fix: a package holds only what its importer passes it

Author: dylan-sutton-chavez

cli/src/asks.rs

@@ -1,10 +1,9 @@
 use anyhow::{anyhow, bail, Result};
 use compiler::modules::lock::{locked_spec, verify_pin};
-use compiler::modules::rules::HOLDERS;
 use compiler::modules::{dir_of, join_relative, parse_integrity, walk_up_dirs};
 use compiler::util::sha256::{hex_encode, sha256};
 use serde_json::{json, Map, Value};
-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 use std::rc::Rc;
 
@@ -27,25 +26,21 @@ impl Home {
     }
 }
 
-/* A package in the tree, the name the root grants it by and what it asks. */
+/* A package the root imports, the key it is granted by and what its section lists. */
 pub struct Package {
     pub name: String,
     label: String,
-    via: Vec<String>,
     pub section: Value,
 }
 
 impl Package {
-    /// The package and the packages it came through, as a report names it.
+    /// The package as a report names it, its version beside the key it is granted by.
     pub fn who(&self) -> String {
-        match self.via.is_empty() {
-            true => self.label.clone(),
-            false => format!("{}, via {}", self.label, self.via.join(" > ")),
-        }
+        self.label.clone()
     }
 }
 
-/* Stops when the root edge.json misses what a package in its tree asks for. */
+/* Stops when the root edge.json misses what a package it imports lists. */
 pub fn check(path: &Path, lock: &Lock) -> Result<()> {
     let Ok(bytes) = std::fs::read(path) else { return Ok(()) };
     let manifest: Value = serde_json::from_slice(&bytes).map_err(|e| anyhow!("parsing {}: {e}", path.display()))?;
@@ -56,7 +51,7 @@ pub fn check(path: &Path, lock: &Lock) -> Result<()> {
     let imports = manifest.get("imports").and_then(Value::as_object).cloned().unwrap_or_default();
     let mut unmet = Vec::new();
     for package in packages(path, &imports, lock)?.iter().filter(|p| !p.section.is_null()) {
-        let missing = system::unmet(&grants, &package.name, &package.section);
+        let missing = system::unmet(&system::held(&json!([[grants, package.name]])), &package.section);
         if !missing.is_empty() {
             unmet.push((package.who(), missing.join(", ")));
         }
@@ -69,23 +64,30 @@ pub fn check(path: &Path, lock: &Lock) -> Result<()> {
     bail!("edge.json does not grant what these packages ask for\n{}\nhelp: grant them under \"permissions\" in edge.json", lines.join("\n"))
 }
 
-/* Every package the imports reach, each through its own edge.json and edge.lock. */
+/* Every package the root imports, each tree below it held to what its importers pass on. */
 pub fn packages(path: &Path, imports: &Map<String, Value>, lock: &Lock) -> Result<Vec<Package>> {
     let project = path.parent().filter(|p| !p.as_os_str().is_empty()).unwrap_or(Path::new("."));
     // The root grants, so it is never one of the packages it checks.
-    let mut walk = Walk { seen: HashSet::from([key("", "")]), found: Vec::new() };
-    walk.imports(&Rc::new(Home::Disk(project.to_path_buf())), "", "", &[], imports, lock)?;
+    let mut walk = Walk { found: Vec::new(), path: vec![key("", "")] };
+    walk.imports(&Rc::new(Home::Disk(project.to_path_buf())), "", "", None, imports, lock)?;
     Ok(walk.found)
 }
 
