Harden Confluence search and return its sources and let trusted providers continue chats that hold confidential tool results

app/MindWork AI Studio/Tools/Web/WebPageAccessBlockReason.cs

@@ -8,4 +8,5 @@ public enum WebPageAccessBlockReason
     NEVER_ALLOWED_ADDRESS,
     PRIVATE_HOST_NOT_ALLOWED,
     INSUFFICIENT_PROVIDER_CONFIDENCE,
+    TARGET_NOT_ALLOWED,
 }

app/MindWork AI Studio/Tools/Web/WebPageRetrievalOptions.cs

@@ -30,5 +30,20 @@ public sealed class WebPageRetrievalOptions
 
     public Func<string, bool>? IsPrivateHostAllowed { get; init; }
 
+    /// <summary>
+    /// Decides for every URL, the first one as well as each redirect target, whether it may be
+    /// requested at all. It runs before anything is sent, so a refused target never sees the URL.
+    /// </summary>
+    public Func<Uri, bool>? IsTargetAllowed { get; init; }
+
+    /// <summary>
+    /// Allows the operating system's sign-in for a host which resolves to public addresses.
+    /// </summary>
+    /// <remarks>
+    /// Without it, the sign-in is only sent to allowed private hosts. Use it only for a host
+    /// which the user or the organization configured, never for one a model named.
+    /// </remarks>
+    public Func<string, bool>? IsOsSsoAllowedForPublicHost { get; init; }
+
     public Func<Uri, ConfidenceLevel, Task>? OnPrivateHostProviderBlockAsync { get; init; }
 }

app/MindWork AI Studio/Tools/Web/WebPageRetrievalService.cs

@@ -92,6 +92,9 @@ public sealed class WebPageRetrievalService(HTMLParser htmlParser)
         if (url is not { Scheme: "http" or "https" })
             throw new WebPageAccessBlockedException("Only HTTP and HTTPS URLs are supported.", WebPageAccessBlockReason.UNSUPPORTED_SCHEME);
 
+        if (options.IsTargetAllowed?.Invoke(url) is false)
+            throw new WebPageAccessBlockedException($"The web page '{url.GetLeftPart(UriPartial.Path)}' is outside the targets this request may reach.", WebPageAccessBlockReason.TARGET_NOT_ALLOWED);
+
         if (!options.TargetChosenByUser && IsBlockedHostName(url.Host))
             throw new WebPageAccessBlockedException("Local web page URLs are not supported.", WebPageAccessBlockReason.LOCAL_HOST_NAME);
 
@@ -158,9 +161,10 @@ public sealed class WebPageRetrievalService(HTMLParser htmlParser)
         originalUrl.Host.Equals(candidateUrl.Host, StringComparison.OrdinalIgnoreCase) &&
         originalUrl.Port == candidateUrl.Port &&
         !IsBlockedHostName(candidateUrl.Host) &&
-        options.IsPrivateHostAllowed?.Invoke(candidateUrl.Host) is true &&
         addresses.Count > 0 &&
-        addresses.All(IsNonPublicAddress);
+        (addresses.All(IsNonPublicAddress)
+            ? options.IsPrivateHostAllowed?.Invoke(candidateUrl.Host) is true
+            : options.IsOsSsoAllowedForPublicHost?.Invoke(candidateUrl.Host) is true);
 
     private static IPAddress NormalizeAddress(IPAddress address) => address.IsIPv4MappedToIPv6 ? address.MapToIPv4() : address;