runx-core 0.6.19

Pure Rust parity kernel for runx state-machine and policy decisions.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121

use runx_contracts::{
    JsonObject, JsonValue, json_bool_field, json_object as json_value_object,
    json_object_field as object_field,
};

use crate::policy::{
    AuthorityProofApproval, AuthorityProofSandbox, AuthorityProofSandboxDeclaration,
    AuthorityProofSandboxFilesystem, AuthorityProofSandboxNetwork, AuthorityProofSandboxRuntime,
};

pub(super) fn summarize_authority_sandbox(
    metadata: Option<&JsonValue>,
    declaration: Option<&AuthorityProofSandboxDeclaration>,
    approval: Option<&AuthorityProofApproval>,
) -> Option<AuthorityProofSandbox> {
    let record = json_value_object(metadata);
    let profile = string_field(record, "profile")
        .or_else(|| declaration.and_then(|value| optional_string(value.profile.as_deref())))?;
    let network = summarize_network(
        record.and_then(|value| object_field(value, "network")),
        declaration,
    );
    let filesystem =
        summarize_filesystem(record.and_then(|value| object_field(value, "filesystem")));
    let runtime = summarize_runtime(record.and_then(|value| object_field(value, "runtime")));

    Some(AuthorityProofSandbox {
        profile: profile.clone().into(),
        cwd_policy: string_field(record, "cwd_policy")
            .or_else(|| declaration.and_then(|value| optional_string(value.cwd_policy.as_deref())))
            .map(Into::into),
        require_enforcement: bool_field(record, "require_enforcement")
            .or_else(|| declaration.and_then(|value| value.require_enforcement)),
        network,
        filesystem,
        runtime,
        approval_required: bool_field(
            record.and_then(|value| object_field(value, "approval")),
            "required",
        )
        .or(Some(profile == "unrestricted-local-dev")),
        approval_approved: bool_field(
            record.and_then(|value| object_field(value, "approval")),
            "approved",
        )
        .or_else(|| approval.map(|value| value.approved)),
    })
}

fn summarize_network(
    network: Option<&JsonObject>,
    declaration: Option<&AuthorityProofSandboxDeclaration>,
) -> Option<AuthorityProofSandboxNetwork> {
    if network.is_none() && declaration.and_then(|value| value.network).is_none() {
        return None;
    }
    let summary = AuthorityProofSandboxNetwork {
        declared: bool_field(network, "declared")
            .or_else(|| declaration.and_then(|value| value.network)),
        enforcement: string_field(network, "enforcement").map(Into::into),
    };
    if summary.declared.is_none() && summary.enforcement.is_none() {
        None
    } else {
        Some(summary)
    }
}

fn summarize_filesystem(
    filesystem: Option<&JsonObject>,
) -> Option<AuthorityProofSandboxFilesystem> {
    filesystem.and_then(|value| {
        let summary = AuthorityProofSandboxFilesystem {
            enforcement: string_field(Some(value), "enforcement").map(Into::into),
            readonly_paths: bool_field(Some(value), "readonly_paths"),
            writable_paths_enforced: bool_field(Some(value), "writable_paths_enforced"),
            private_tmp: bool_field(Some(value), "private_tmp"),
        };
        if summary.enforcement.is_none()
            && summary.readonly_paths.is_none()
            && summary.writable_paths_enforced.is_none()
            && summary.private_tmp.is_none()
        {
            None
        } else {
            Some(summary)
        }
    })
}

fn summarize_runtime(runtime: Option<&JsonObject>) -> Option<AuthorityProofSandboxRuntime> {
    runtime.and_then(|value| {
        let summary = AuthorityProofSandboxRuntime {
            enforcer: string_field(Some(value), "enforcer").map(Into::into),
            reason: string_field(Some(value), "reason").map(Into::into),
        };
        if summary.enforcer.is_none() && summary.reason.is_none() {
            None
        } else {
            Some(summary)
        }
    })
}

fn string_field(object: Option<&JsonObject>, field: &str) -> Option<String> {
    match object.and_then(|value| value.get(field)) {
        Some(JsonValue::String(value)) if !value.trim().is_empty() => Some(value.trim().to_owned()),
        _ => None,
    }
}

fn optional_string(value: Option<&str>) -> Option<String> {
    value.and_then(|entry| {
        let trimmed = entry.trim();
        (!trimmed.is_empty()).then(|| trimmed.to_owned())
    })
}

fn bool_field(object: Option<&JsonObject>, field: &str) -> Option<bool> {
    object.and_then(|value| json_bool_field(value, field))
}