Skip to content

Commit 3a53e7f

Browse files
committed
chore: update generate files
1 parent 3c8d502 commit 3a53e7f

File tree

4 files changed

+1264
-1349
lines changed

4 files changed

+1264
-1349
lines changed

src/capnp/persistent.ts

+84-91
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ export class Persistent_SaveParams extends $.Struct {
55
static readonly _capnp = {
66
displayName: "SaveParams",
77
id: "f76fba59183073a5",
8-
size: new $.ObjectSize(0, 1),
8+
size: new $.ObjectSize(0, 1)
99
};
1010
_adoptSealFor(value: $.Orphan<$.Pointer>): void {
1111
$.utils.adopt(value, $.utils.getPointer(0, this));
@@ -14,13 +14,13 @@ export class Persistent_SaveParams extends $.Struct {
1414
return $.utils.disown(this.sealFor);
1515
}
1616
/**
17-
* Seal the SturdyRef so that it can only be restored by the specified Owner. This is meant
18-
* to mitigate damage when a SturdyRef is leaked. See comments above.
19-
*
20-
* Leaving this value null may or may not be allowed; it is up to the realm to decide. If a
21-
* realm does allow a null owner, this should indicate that anyone is allowed to restore the
22-
* ref.
23-
* */
17+
* Seal the SturdyRef so that it can only be restored by the specified Owner. This is meant
18+
* to mitigate damage when a SturdyRef is leaked. See comments above.
19+
*
20+
* Leaving this value null may or may not be allowed; it is up to the realm to decide. If a
21+
* realm does allow a null owner, this should indicate that anyone is allowed to restore the
22+
* ref.
23+
* */
2424
get sealFor(): $.Pointer {
2525
return $.utils.getPointer(0, this);
2626
}
@@ -38,7 +38,7 @@ export class Persistent_SaveResults extends $.Struct {
3838
static readonly _capnp = {
3939
displayName: "SaveResults",
4040
id: "b76848c18c40efbf",
41-
size: new $.ObjectSize(0, 1),
41+
size: new $.ObjectSize(0, 1)
4242
};
4343
_adoptSturdyRef(value: $.Orphan<$.Pointer>): void {
4444
$.utils.adopt(value, $.utils.getPointer(0, this));
@@ -75,116 +75,109 @@ export class Persistent$Client {
7575
this.client = client;
7676
}
7777
static readonly methods: [
78-
$.Method<Persistent_SaveParams, Persistent_SaveResults>,
78+
$.Method<Persistent_SaveParams, Persistent_SaveResults>
7979
] = [
8080
{
8181
ParamsClass: Persistent_SaveParams,
8282
ResultsClass: Persistent_SaveResults,
8383
interfaceId: Persistent$Client.interfaceId,
8484
methodId: 0,
8585
interfaceName: "persistent.capnp:Persistent",
86-
methodName: "save",
87-
},
86+
methodName: "save"
87+
}
8888
];
89-
save(
90-
paramsFunc?: (params: Persistent_SaveParams) => void,
91-
): Persistent_SaveResults$Promise {
89+
save(paramsFunc?: (params: Persistent_SaveParams) => void): Persistent_SaveResults$Promise {
9290
const answer = this.client.call({
9391
method: Persistent$Client.methods[0],
94-
paramsFunc: paramsFunc,
92+
paramsFunc: paramsFunc
9593
});
9694
const pipeline = new $.Pipeline(Persistent_SaveResults, answer);
9795
return new Persistent_SaveResults$Promise(pipeline);
9896
}
9997
}
10098
$.Registry.register(Persistent$Client.interfaceId, Persistent$Client);
10199
export interface Persistent$Server$Target {
102-
save(
103-
params: Persistent_SaveParams,
104-
results: Persistent_SaveResults,
105-
): Promise<void>;
100+
save(params: Persistent_SaveParams, results: Persistent_SaveResults): Promise<void>;
106101
}
107102
export class Persistent$Server extends $.Server {
108103
readonly target: Persistent$Server$Target;
109104
constructor(target: Persistent$Server$Target) {
110105
super(target, [
111106
{
112107
...Persistent$Client.methods[0],
113-
impl: target.save,
114-
},
108+
impl: target.save
109+
}
115110
]);
116111
this.target = target;
117112
}
118-
client(): Persistent$Client {
119-
return new Persistent$Client(this);
120-
}
113+
client(): Persistent$Client { return new Persistent$Client(this); }
121114
}
122115
/**
123-
* Interface implemented by capabilities that outlive a single connection. A client may save()
124-
* the capability, producing a SturdyRef. The SturdyRef can be stored to disk, then later used to
125-
* obtain a new reference to the capability on a future connection.
126-
*
127-
* The exact format of SturdyRef depends on the "realm" in which the SturdyRef appears. A "realm"
128-
* is an abstract space in which all SturdyRefs have the same format and refer to the same set of
129-
* resources. Every vat is in exactly one realm. All capability clients within that vat must
130-
* produce SturdyRefs of the format appropriate for the realm.
131-
*
132-
* Similarly, every VatNetwork also resides in a particular realm. Usually, a vat's "realm"
133-
