network tests pass
• All 971 openshell-server tests pass (7 fixtures updated)
• mise run ci passes (full lint + clippy + tests)

Checklist

• Conventional commit format
• DCO sign-off
• No AI attribution
• Pre-commit checks pass

Summary by CodeRabbit

• New Features

  • Added shared L7 endpoint semantic validation covering REST, WebSocket, GraphQL, SQL, JSON-RPC, and MCP, enforcing protocol/access/rules/deny-rules consistency and JSON-RPC/MCP-specific constraints.

• Bug Fixes

  • Provider profile linting and supervisor runtime policy validation now use the same semantic validator, producing consistent endpoint diagnostics (including cases that would deny all traffic).

• Tests

  • Expanded unit tests for protocol parsing/classification and rule combinations, and updated integration round-trip assertions to reflect the new validation behavior.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 69fb8714-efef-4699-b0fd-0693723d17d5

📥 Commits

Reviewing files that changed from the base of the PR and between 9a4f8a8 and d9510ee.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• crates/openshell-policy/src/l7_validate.rs
• crates/openshell-policy/src/lib.rs
• crates/openshell-providers/Cargo.toml
• crates/openshell-providers/src/profiles.rs
• crates/openshell-server/src/grpc/policy.rs
• crates/openshell-server/src/grpc/provider.rs
• crates/openshell-supervisor-network/src/l7/mod.rs

---

📝 Walkthrough

Walkthrough

Adds shared L7 endpoint semantic validation for protocol, access, rules, and deny-rules constraints. Provider profile linting and runtime policy validation now use the shared validator, with expanded tests and updated endpoint fixtures.

Changes

L7 Endpoint Validation

Layer / File(s)	Summary
Shared L7 semantic validator crates/openshell-policy/src/l7_validate.rs, crates/openshell-policy/src/lib.rs	Defines reusable protocol parsing, endpoint validation inputs, semantic checks, public exports, and unit tests.
Provider profile lint integration crates/openshell-providers/Cargo.toml, crates/openshell-providers/src/profiles.rs	Runs shared validation during profile linting, emits endpoint diagnostics, and updates round-trip and semantic validation tests.
Runtime policy validation integration crates/openshell-supervisor-network/src/l7/mod.rs, crates/openshell-server/src/grpc/policy.rs, crates/openshell-server/src/grpc/provider.rs	Delegates endpoint-level checks to the shared validator, retains per-deny-rule validation, and updates affected fixtures with explicit access values.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ProfileLint
  participant SharedL7Validator
  participant RuntimePolicyValidator
  participant Diagnostics
  ProfileLint->>SharedL7Validator: validate endpoint fields
  SharedL7Validator-->>ProfileLint: return semantic errors
  ProfileLint->>Diagnostics: emit endpoint diagnostics
  RuntimePolicyValidator->>SharedL7Validator: validate endpoint fields
  SharedL7Validator-->>RuntimePolicyValidator: return semantic errors

Loading

Possibly related PRs

• gracesmith6504/OpenShell#2: Extends related L7 protocol, rules, access, and deny-rules validation in provider profile handling.

Suggested reviewers: derekwaynecarr, drew, johntmyers

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1714-shared-l7-validation

---

_{Comment @coderabbitai help to get the list of available commands.}

[gracesmith6504]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[gracesmith6504]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[gracesmith6504]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

✅ Action performed

Full review finished.