+/* A non-root importer, as a report names it, and the section it passes on from. */
+struct Importer<'a> {
+    label: &'a str,
+    section: &'a Value,
+}
+
 struct Walk {
-    seen: HashSet<String>,
     found: Vec<Package>,
+    // The packages from the root down to the one being read.
+    path: Vec<String>,
 }
 
 impl Walk {
     /* Follows each import of the package at `dir`, as the lock beside its manifest resolved it. */
-    fn imports(&mut self, home: &Rc<Home>, id: &str, dir: &str, via: &[String], imports: &Map<String, Value>, lock: &Lock) -> Result<()> {
+    fn imports(&mut self, home: &Rc<Home>, id: &str, dir: &str, importer: Option<&Importer>, imports: &Map<String, Value>, lock: &Lock) -> Result<()> {
         for (name, target) in imports {
             // A target the lock cannot answer yet is the command's own error to report.
             let Some(spec) = target.as_str().and_then(|t| locked_spec(name, t, Some(lock)).ok()) else { continue };
@@ -101,67 +103,73 @@ impl Walk {
                         Some(bytes) => bytes,
                         None => fetch_cached(target, pin).map_err(|e| anyhow!(e))?,
                     };
-                    self.bundle(target, &spec, &bytes, name, via)?;
+                    self.bundle(target, &spec, &bytes, name, importer)?;
                 }
                 continue;
             }
             let rel = join_relative(dir, target).trim_start_matches("./").to_string();
             if packed(&rel) {
                 let bytes = home.read(&rel).ok_or_else(|| anyhow!("reading {rel}: not found"))?;
-                self.bundle(&rel, &spec, &bytes, name, via)?;
+                self.bundle(&rel, &spec, &bytes, name, importer)?;
                 continue;
             }
-            // A module belongs to the nearest manifest above it, another package unless that is this one.
+            // A module belongs to the nearest manifest above it, a new package unless it holds the importer.
             let nearest = walk_up_dirs(&dir_of(&rel)).find(|d| d == dir || home.read(&format!("{d}edge.json")).is_some());
-            if let Some(found) = nearest.filter(|d| d != dir) {
+            if let Some(found) = nearest.filter(|d| !walk_up_dirs(dir).any(|around| around == *d)) {
                 let place = format!("{found}edge.json");
-                self.visit(home, id, &found, &place, name, via)?;
+                self.visit(home, id, &found, &place, name, importer)?;
             }
         }
         Ok(())
     }
 
     /* A packed package, held to its pin, then read from inside itself like any other. */
-    fn bundle(&mut self, address: &str, spec: &str, bytes: &[u8], name: &str, via: &[String]) -> Result<()> {
+    fn bundle(&mut self, address: &str, spec: &str, bytes: &[u8], name: &str, importer: Option<&Importer>) -> Result<()> {
         verify_pin(spec, bytes).map_err(|e| anyhow!(e))?;
         let files = crate::pack::into_files(Bundle::decode(bytes).map_err(|e| anyhow!("package '{address}' is not a packed .edge, {e}"))?);
-        self.visit(&Rc::new(Home::Packed(files)), &hex_encode(&sha256(bytes)), "", address, name, via)
+        self.visit(&Rc::new(Home::Packed(files)), &hex_encode(&sha256(bytes)), "", address, name, importer)
     }
 