* corresponds to the realm of its main VatNetwork. However, a Vat can in fact communicate over
134-
* a VatNetwork in a different realm -- in this case, all SturdyRefs need to be transformed when
135-
* coming or going through said VatNetwork. The RPC system has hooks for registering
136-
* transformation callbacks for this purpose.
137-
*
138-
* Since the format of SturdyRef is realm-dependent, it is not defined here. An application should
139-
* choose an appropriate realm for itself as part of its design. Note that under Sandstorm, every
140-
* application exists in its own realm and is therefore free to define its own SturdyRef format;
141-
* the Sandstorm platform handles translating between realms.
142-
*
143-
* Note that whether a capability is persistent is often orthogonal to its type. In these cases,
144-
* the capability's interface should NOT inherit `Persistent`; instead, just perform a cast at
145-
* runtime. It's not type-safe, but trying to be type-safe in these cases will likely lead to
146-
* tears. In cases where a particular interface only makes sense on persistent capabilities, it
147-
* still should not explicitly inherit Persistent because the `SturdyRef` and `Owner` types will
148-
* vary between realms (they may even be different at the call site than they are on the
149-
* implementation). Instead, mark persistent interfaces with the $persistent annotation (defined
150-
* below).
151-
*
152-
* Sealing
153-
* -------
154-
*
155-
* As an added security measure, SturdyRefs may be "sealed" to a particular owner, such that
156-
* if the SturdyRef itself leaks to a third party, that party cannot actually restore it because
157-
* they are not the owner. To restore a sealed capability, you must first prove to its host that
158-
* you are the rightful owner. The precise mechanism for this authentication is defined by the
159-
* realm.
160-
*
161-
* Sealing is a defense-in-depth mechanism meant to mitigate damage in the case of catastrophic
162-
* attacks. For example, say an attacker temporarily gains read access to a database full of
163-
* SturdyRefs: it would be unfortunate if it were then necessary to revoke every single reference
164-
* in the database to prevent the attacker from using them.
165-
*
166-
* In general, an "owner" is a course-grained identity. Because capability-based security is still
167-
* the primary mechanism of security, it is not necessary nor desirable to have a separate "owner"
168-
* identity for every single process or object; that is exactly what capabilities are supposed to
169-
* avoid! Instead, it makes sense for an "owner" to literally identify the owner of the machines
170-
* where the capability is stored. If untrusted third parties are able to run arbitrary code on
171-
* said machines, then the sandbox for that code should be designed using Distributed Confinement
172-
* such that the third-party code never sees the bits of the SturdyRefs and cannot directly
173-
* exercise the owner's power to restore refs. See:
174-
*
175-
* http://www.erights.org/elib/capability/dist-confine.html
176-
*
177-
* Resist the urge to represent an Owner as a simple public key. The whole point of sealing is to
178-
* defend against leaked-storage attacks. Such attacks can easily result in the owner's private
179-
* key being stolen as well. A better solution is for `Owner` to contain a simple globally unique
180-
* identifier for the owner, and for everyone to separately maintain a mapping of owner IDs to
181-
* public keys. If an owner's private key is compromised, then humans will need to communicate
182-
* and agree on a replacement public key, then update the mapping.
183-
*
184-
* As a concrete example, an `Owner` could simply contain a domain name, and restoring a SturdyRef
185-
* would require signing a request using the domain's private key. Authenticating this key could
186-
* be accomplished through certificate authorities or web-of-trust techniques.
187-
* */
116+
* Interface implemented by capabilities that outlive a single connection. A client may save()
117+
* the capability, producing a SturdyRef. The SturdyRef can be stored to disk, then later used to
118+
* obtain a new reference to the capability on a future connection.
119+
*
120+
* The exact format of SturdyRef depends on the "realm" in which the SturdyRef appears. A "realm"
121+
* is an abstract space in which all SturdyRefs have the same format and refer to the same set of
122+
* resources. Every vat is in exactly one realm. All capability clients within that vat must
123+
* produce SturdyRefs of the format appropriate for the realm.
