工具调用的结构、授权与业务契约

"""A specific tool's manual validator, not a JSON Schema implementation."""
import json


def validate_shape(params):
    if type(params) is not dict or set(params) != {"account", "amount_cents"}:
        raise ValueError("shape")
    if not isinstance(params["account"], str) or not params["account"]:
        raise ValueError("account")
    if type(params["amount_cents"]) is not int or params["amount_cents"] <= 0:
        raise ValueError("amount")


def authorize(params, actor, accounts):
    validate_shape(params)
    account = accounts.get(params["account"])
    if account is None or account["tenant"] != actor["tenant"]:
        raise PermissionError("not allowed")
    if "pay" not in actor["permissions"]:
        raise PermissionError("not allowed")
    if params["amount_cents"] > account["balance"]:
        raise ValueError("balance")


def demo():
    params = dict(account="B", amount_cents=100)
    actor = dict(tenant="tenant-a", permissions=["pay"])
    accounts = {"B": dict(tenant="tenant-b", balance=1000)}
    validate_shape(params)
    try:
        authorize(params, actor, accounts)
    except PermissionError:
        return dict(shape_valid=True, authorized=False, business_writes=0)
    raise AssertionError("cross-tenant request was accepted")


if __name__ == "__main__":
    print(json.dumps(demo(), sort_keys=True))