test

Signed-off-by: Roman Nikitenko <rnikiten@redhat.com>

Author: RomanNikitenko

code/src/vs/platform/extensionManagement/common/extensionManagement.ts

@@ -709,6 +709,7 @@ export async function computeSize(location: URI, fileService: IFileService): Pro
 export const ExtensionsLocalizedLabel = localize2('extensions', "Extensions");
 export const PreferencesLocalizedLabel = localize2('preferences', 'Preferences');
 export const AllowedExtensionsConfigKey = 'extensions.allowed';
+export const BlockNonGalleryExtensionsConfigKey = 'extensions.blockNonGalleryExtensions';
 export const VerifyExtensionSignatureConfigKey = 'extensions.verifySignature';
 
 Registry.as<IConfigurationRegistry>(Extensions.Configuration)
@@ -781,6 +782,17 @@ Registry.as<IConfigurationRegistry>(Extensions.Configuration)
 						],
 					}
 				}
+			},
+			[BlockNonGalleryExtensionsConfigKey]: {
+				type: 'boolean',
+				markdownDescription: localize('extensions.blockNonGalleryExtensions', "When enabled and the allowed extensions policy is configured, blocks installation of non-gallery extensions (VSIX files and resource extensions). Only extensions from the gallery can be installed."),
+				default: false,
+				scope: ConfigurationScope.APPLICATION,
+				policy: {
+					name: 'BlockNonGalleryExtensions',
+					minimumVersion: '1.96',
+					description: localize('extensions.blockNonGalleryExtensions.policy', "When enabled and the allowed extensions policy is configured, blocks installation of non-gallery extensions (VSIX files and resource extensions). Only extensions from the gallery can be installed."),
+				},
 			}
 		}
 	});

code/src/vs/server/node/serverEnvironmentService.ts

@@ -3,6 +3,7 @@
  *  Licensed under the MIT License. See License.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 
+import * as fs from 'fs';
 import * as nls from '../../nls.js';
 
 import { NativeEnvironmentService } from '../../platform/environment/node/environmentService.js';
@@ -14,6 +15,7 @@ import { URI } from '../../base/common/uri.js';
 import { joinPath } from '../../base/common/resources.js';
 import { join } from '../../base/common/path.js';
 
+export const POLICY_FILE_PATH = '/checode-config/policy.json';
 export const serverOptions: OptionDescriptions<Required<ServerParsedArgs>> = {
 
 	/* ----- server setup ----- */
@@ -239,5 +241,12 @@ export class ServerEnvironmentService extends NativeEnvironmentService implement
 	get machineSettingsResource(): URI { return joinPath(URI.file(join(this.userDataPath, 'Machine')), 'settings.json'); }
 	@memoize
 	get mcpResource(): URI { return joinPath(URI.file(join(this.userDataPath, 'User')), 'mcp.json'); }
+	@memoize
+	override get policyFile(): URI | undefined {
+		if (fs.existsSync(POLICY_FILE_PATH)) {
+			return URI.file(POLICY_FILE_PATH);
+		}
+		return super.policyFile;
+	}
 	override get args(): ServerParsedArgs { return super.args as ServerParsedArgs; }
 }

code/src/vs/server/node/serverServices.ts

@@ -65,7 +65,9 @@ import { IExtensionsScannerService } from '../../platform/extensionManagement/co
 import { ExtensionsScannerService } from './extensionsScannerService.js';
 import { IExtensionsProfileScannerService } from '../../platform/extensionManagement/common/extensionsProfileScannerService.js';
 import { IUserDataProfilesService } from '../../platform/userDataProfile/common/userDataProfile.js';
-import { NullPolicyService } from '../../platform/policy/common/policy.js';
+import { IPolicyService, NullPolicyService } from '../../platform/policy/common/policy.js';
+import { FilePolicyService } from '../../platform/policy/common/filePolicyService.js';
+import { PolicyChannel } from '../../platform/policy/common/policyIpc.js';
 import { OneDataSystemAppender } from '../../platform/telemetry/node/1dsAppender.js';
 import { LoggerService } from '../../platform/log/node/loggerService.js';
 import { ServerUserDataProfilesService } from '../../platform/userDataProfile/node/userDataProfile.js';
@@ -138,8 +140,17 @@ export async function setupServerServices(connectionToken: ServerConnectionToken
 	const uriIdentityService = new UriIdentityService(fileService);
 	services.set(IUriIdentityService, uriIdentityService);
 
