beamr 0.4.5

A Rust runtime with the BEAM's execution model, targeting Gleam
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

//! Sandboxed execution environment presets.
//!
//! Sandboxes are fixed [`CapabilitySet`] presets used when creating a process.
//! They intentionally wrap the canonical native capability model rather than
//! introducing a separate authority taxonomy.

use crate::native::{Capability, CapabilitySet};

/// Named capability presets for sandboxed process execution.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
pub enum Sandbox {
    /// No native capabilities. The process can only perform computation that
    /// does not cross the native capability boundary.
    Pure,
    /// File, network, environment, and other external I/O; no process spawn.
    Worker,
    /// Process-supervision authority; no direct external I/O.
    Supervisor,
    /// Every known capability.
    #[default]
    Unrestricted,
}

impl Sandbox {
    /// Returns the fixed capability set granted by this sandbox profile.
    #[must_use]
    pub fn capabilities(self) -> CapabilitySet {
        match self {
            Self::Pure => CapabilitySet::from_slice(&[]),
            Self::Worker => CapabilitySet::from_slice(&[Capability::ExternalIo]),
            Self::Supervisor => {
                CapabilitySet::from_slice(&[Capability::ProcessLocal, Capability::Spawn])
            }
            Self::Unrestricted => CapabilitySet::all(),
        }
    }
}

impl From<Sandbox> for CapabilitySet {
    fn from(sandbox: Sandbox) -> Self {
        sandbox.capabilities()
    }
}

#[cfg(test)]
mod tests {
    use super::Sandbox;
    use crate::native::{Capability, CapabilitySet};

    const ALL: [Capability; 6] = [
        Capability::Pure,
        Capability::ProcessLocal,
        Capability::Clock,
        Capability::Entropy,
        Capability::ExternalIo,
        Capability::Spawn,
    ];

    fn assert_exact_capabilities(sandbox: Sandbox, expected: &[Capability]) {
        let capabilities = sandbox.capabilities();
        for capability in ALL {
            assert_eq!(
                capabilities.contains(capability),
                expected.contains(&capability),
                "{sandbox:?} capability membership for {capability:?}"
            );
        }
        assert_eq!(capabilities.iter().count(), expected.len());
    }

    #[test]
    fn pure_sandbox_has_no_capabilities() {
        assert_exact_capabilities(Sandbox::Pure, &[]);
    }

    #[test]
    fn worker_sandbox_grants_external_io_without_spawn() {
        assert_exact_capabilities(Sandbox::Worker, &[Capability::ExternalIo]);
    }

    #[test]
    fn supervisor_sandbox_grants_process_supervision_without_io() {
        assert_exact_capabilities(
            Sandbox::Supervisor,
            &[Capability::ProcessLocal, Capability::Spawn],
        );
    }

    #[test]
    fn unrestricted_sandbox_grants_all_capabilities() {
        assert_eq!(Sandbox::Unrestricted.capabilities(), CapabilitySet::all());
        assert_exact_capabilities(Sandbox::Unrestricted, &ALL);
    }

    #[test]
    fn default_sandbox_is_unrestricted() {
        assert_eq!(Sandbox::default(), Sandbox::Unrestricted);
    }
}