Enum PluginPolicy 

pub enum PluginPolicy {
    Trusted {
        allowlist: Vec<[u8; 32]>,
    },
    AllowUnsigned,
}

Trust policy governing which plugins may load.

The production path uses PluginPolicy::trusted with an explicit allowlist of publisher verifying keys. PluginPolicy::AllowUnsigned is the dev escape hatch — it loads anything (even unsigned modules) but logs a loud warning per load.

Variants

Trusted

Secure default: a plugin loads only if its module hash matches, its Ed25519 signature verifies, AND its publisher key is in this allowlist. Each entry is the 32-byte raw Ed25519 verifying key.

Fields

allowlist: Vec<[u8; 32]>

AllowUnsigned

Dev-only: skip signature/allowlist enforcement. Hash is still checked when a wasm_module_hash is present (cheap integrity), but unsigned / unknown-publisher modules are allowed. Every load logs a loud warn.

Implementations

impl PluginPolicy

pub fn trusted(publisher_keys: &[&str]) -> Result<Self, PluginError>

Construct the secure (production) policy from a list of trusted publisher keys, each encoded as ed25519:<base64> (the same form the manifest publisher_key uses).

pub fn deny_all() -> Self

Secure policy that trusts no publisher at all — every signed or unsigned module is rejected. Useful as a strict default.

Trait Implementations

impl Clone for PluginPolicy

fn clone(&self) -> PluginPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PluginPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.