add allow commands list

tests/test_client_config.py

@@ -0,0 +1,42 @@
+import pytest
+
+from nexus_sync.client.config import COMMAND_ACCESS_ENV, load_command_access_policy
+from nexus_sync.client.execute import CommandAccessPolicy
+
+
+def test_load_command_access_policy_defaults_to_deny_all() -> None:
+    policy = load_command_access_policy({})
+
+    assert not policy.full_access
+    assert not policy.allows("hostname")
+
+
+def test_load_command_access_policy_uses_default_when_env_is_missing() -> None:
+    default = CommandAccessPolicy.allow(["hostname"])
+
+    policy = load_command_access_policy({}, default=default)
+
+    assert policy == default
+
+
+def test_load_command_access_policy_supports_command_allowlist() -> None:
+    policy = load_command_access_policy(
+        {COMMAND_ACCESS_ENV: "hostname, network_interfaces"},
+    )
+
+    assert policy.allows("hostname")
+    assert policy.allows("network_interfaces")
+    assert not policy.allows("unknown")
+
+
+def test_load_command_access_policy_supports_full_access() -> None:
+    policy = load_command_access_policy({COMMAND_ACCESS_ENV: "full_access"})
+
+    assert policy.full_access
+    assert policy.allows("hostname")
+    assert policy.allows("future_registered_preset")
+
+
+def test_load_command_access_policy_rejects_mixed_full_access() -> None:
+    with pytest.raises(ValueError, match="cannot be mixed"):
+        load_command_access_policy({COMMAND_ACCESS_ENV: "hostname,full_access"})

tests/test_execute.py

@@ -1,6 +1,6 @@
 import subprocess
 
-from nexus_sync.client.execute import execute_command
+from nexus_sync.client.execute import CommandAccessPolicy, execute_command
 from nexus_sync.common import Command, CommandKind, CommandResultStatus
 
 
@@ -51,6 +51,62 @@ def test_execute_command_rejects_unknown_preset() -> None:
     assert "unknown command preset" in result.stderr
 
 
+def test_execute_command_allows_selected_preset(monkeypatch) -> None:
+    calls = []
+
+    def fake_run(argv, **kwargs):
+        calls.append(argv)
+        return subprocess.CompletedProcess(argv, 0, stdout="host\n", stderr="")
+
+    monkeypatch.setattr(subprocess, "run", fake_run)
+
+    result = execute_command(
+        _command(),
+        access_policy=CommandAccessPolicy.allow(["hostname"]),
+    )
+
+    assert result.status == CommandResultStatus.SUCCEEDED
+    assert calls == [["hostname"]]
+
+
+def test_execute_command_rejects_disallowed_preset(monkeypatch) -> None:
+    calls = []
+
+    def fake_run(argv, **kwargs):
+        calls.append(argv)
+        return subprocess.CompletedProcess(argv, 0, stdout="host\n", stderr="")
+
+    monkeypatch.setattr(subprocess, "run", fake_run)
+
+    result = execute_command(
+        _command(name="hostname"),
+        access_policy=CommandAccessPolicy.allow(["network_interfaces"]),
+    )
+
+    assert result.status == CommandResultStatus.REJECTED
+    assert result.return_code is None
+    assert "not allowed" in result.stderr
+    assert calls == []
+
+
+def test_execute_command_full_access_allows_registered_presets(monkeypatch) -> None:
+    calls = []
+
+    def fake_run(argv, **kwargs):
+        calls.append(argv)
+        return subprocess.CompletedProcess(argv, 0, stdout="host\n", stderr="")
+
+    monkeypatch.setattr(subprocess, "run", fake_run)
+
+    result = execute_command(
+        _command(name="hostname"),
+        access_policy=CommandAccessPolicy.allow_all(),
+    )
+
+    assert result.status == CommandResultStatus.SUCCEEDED
+    assert calls == [["hostname"]]
+
+
 def test_execute_command_maps_non_zero_exit_to_failed(monkeypatch) -> None:
     def fake_run(argv, **kwargs):
         return subprocess.CompletedProcess(argv, 2, stdout="", stderr="failed\n")