Struct SandboxedPlugin 

pub struct SandboxedPlugin { /* private fields */ }

A sandboxed plugin, ready to mount.

Clone shares the compiled host, the concurrency permits, the capability backends and the activity log rather than copying them — so registering a clone with RenderSlots and then installing the original as a Plugin gives one plugin with one ceiling and one ledger, not two of each.

Implementations

impl SandboxedPlugin

pub fn new(host: SandboxHost) -> Self

Wrap an already-compiled host.

pub fn with_services(self, services: CapabilityServices) -> Self

Wire the backends this plugin’s granted capabilities need (issue #1632).

Anything left unwired stays unwired: a call to a capability with no backend is answered unavailable and recorded, which is the same shape as every other refusal and not a silent success.

services.tenant is ignored — the tenant is the request’s, resolved per request — and services.rate may replace the limiter built from the manifest, for an embedder that wants one shared across a fleet.

May, not does: a replacement is taken only when it is no looser than the manifest’s. Sharing limiting state across instances is what this is for; raising the ceiling is not, and silently allowing it would make the calls_per_second on the consent screen a number the operator approved and the plugin need not obey. A looser limiter is ignored and the manifest’s kept, so wiring one by mistake costs coordination rather than containment.

pub fn activity(&self) -> Arc<PluginActivityLog>

What this plugin has done, for the operator audit surface.

Shared with every mounted route, so a caller that keeps this handle sees activity as it happens rather than a copy taken at mount.

pub fn from_artifact( artifact: &SandboxArtifact, ) -> Result<Self, SandboxPluginError>

Load a verified artifact.

Errors

Returns SandboxPluginError::Load if the module does not compile or imports something the sandbox does not provide.

pub fn from_file(path: &Path) -> Result<Self, SandboxPluginError>

Read, verify and load a .autumn-plugin file.

Errors

Returns SandboxPluginError::Artifact if the file is missing, malformed, or does not match its declared digest, and SandboxPluginError::Load if the module cannot be sandboxed.

pub fn manifest(&self) -> &SandboxManifest

The manifest this plugin is mounted under.

pub async fn render_slot( &self, slot: &str, context: &[(String, String)], ) -> Option<String>

Fill one render slot (issue #1632).

Returns None — meaning omit the fragment — for every failure there is: the slot was not granted, the guest trapped, it ran out of fuel, it answered with something this build will not emit, or it overran the render_bytes quota. A render hook is decoration on somebody else’s page, and there is no failure of a plugin’s that should become a failure of the page.

Runs on a blocking worker for the same reason a request does, and holds a concurrency permit for the same reason: a slot on a hot page is as many concurrent interpreters as the page has readers.

pub fn mounted_router<S>(&self) -> Router<S>

where S: Clone + Send + Sync + 'static,

This plugin, mounted at the prefix its own manifest declares.

The public door, for a test or an embedder that wants the routes without an AppBuilder. It nests at self.manifest().prefix and nowhere else: a caller that could choose the prefix could mount a plugin over a namespace its manifest never named, and the prefix would stop being a containment boundary.

Generic over the router’s state because the handlers use none — a sandboxed plugin has no access to application state, which is the point.

Prefer installing it as a Plugin, which also logs the capability grant and declares the routes for autumn routes and autumn plugin-check.

Trait Implementations

impl Clone for SandboxedPlugin

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxedPlugin

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Plugin for SandboxedPlugin

fn name(&self) -> Cow<'static, str>

Stable identifier used for duplicate-registration detection.

fn build(self, app: AppBuilder) -> AppBuilder

Apply this plugin’s configuration to the builder.

fn contract(&self) -> Option<PluginContract>

Declare which autumn-web versions this plugin supports, and any experimental surface it knowingly depends on.