add allow commands list

tests/test_client_config.py

@@ -0,0 +1,42 @@
+import pytest
+
+from nexus_sync.client.config import COMMAND_ACCESS_ENV, load_command_access_policy
+from nexus_sync.client.execute import CommandAccessPolicy
+
+
+def test_load_command_access_policy_defaults_to_deny_all() -> None:
+    policy = load_command_access_policy({})
+
+    assert not policy.full_access
+    assert not policy.allows("hostname")
+
+
+def test_load_command_access_policy_uses_default_when_env_is_missing() -> None:
+    default = CommandAccessPolicy.allow(["hostname"])
+
+    policy = load_command_access_policy({}, default=default)
+
+    assert policy == default
+
+
+def test_load_command_access_policy_supports_command_allowlist() -> None:
+    policy = load_command_access_policy(
+        {COMMAND_ACCESS_ENV: "hostname, network_interfaces"},
+    )
+
+    assert policy.allows("hostname")
+    assert policy.allows("network_interfaces")
+    assert not policy.allows("unknown")
+
+
+def test_load_command_access_policy_supports_full_access() -> None:
+    policy = load_command_access_policy({COMMAND_ACCESS_ENV: "full_access"})
+
+    assert policy.full_access
+    assert policy.allows("hostname")
+    assert policy.allows("future_registered_preset")
+
+
+def test_load_command_access_policy_rejects_mixed_full_access() -> None:
+    with pytest.raises(ValueError, match="cannot be mixed"):
+        load_command_access_policy({COMMAND_ACCESS_ENV: "hostname,full_access"})