+	let policyService: IPolicyService;
+	if (environmentService.policyFile) {
+		policyService = disposables.add(new FilePolicyService(environmentService.policyFile, fileService, logService));
+		logService.info(`Using policy file: ${environmentService.policyFile.fsPath}`);
+	} else {
+		policyService = new NullPolicyService();
+		logService.info('Policy file not found');
+	}
+
 	// Configuration
-	const configurationService = new ConfigurationService(environmentService.machineSettingsResource, fileService, new NullPolicyService(), logService);
+	const configurationService = new ConfigurationService(environmentService.machineSettingsResource, fileService, policyService, logService);
 	services.set(IConfigurationService, configurationService);
 
 	// User Data Profiles
@@ -258,6 +269,9 @@ export async function setupServerServices(connectionToken: ServerConnectionToken
 
 		socketServer.registerChannel('mcpManagement', new McpManagementChannel(mcpManagementService, (ctx: RemoteAgentConnectionContext) => getUriTransformer(ctx.remoteAuthority)));
 
+		// Policy Channel - register after policy service is initialized
+		socketServer.registerChannel('policy', new PolicyChannel(policyService));
+
 		// clean up extensions folder
 		remoteExtensionsScanner.whenExtensionsReady().then(() => extensionManagementService.cleanUp());
 

code/src/vs/workbench/browser/web.main.ts

@@ -68,7 +68,8 @@ import { IProgressService } from '../../platform/progress/common/progress.js';
 import { DelayedLogChannel } from '../services/output/common/delayedLogChannel.js';
 import { dirname, joinPath } from '../../base/common/resources.js';
 import { IUserDataProfile, IUserDataProfilesService } from '../../platform/userDataProfile/common/userDataProfile.js';
-import { NullPolicyService } from '../../platform/policy/common/policy.js';
+import { IPolicyService, NullPolicyService } from '../../platform/policy/common/policy.js';
+import { PolicyChannelClient } from '../../platform/policy/common/policyIpc.js';
 import { IRemoteExplorerService } from '../services/remote/common/remoteExplorerService.js';
 import { DisposableTunnel, TunnelProtocol } from '../../platform/tunnel/common/tunnel.js';
 import { ILabelService } from '../../platform/label/common/label.js';
@@ -567,7 +568,32 @@ export class BrowserMain extends Disposable {
 		}
 
 		const configurationCache = new ConfigurationCache([Schemas.file, Schemas.vscodeUserData, Schemas.tmp] /* Cache all non native resources */, environmentService, fileService);
-		const workspaceService = new WorkspaceService({ remoteAuthority: this.configuration.remoteAuthority, configurationCache }, environmentService, userDataProfileService, userDataProfilesService, fileService, remoteAgentService, uriIdentityService, logService, new NullPolicyService());
+		
+		// Get policy service from remote agent if available, otherwise use NullPolicyService
+		let policyService: IPolicyService;
+		if (this.configuration.remoteAuthority) {
+			try {
+				const connection = remoteAgentService.getConnection();
+				if (connection) {
+					const policyChannel = connection.getChannel('policy');
+					// PolicyChannelClient needs initial policiesData - start with empty object, policies will be loaded when definitions are registered
+					policyService = new PolicyChannelClient({}, policyChannel);
+					logService.info('Policy channel client was created successfully');
+				} else {
+					logService.warn('Failed to get remote aget connection, using NullPolicyService');
+					policyService = new NullPolicyService();
+				}
+			} catch (error) {
+				console.log('/// web main /// connection - ERROR ');
+				logService.warn('Failed to create policy channel client, using NullPolicyService', error);
+				policyService = new NullPolicyService();
+			}
+		} else {
+			logService.warn('Failed to create policy channel client(no remote authority), using NullPolicyService');
+			policyService = new NullPolicyService();
+		}
+		
+		const workspaceService = new WorkspaceService({ remoteAuthority: this.configuration.remoteAuthority, configurationCache }, environmentService, userDataProfileService, userDataProfilesService, fileService, remoteAgentService, uriIdentityService, logService, policyService);
 