-    /* Records the package whose manifest sits at `dir`, then follows what it imports in turn. */
-    fn visit(&mut self, home: &Rc<Home>, id: &str, dir: &str, place: &str, hint: &str, via: &[String]) -> Result<()> {
-        if !self.seen.insert(key(id, dir)) {
+    /* Holds the package at `dir` to what its importer passes, then follows its own imports. */
+    fn visit(&mut self, home: &Rc<Home>, id: &str, dir: &str, place: &str, name: &str, importer: Option<&Importer>) -> Result<()> {
+        let at = key(id, dir);
+        // A package importing one that imports it reaches that same package, as the engine reads it.
+        if self.path.contains(&at) {
             return Ok(());
         }
         let Some(bytes) = home.read(&format!("{dir}edge.json")) else { return Ok(()) };
         let manifest: Value = serde_json::from_slice(&bytes).map_err(|e| anyhow!("edge.json at '{place}': {e}"))?;
-        let named = manifest.get("name").and_then(Value::as_str);
-        if let Some(name) = named.filter(|n| HOLDERS.contains(n)) {
-            bail!("edge.json at '{place}': name '{name}' is reserved for permissions");
-        }
-        let name = named.unwrap_or(hint).to_string();
         let section = manifest.get("permissions").cloned().unwrap_or(Value::Null);
-        if !section.is_null() {
-            if let Some(problem) = system::check(&section) {
-                bail!("edge.json at '{place}': {problem}");
-            }
-            // The root grants by name, and against an empty grant every ask comes back unmet.
-            if named.is_none() && !system::unmet(&json!({}), &name, &section).is_empty() {
-                bail!("edge.json at '{place}': a package that asks for permissions needs a name");
-            }
+        if !section.is_null()
+            && let Some(problem) = system::check(&section)
+        {
+            bail!("edge.json at '{place}': {problem}");
         }
         let label = match manifest.get("version").and_then(Value::as_str) {
             Some(version) => format!("{name} {version}"),
-            None => name.clone(),
+            None => name.to_string(),
         };
+        match importer {
+            None => self.found.push(Package { name: name.to_string(), label: label.clone(), section: section.clone() }),
+            Some(importer) if !section.is_null() => {
+                // What the importer writes for it, since the root check covers what the importer holds.
+                let missing = system::unmet(&system::held(&json!([[importer.section, name]])), &section);
+                if !missing.is_empty() {
+                    bail!("edge.json at '{place}' asks for {}, which {} does not pass it", missing.join(", "), importer.label);
+                }
+            }
+            Some(_) => {}
+        }
         let lock = match home.read(&format!("{dir}{}", lock::FILE)) {
             Some(bytes) => Lock::parse(&bytes).map_err(|e| anyhow!("edge.json at '{place}': {e}"))?,
             None => Lock::default(),
         };
         let imports = manifest.get("imports").and_then(Value::as_object).cloned().unwrap_or_default();
-        let chain: Vec<String> = via.iter().cloned().chain([label.clone()]).collect();
-        self.found.push(Package { name, label, via: via.to_vec(), section });
-        self.imports(home, id, dir, &chain, &imports, &lock)
+        let given = if section.is_null() { json!({}) } else { section };
+        self.path.push(at);
+        let followed = self.imports(home, id, dir, Some(&Importer { label: &label, section: &given }), &imports, &lock);
+        self.path.pop();
+        followed
     }
 }
 

cli/src/cmd/pkg.rs

@@ -1,6 +1,6 @@
 use anyhow::{anyhow, bail, Result};
 use compiler::modules::rules::shaped_like_version;
-use serde_json::{json, Map, Value};
+use serde_json::{Map, Value};
 use std::io::Read;
 use std::path::Path;
 
@@ -76,7 +76,7 @@ pub fn add(path: &Path, pkgs: &[String]) -> Result<()> {
     let mut asking = false;
     for package in packages.iter().filter(|p| !p.section.is_null()) {
         // Against an empty grant every ask comes back unmet, which lists them all.
-        let asked = system::unmet(&json!({}), &package.name, &package.section);
+        let asked = system::unmet(&[], &package.section);
         if !asked.is_empty() {
             ui::asks(&package.who(), &asked);
             asking = true;

cli/src/host/env.rs

@@ -97,7 +97,7 @@ fn call_native(caller: &mut Caller<'_, State>, id: i32, call_id: i32, argv_ptr:
             }
             Ok(status)
         }
-        Native::System { module, name, package } => {
+        Native::System { module, name, spec } => {
             let raw = read(caller, ex.memory, argv_ptr, argc.max(1) * 4);
             let handles: Vec<u32> = raw.as_chunks::<4>().0.iter().map(|c| u32::from_le_bytes(*c)).collect();
             // The trailing slot holds the kwargs, which a system call never takes.
@@ -117,7 +117,7 @@ fn call_native(caller: &mut Caller<'_, State>, id: i32, call_id: i32, argv_ptr:
             }
             let state = caller.data();
             let called = match state.events.clone() {
-                Some(events) => super::system::invoke(state.run, &package, &module, &name, &args, call_id as u32, events),
+                Some(events) => super::system::invoke(state.run, &spec, &name, &args, call_id as u32, events),
                 None => Err(format!("RuntimeError: {module}.{name} has no interpreter to answer")),
             };
             let answer = called.map(|called| match called {

