sim-table-fs 0.1.1

SIM workspace package for sim table fs.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106

//! Capability names used by filesystem-backed tables.

use sim_kernel::{CapabilityName, Cx, Error, Result};

/// The capability gating filesystem-backed tables (`table.fs`).
pub fn table_fs_capability() -> CapabilityName {
    CapabilityName::new("table.fs")
}

/// The capability gating filesystem table reads (`fs/read`).
pub fn table_fs_read_capability() -> CapabilityName {
    CapabilityName::new("fs/read")
}

/// The capability gating filesystem table writes (`fs/write`).
pub fn table_fs_write_capability() -> CapabilityName {
    CapabilityName::new("fs/write")
}

/// The capability gating filesystem table directory creation (`fs/write`).
pub fn table_fs_mkdir_capability() -> CapabilityName {
    table_fs_write_capability()
}

/// The capability gating filesystem table directory removal (`fs/write`).
pub fn table_fs_rmdir_capability() -> CapabilityName {
    table_fs_write_capability()
}

/// The capability gating patch-only filesystem leaf edits (`edit`).
pub fn table_fs_edit_capability() -> CapabilityName {
    CapabilityName::new("edit")
}

/// The capability gating filesystem tree search (`find`).
pub fn table_fs_find_capability() -> CapabilityName {
    CapabilityName::new("find")
}

pub(crate) fn require_table_fs_read(cx: &Cx) -> Result<()> {
    require_with_aliases(cx, table_fs_read_capability(), fs_read_aliases())
}

pub(crate) fn require_table_fs_write(cx: &Cx) -> Result<()> {
    require_with_aliases(cx, table_fs_write_capability(), fs_write_aliases())
}

pub(crate) fn require_table_fs_edit(cx: &Cx) -> Result<()> {
    cx.require(&table_fs_edit_capability())
}

pub(crate) fn require_table_fs_find(cx: &Cx) -> Result<()> {
    cx.require(&table_fs_find_capability())
}

fn fs_read_aliases() -> &'static [&'static str] {
    &["table.fs.read", "stream.file.read", "file-read"]
}

fn fs_write_aliases() -> &'static [&'static str] {
    &[
        "table.fs.write",
        "table.fs.mkdir",
        "table.fs.rmdir",
        "stream.file.write",
        "file-write",
    ]
}

fn require_with_aliases(
    cx: &Cx,
    canonical: CapabilityName,
    aliases: &'static [&'static str],
) -> Result<()> {
    if cx.capabilities().contains(&canonical)
        || aliases
            .iter()
            .any(|alias| cx.capabilities().contains(&CapabilityName::new(*alias)))
    {
        Ok(())
    } else {
        Err(Error::CapabilityDenied {
            capability: canonical,
        })
    }
}

#[cfg(test)]
mod tests {
    use super::{
        table_fs_capability, table_fs_edit_capability, table_fs_find_capability,
        table_fs_mkdir_capability, table_fs_read_capability, table_fs_rmdir_capability,
        table_fs_write_capability,
    };

    #[test]
    fn capability_tokens_are_stable() {
        assert_eq!(table_fs_capability().as_str(), "table.fs");
        assert_eq!(table_fs_read_capability().as_str(), "fs/read");
        assert_eq!(table_fs_write_capability().as_str(), "fs/write");
        assert_eq!(table_fs_mkdir_capability().as_str(), "fs/write");
        assert_eq!(table_fs_rmdir_capability().as_str(), "fs/write");
        assert_eq!(table_fs_edit_capability().as_str(), "edit");
        assert_eq!(table_fs_find_capability().as_str(), "find");
    }
}