 		try {
 			await workspaceService.initialize(workspace);

code/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts

@@ -21,6 +21,7 @@ import {
 	TargetPlatformToString,
 	IAllowedExtensionsService,
 	AllowedExtensionsConfigKey,
+	BlockNonGalleryExtensionsConfigKey,
 	EXTENSION_INSTALL_SKIP_PUBLISHER_TRUST_CONTEXT,
 	ExtensionManagementError,
 	ExtensionManagementErrorCode,
@@ -2406,6 +2407,12 @@ export class ExtensionsWorkbenchService extends Disposable implements IExtension
 		}
 
 		if (extension.gallery) {
+			// Check if extension is allowed first (before checking platform compatibility or signing)
+			const allowedResult = this.allowedExtensionsService.isAllowed({ id: extension.gallery.identifier.id, publisherDisplayName: extension.gallery.publisherDisplayName });
+			if (allowedResult !== true) {
+				return new MarkdownString(nls.localize('extension not allowed to install', "This extension cannot be installed because it is not in the allowed list."));
+			}
+
 			if (!extension.gallery.isSigned && shouldRequireRepositorySignatureFor(extension.private, await this.extensionGalleryManifestService.getExtensionGalleryManifest())) {
 				return new MarkdownString().appendText(nls.localize('not signed', "This extension is not signed."));
 			}
@@ -2428,6 +2435,13 @@ export class ExtensionsWorkbenchService extends Disposable implements IExtension
 			return localResult ?? remoteResult ?? webResult ?? new MarkdownString().appendText(nls.localize('cannot be installed', "Cannot install the '{0}' extension because it is not available in this setup.", extension.displayName ?? extension.identifier.id));
 		}
 
+		// Block non-gallery extensions if the policy is configured and blockNonGalleryExtensions is enabled
+		const blockNonGallery = this.configurationService.getValue<boolean>(BlockNonGalleryExtensionsConfigKey);
+		const hasPolicy = this.configurationService.inspect(AllowedExtensionsConfigKey).policy !== undefined;
+		if (hasPolicy && blockNonGallery) {
+			return new MarkdownString(nls.localize('non-gallery extension not allowed', "This extension cannot be installed because only extensions from the gallery are allowed. Please install this extension from the Extensions marketplace."));
+		}
+
 		if (extension.resourceExtension && await this.extensionManagementService.canInstall(extension.resourceExtension) === true) {
 			return true;
 		}
@@ -2564,9 +2578,21 @@ export class ExtensionsWorkbenchService extends Disposable implements IExtension
 				}
 			}
 			if (installable instanceof URI) {
+				// Block VSIX installations if the policy is configured and blockNonGalleryExtensions is enabled
+				const blockNonGallery = this.configurationService.getValue<boolean>(BlockNonGalleryExtensionsConfigKey);
+				const hasPolicy = this.configurationService.inspect(AllowedExtensionsConfigKey).policy !== undefined;
+				if (hasPolicy && blockNonGallery) {
+					throw new Error(nls.localize('vsix not allowed', "VSIX files cannot be installed because only extensions from the gallery are allowed. Please install this extension from the Extensions marketplace."));
+				}
 				extension = await this.doInstall(undefined, () => this.installFromVSIX(installable, installOptions), progressLocation);
 			} else if (extension) {
 				if (extension.resourceExtension) {
+					// Block resource extension installations if the policy is configured and blockNonGalleryExtensions is enabled
+					const blockNonGallery = this.configurationService.getValue<boolean>(BlockNonGalleryExtensionsConfigKey);
+					const hasPolicy = this.configurationService.inspect(AllowedExtensionsConfigKey).policy !== undefined;
+					if (hasPolicy && blockNonGallery) {
+						throw new Error(nls.localize('resource extension not allowed', "Resource extensions cannot be installed because only extensions from the gallery are allowed. Please install this extension from the Extensions marketplace."));
+					}
 					extension = await this.doInstall(extension, () => this.extensionManagementService.installResourceExtension(installable as IResourceExtension, installOptions), progressLocation);
 				} else {
 					extension = await this.doInstall(extension, () => this.installFromGallery(extension!, installable as IGalleryExtension, installOptions, servers), progressLocation);