cli/src/host/mod.rs

@@ -192,11 +192,11 @@ pub struct Plugin {
 #[derive(Clone)]
 pub enum Native {
     Plugin(Box<Plugin>),
-    // A system call, opened for one package and answered by SpiderMonkey.
+    // A system call, opened under the spec its package imports it by, answered by SpiderMonkey.
     System {
         module: String,
         name: String,
-        package: String,
+        spec: String,
     },
 }
 

cli/src/host/resolver.rs

@@ -125,14 +125,15 @@ fn registered(names: &[String]) -> Vec<String> {
     })
 }
 
-/* Serves the system modules to every package the walk met, opened with its scopes or refused when the root grants it none. */
+/* Serves the system modules to every package the walk met, refused where its importers pass none. */
 fn serve_system(inst: &mut Instance, project: &Project, packages: &Value) -> Vec<String> {
     let root = packages["root"].as_str().unwrap_or_default();
     // An untrusted run grants only through its own bundle manifest, and an empty grant needs no checking.
     let declared = packages.get("permissions").filter(|p| (!project.untrusted || project.ceiling.is_some()) && p.as_object().is_some_and(|holders| !holders.is_empty())).cloned();
     if let Some(problem) = declared.as_ref().and_then(system::check) {
         return vec![format!("edge.json at '{root}edge.json': {problem}")];
     }
+    let granted = declared.is_some();
     let permissions = declared.unwrap_or_else(|| json!({}));
     let entries: Vec<&Value> = permissions.as_object().into_iter().flat_map(|holders| holders.values()).filter_map(Value::as_array).flatten().collect();
     // The refusal names only what the bundle grants, never the eval grant of the pool.
@@ -144,7 +145,7 @@ fn serve_system(inst: &mut Instance, project: &Project, packages: &Value) -> Vec
             .into_iter()
             .flatten()
             .filter_map(|(holder, listed)| {
-                let missing = system::unmet(&json!({ "eval": ceiling }), "eval", &json!({ "main": listed }));
+                let missing = system::unmet(&system::held(&json!([[{ "eval": ceiling }, "eval"]])), &json!({ "main": listed }));
                 (!missing.is_empty()).then(|| (holder, missing.join(", ")))
             })
             .collect();
@@ -180,9 +181,11 @@ fn serve_system(inst: &mut Instance, project: &Project, packages: &Value) -> Vec
     }
     for pair in packages["dirs"].as_array().into_iter().flatten() {
         let (Some(dir), Some(pkg)) = (pair[0].as_str(), pair[1].as_str()) else { continue };
+        // A run that grants nothing of its own holds nothing, whatever its manifests pass on.
+        let chain = if granted { pair[2].clone() } else { json!([]) };
         for module in SYSTEM_MODULES {
             let spec = system_spec(module, dir);
-            let served = match system::scopes(&permissions, pkg, module) {
+            let served = match system::scopes(&chain, module) {
                 Some(held) => inst.register_system(&spec, pkg, module, &held),
                 None => inst.register_error(&spec, &format!("'{pkg}' imports {module}, which edge.json does not grant it")),
             };

cli/src/host/system/engine.rs

@@ -21,7 +21,7 @@ use std::thread::JoinHandle;
 const WEB: &str = include_str!("web.js");
 // The only JavaScript that can ever load, the system calls `js/dist` carries.
 const SYSTEM_DIR: &str = "src/system/";
-const ENTRY: &str = "import { SYSTEM } from './system/index.js';\nimport { check, scopes, unmet } from './system/grants.js';\nglobalThis.__edge = { open: SYSTEM, check, scopes, unmet };\n";
+const ENTRY: &str = "import { SYSTEM } from './system/index.js';\nimport { check, held, scopes, unmet } from './system/grants.js';\nglobalThis.__edge = { open: SYSTEM, check, held, scopes, unmet };\n";
 
 /* What the thread keeps between calls, the calls waiting to settle and the pipe's requests and sockets. */
 struct State {