cageforge-policy-compose 0.2.0

// SPDX-License-Identifier: Apache-2.0

//! Caller-supplied identity for matching external enforcement boundaries.
//!
//! [`crate::ExternalOwner`] prevents unrelated declarations from being merged;
//! it is not a proof that an operating-system sandbox exists.

use std::sync::Arc;

/// An opaque proof that two external-enforcement declarations share one owner.
///
/// Cloning an owner preserves its identity. Independent owners do not compare
/// equal, so unrelated external boundaries cannot be composed accidentally.
/// This identity is a trusted caller declaration only; it does not prove that
/// an external sandbox exists or that it enforces the declared boundary.
/// The `Arc<()>` payload stores no platform or harness data: the allocation's
/// identity is the proof, and `Arc::ptr_eq` is the comparison. This keeps the
/// type reusable wherever one trusted enforcement boundary owns both sides.
///
/// This type intentionally has no [`Default`] implementation. Every owner
/// must be created explicitly with [`Self::new`], because a default value
/// would be a fresh owner identity rather than a shared enforcement boundary.
///
/// ```compile_fail
/// use cageforge_policy_compose::ExternalOwner;
/// let _ = ExternalOwner::default();
/// ```
#[derive(Clone)]
pub struct ExternalOwner(Arc<()>);

impl ExternalOwner {
    /// Creates a new external-enforcement owner identity.
    #[allow(clippy::new_without_default)]
    pub fn new() -> Self {
        Self(Arc::new(()))
    }
}

impl std::fmt::Debug for ExternalOwner {
    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        formatter
            .debug_struct("ExternalOwner")
            .finish_non_exhaustive()
    }
}

impl PartialEq for ExternalOwner {
    fn eq(&self, other: &Self) -> bool {
        Arc::ptr_eq(&self.0, &other.0)
    }
}

impl Eq for ExternalOwner {}