char/avril

(wip) why'd you have to go and make things so complicaaaaated?

git clone https://git.t4t.associates/char/avril

Charlotte Sommass: run cargo fmt05d50bd

main
branchesmainall refs →
2.5 KiB82 linesraw
1use std::sync::Arc;
2
3use crate::caps::{Capabilities, CapabilitiesError, PathTarget};
4
5#[derive(Clone, Copy, Debug, PartialEq, Eq)]
6pub enum SourceAccess {
7    Execute,
8    Read,
9}
10
11#[derive(Clone)]
12pub struct SourceAuthority {
13    caps: Arc<Capabilities>,
14    access: SourceAccess,
15}
16
17impl SourceAuthority {
18    pub fn execute(caps: Arc<Capabilities>) -> Self {
19        Self {
20            caps,
21            access: SourceAccess::Execute,
22        }
23    }
24
25    pub fn read(caps: Arc<Capabilities>) -> Self {
26        Self { caps, access: SourceAccess::Read }
27    }
28
29    pub fn is_read(&self) -> bool {
30        self.access == SourceAccess::Read
31    }
32
33    pub fn check_local(&self, target: &PathTarget) -> Result<(), CapabilitiesError> {
34        match self.access {
35            SourceAccess::Execute => self.caps.check_js_exec(target),
36            SourceAccess::Read => self.caps.check_read(target),
37        }
38    }
39
40    pub fn check_remote_module(&self, url: &url::Url) -> Result<(), CapabilitiesError> {
41        match self.access {
42            SourceAccess::Execute => self.caps.check_remote_exec(url),
43            SourceAccess::Read => self.check_net_url(url),
44        }
45    }
46
47    pub fn check_remote_package(&self, url: &url::Url) -> Result<(), CapabilitiesError> {
48        match self.access {
49            SourceAccess::Execute => self.caps.check_remote_acquire(url),
50            SourceAccess::Read => self.check_net_url(url),
51        }
52    }
53
54    fn check_net_url(&self, url: &url::Url) -> Result<(), CapabilitiesError> {
55        let host = url
56            .host_str()
57            .ok_or_else(|| CapabilitiesError::NetUrlDenied(url.to_string()))?;
58        let port = url
59            .port_or_known_default()
60            .ok_or_else(|| CapabilitiesError::NetUrlDenied(url.to_string()))?;
61        self.caps.check_net(host, port)
62    }
63
64    /// Reauthorize an acquired artifact by its recorded final URL. No-op
65    /// under Execute, which keeps requested-only redirect semantics.
66    pub fn check_remote_final(&self, final_url: &str) -> Result<(), CapabilitiesError> {
67        if self.is_read() {
68            let url = url::Url::parse(final_url)
69                .map_err(|_| CapabilitiesError::NetUrlDenied(final_url.to_owned()))?;
70            self.check_net_url(&url)
71        } else {
72            Ok(())
73        }
74    }
75
76    pub fn unrestricted_local(&self) -> bool {
77        match self.access {
78            SourceAccess::Execute => self.caps.unrestricted_js_exec(),
79            SourceAccess::Read => self.caps.unrestricted_read(),
80        }
81    }
82}