harn-vm 0.10.68

Async bytecode virtual machine for the Harn programming language
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

use super::*;

fn capability_ceiling(capability: &str, operations: &[&str]) -> CapabilityPolicy {
    CapabilityPolicy {
        capabilities: BTreeMap::from([(
            capability.to_string(),
            operations
                .iter()
                .map(|operation| operation.to_string())
                .collect(),
        )]),
        ..CapabilityPolicy::default()
    }
}

#[test]
fn authority_effect_policy_preserves_access_and_resource_scope() {
    let plan_admission = EffectRecord::new(EffectKind::Authority, EffectScope::Write)
        .with_resource("plan_admission");
    let native_approval = EffectRecord::new(EffectKind::Authority, EffectScope::Write)
        .with_resource("native_approval");

    let exact = capability_ceiling("authority", &["write@plan_admission"]);
    assert!(effect_allowed_by_ceiling(&plan_admission, &exact));
    assert!(!effect_allowed_by_ceiling(&native_approval, &exact));

    let broad = capability_ceiling("authority", &["write"]);
    assert!(effect_allowed_by_ceiling(&plan_admission, &broad));
    assert!(effect_allowed_by_ceiling(&native_approval, &broad));

    let connector_only = capability_ceiling("connector", &["call"]);
    assert!(!effect_allowed_by_ceiling(&plan_admission, &connector_only));
    let existing_host_interaction =
        EffectRecord::new(EffectKind::Host, EffectScope::Write).with_resource("human-approval");
    let existing_host_introspection =
        EffectRecord::new(EffectKind::Host, EffectScope::Read).with_resource("runtime-tools");
    assert!(effect_allowed_by_ceiling(
        &existing_host_interaction,
        &connector_only
    ));
    assert!(effect_allowed_by_ceiling(
        &existing_host_introspection,
        &connector_only
    ));
}