harmos-runtime 0.1.4

Harmos runtime: managed state, undo, recovery, background work and typed streams.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

/* ***
 *
 * Harmos
 *
 * SPDX-License-Identifier: Apache-2.0
 *
 * ***
 */

/* === Modules === */

#[cfg(all(test, any(feature = "plugin", feature = "plugin-guest", feature = "plugin-sidecar")))]
mod tests {
    use super::*;
    use crate::operations::authorization::{Authorization, Required};
    use crate::operations::{WireDeclaration, host::Catalog};
    use harmos_domain::plugin::Grant;

    #[test]
    fn plugin_grants_preserved() {
        let contract = WireDeclaration::of::<Catalog>().contract().unwrap();
        let allowed = Grant::of("host.catalog", "allowed");
        let refused = Grant::of("host.catalog", "refused");
        let foreign = Grant::of("other.operation", "allowed");
        let mut authority = GrantAuthority {
            owner: "host".into(),
            operation: "host.catalog".into(),
            plugin: Some(("caller".into(), Some(Required { contract: contract.clone(), grants: vec![allowed.clone()] }))),
            external: Some(Authorization::Full(contract)),
        };

        authority.admit(Some(&allowed)).unwrap();
        assert!(matches!(authority.admit(Some(&refused)), Err(Error::OperationUnauthorized { caller, .. }) if caller == "caller"));
        assert!(matches!(authority.admit(Some(&foreign)), Err(Error::PermissionDenied)));

        authority.plugin = None;
        authority.admit(Some(&refused)).unwrap();
        assert!(matches!(authority.admit(Some(&foreign)), Err(Error::PermissionDenied)));
    }
}

/* === Re-Exports === */

/* === Imports === */

// Standard Library Imports

// Third Party Imports

// Local Imports
use super::*;

/* === Constants === */

/* === Macros === */

/* === Type Aliases === */

/* === Structs === */

/* === Enums === */

/* === Traits === */

/* === Implementations === */

impl GrantAuthority {
    // Refuse a request whose grant the caller does not hold. A request resolves
    // only to a grant on the operation it calls; a provider preparing a grant on
    // another operation is refused for every caller.
    pub(in crate::operations) fn admit(&self, grant: Option<&harmos_domain::plugin::Grant>) -> Result<()> {
        let denied = |caller: &str| Error::OperationUnauthorized {
            caller: caller.to_owned(),
            owner: self.owner.clone(),
            operation: self.operation.clone(),
        };
        if grant.is_some_and(|grant| grant.operation() != self.operation) {
            return Err(Error::PermissionDenied);
        }
        #[cfg(any(feature = "plugin", feature = "plugin-guest", feature = "plugin-sidecar"))]
        if let Some((caller, required)) = &self.plugin
            && !grant_allowed(required.as_ref(), grant)
        {
            return Err(denied(caller));
        }
        if let Some(crate::operations::authorization::Authorization::Restricted(required)) = &self.external
            && grant.is_some_and(|grant| !required.grants(grant))
        {
            return Err(denied("external"));
        }
        Ok(())
    }
}

/* === Public Functions === */

/* === Private Functions === */

/* === Tests === */