fix(cli): accept allow-encoded-slash in policy update

Also merge the two protocol check helpers into one.

Signed-off-by: Eric Curtin <eric.curtin@docker.com>

Author: ericcurtin

crates/openshell-cli/src/main.rs

@@ -2191,8 +2191,8 @@ enum PolicyCommands {
         name: Option<String>,
 
         /// Add or merge an endpoint: host:port[:access[:protocol[:enforcement[:options]]]].
-        /// Options include allowed-ip=..., credential rewrite flags, and
-        /// allow-uninspected-credentials.
+        /// Options include allowed-ip=..., allow-encoded-slash, credential
+        /// rewrite flags, and allow-uninspected-credentials.
         #[arg(long = "add-endpoint")]
         add_endpoints: Vec<String>,
 

crates/openshell-cli/src/policy_update.rs

@@ -268,37 +268,28 @@ fn l7_target_to_proto(target: &L7RuleTarget) -> ProtoL7RuleTarget {
     }
 }
 
-fn ensure_websocket_credential_rewrite_protocol(
+/// Require the endpoint protocol segment to be one of `allowed` for `option`.
+fn ensure_option_protocol(
     spec: &str,
     endpoint: &NetworkEndpoint,
+    option: &str,
+    allowed: &[&str],
 ) -> Result<()> {
-    if matches!(endpoint.protocol.as_str(), "rest" | "websocket") {
+    if allowed.contains(&endpoint.protocol.as_str()) {
         return Ok(());
     }
     let protocol = if endpoint.protocol.is_empty() {
         "<empty>"
     } else {
         endpoint.protocol.as_str()
     };
+    let allowed = allowed
+        .iter()
+        .map(|protocol| format!("'{protocol}'"))
+        .collect::<Vec<_>>()
+        .join(" or ");
     Err(miette!(
-        "websocket-credential-rewrite endpoint option requires --add-endpoint protocol segment to be 'rest' or 'websocket'; got '{protocol}' in '{spec}'"
-    ))
-}
-
-fn ensure_request_body_credential_rewrite_protocol(
-    spec: &str,
-    endpoint: &NetworkEndpoint,
-) -> Result<()> {
-    if endpoint.protocol == "rest" {
-        return Ok(());
-    }
-    let protocol = if endpoint.protocol.is_empty() {
-        "<empty>"
-    } else {
-        endpoint.protocol.as_str()
-    };
-    Err(miette!(
-        "request-body-credential-rewrite endpoint option requires --add-endpoint protocol segment to be 'rest'; got '{protocol}' in '{spec}'"
+        "{option} endpoint option requires --add-endpoint protocol segment to be {allowed}; got '{protocol}' in '{spec}'"
     ))
 }
 
@@ -504,12 +495,16 @@ fn apply_add_endpoint_options(
             "allow-uninspected-credentials" => {
                 endpoint.allow_uninspected_credentials = true;
             }
+            "allow-encoded-slash" => {
+                ensure_option_protocol(spec, endpoint, option, &["rest", "websocket"])?;
+                endpoint.allow_encoded_slash = true;
+            }
             "websocket-credential-rewrite" => {
-                ensure_websocket_credential_rewrite_protocol(spec, endpoint)?;
+                ensure_option_protocol(spec, endpoint, option, &["rest", "websocket"])?;
                 endpoint.websocket_credential_rewrite = true;
             }
             "request-body-credential-rewrite" => {
-                ensure_request_body_credential_rewrite_protocol(spec, endpoint)?;
+                ensure_option_protocol(spec, endpoint, option, &["rest"])?;
                 endpoint.request_body_credential_rewrite = true;
             }
             _ if option.starts_with(ALLOWED_IP_OPTION_PREFIX) => {
@@ -521,7 +516,7 @@ fn apply_add_endpoint_options(
             }
             _ => {
                 return Err(miette!(
-                    "--add-endpoint options segment supports only 'allow-uninspected-credentials', 'websocket-credential-rewrite', 'request-body-credential-rewrite', and 'allowed-ip=<CIDR-or-IP>'; got '{option}' in '{spec}'"
+                    "--add-endpoint options segment supports only 'allow-uninspected-credentials', 'allow-encoded-slash', 'websocket-credential-rewrite', 'request-body-credential-rewrite', and 'allowed-ip=<CIDR-or-IP>'; got '{option}' in '{spec}'"
                 ));
             }
         }
@@ -831,6 +826,45 @@ mod tests {
         assert!(endpoint.request_body_credential_rewrite);
     }
 
+    #[test]
+    fn parse_add_endpoint_enables_allow_encoded_slash_on_rest_and_websocket() {
+        for protocol in ["rest", "websocket"] {
+            let plan = build_policy_update_plan(
+                &[format!(
+                    "registry.npmjs.org:443:full:{protocol}:enforce:allow-encoded-slash"
+                )],
+                &[],
+                &[],
+                &[],
+                &[],
+                &[],
+                None,
+            )
+            .expect("plan should build");
+
+            let PolicyMergeOp::AddRule { rule, .. } = &plan.preview_operations[0] else {
+                panic!("expected add-rule preview");
+            };
+            assert!(rule.endpoints[0].allow_encoded_slash, "{protocol}");
+        }
+    }
+
+    #[test]
+    fn allow_encoded_slash_rejects_endpoint_without_http_protocol() {
+        for spec in [
+            "registry.npmjs.org:443::::allow-encoded-slash",
+            "registry.npmjs.org:443::tcp::allow-encoded-slash",
+        ] {
+            let error =
+                build_policy_update_plan(&[spec.to_string()], &[], &[], &[], &[], &[], None)
+                    .expect_err("plan should fail");
+            assert!(
+                error.to_string().contains("to be 'rest' or 'websocket'"),
+                "{error}"
+            );
+        }
+    }
+
     #[test]
     fn parse_add_endpoint_enables_allow_uninspected_credentials() {
         let plan = build_policy_update_plan(

docs/how-it-works/policies/network-rules.mdx

@@ -340,6 +340,10 @@ request, which the read-only preset denies. Run `npm install --no-audit`, or
 replace `access: read-only` with explicit rules that also allow the audit's
 `POST` requests. An endpoint cannot combine `access` and `rules`.
 
+To set the option on a live sandbox without replacing the policy, add
+`allow-encoded-slash` to the `--add-endpoint` options segment of
+`openshell policy update`, which requires a `rest` or `websocket` endpoint.
+
 Verify that a scoped package lookup succeeds:
 
 ```shell