124+
*
125+
* Similarly, every VatNetwork also resides in a particular realm. Usually, a vat's "realm"
126+
* corresponds to the realm of its main VatNetwork. However, a Vat can in fact communicate over
127+
* a VatNetwork in a different realm -- in this case, all SturdyRefs need to be transformed when
128+
* coming or going through said VatNetwork. The RPC system has hooks for registering
129+
* transformation callbacks for this purpose.
130+
*
131+
* Since the format of SturdyRef is realm-dependent, it is not defined here. An application should
132+
* choose an appropriate realm for itself as part of its design. Note that under Sandstorm, every
133+
* application exists in its own realm and is therefore free to define its own SturdyRef format;
134+
* the Sandstorm platform handles translating between realms.
135+
*
136+
* Note that whether a capability is persistent is often orthogonal to its type. In these cases,
137+
* the capability's interface should NOT inherit `Persistent`; instead, just perform a cast at
138+
* runtime. It's not type-safe, but trying to be type-safe in these cases will likely lead to
139+
* tears. In cases where a particular interface only makes sense on persistent capabilities, it
140+
* still should not explicitly inherit Persistent because the `SturdyRef` and `Owner` types will
141+
* vary between realms (they may even be different at the call site than they are on the
142+
* implementation). Instead, mark persistent interfaces with the $persistent annotation (defined
143+
* below).
144+
*
145+
* Sealing
146+
* -------
147+
*
148+
* As an added security measure, SturdyRefs may be "sealed" to a particular owner, such that
149+
* if the SturdyRef itself leaks to a third party, that party cannot actually restore it because
150+
* they are not the owner. To restore a sealed capability, you must first prove to its host that
151+
* you are the rightful owner. The precise mechanism for this authentication is defined by the
152+
* realm.
153+
*
154+
* Sealing is a defense-in-depth mechanism meant to mitigate damage in the case of catastrophic
155+
* attacks. For example, say an attacker temporarily gains read access to a database full of
156+
* SturdyRefs: it would be unfortunate if it were then necessary to revoke every single reference
157+
* in the database to prevent the attacker from using them.
158+
*
159+
* In general, an "owner" is a course-grained identity. Because capability-based security is still
160+
* the primary mechanism of security, it is not necessary nor desirable to have a separate "owner"
161+
* identity for every single process or object; that is exactly what capabilities are supposed to
162+
* avoid! Instead, it makes sense for an "owner" to literally identify the owner of the machines
163+
* where the capability is stored. If untrusted third parties are able to run arbitrary code on
164+
* said machines, then the sandbox for that code should be designed using Distributed Confinement
165+
* such that the third-party code never sees the bits of the SturdyRefs and cannot directly
166+
* exercise the owner's power to restore refs. See:
167+
*
168+
* http://www.erights.org/elib/capability/dist-confine.html
169+
*
170+
* Resist the urge to represent an Owner as a simple public key. The whole point of sealing is to
171+
* defend against leaked-storage attacks. Such attacks can easily result in the owner's private
172+
* key being stolen as well. A better solution is for `Owner` to contain a simple globally unique
173+
* identifier for the owner, and for everyone to separately maintain a mapping of owner IDs to
174+
* public keys. If an owner's private key is compromised, then humans will need to communicate
175+
* and agree on a replacement public key, then update the mapping.
176+
*
177+
* As a concrete example, an `Owner` could simply contain a domain name, and restoring a SturdyRef
178+
* would require signing a request using the domain's private key. Authenticating this key could
179+
* be accomplished through certificate authorities or web-of-trust techniques.
180+
* */
188181
export class Persistent extends $.Interface {
189182
static readonly SaveParams = Persistent_SaveParams;
190183
static readonly SaveResults = Persistent_SaveResults;
@@ -193,7 +186,7 @@ export class Persistent extends $.Interface {
193186
static readonly _capnp = {
194187
displayName: "Persistent",
195188
id: "c8cb212fcd9f5691",
196-
size: new $.ObjectSize(0, 0),
189+
size: new $.ObjectSize(0, 0)
197190
};
198191
toString(): string {
199192
return "Persistent_" + super.toString();

0 commit comments

Comments
 (0)