@@ -5,7 +5,7 @@ export class Persistent_SaveParams extends $.Struct {
5
5
static readonly _capnp = {
6
6
displayName : "SaveParams" ,
7
7
id : "f76fba59183073a5" ,
8
- size : new $ . ObjectSize ( 0 , 1 ) ,
8
+ size : new $ . ObjectSize ( 0 , 1 )
9
9
} ;
10
10
_adoptSealFor ( value : $ . Orphan < $ . Pointer > ) : void {
11
11
$ . utils . adopt ( value , $ . utils . getPointer ( 0 , this ) ) ;
@@ -14,13 +14,13 @@ export class Persistent_SaveParams extends $.Struct {
14
14
return $ . utils . disown ( this . sealFor ) ;
15
15
}
16
16
/**
17
- * Seal the SturdyRef so that it can only be restored by the specified Owner. This is meant
18
- * to mitigate damage when a SturdyRef is leaked. See comments above.
19
- *
20
- * Leaving this value null may or may not be allowed; it is up to the realm to decide. If a
21
- * realm does allow a null owner, this should indicate that anyone is allowed to restore the
22
- * ref.
23
- * */
17
+ * Seal the SturdyRef so that it can only be restored by the specified Owner. This is meant
18
+ * to mitigate damage when a SturdyRef is leaked. See comments above.
19
+ *
20
+ * Leaving this value null may or may not be allowed; it is up to the realm to decide. If a
21
+ * realm does allow a null owner, this should indicate that anyone is allowed to restore the
22
+ * ref.
23
+ * */
24
24
get sealFor ( ) : $ . Pointer {
25
25
return $ . utils . getPointer ( 0 , this ) ;
26
26
}
@@ -38,7 +38,7 @@ export class Persistent_SaveResults extends $.Struct {
38
38
static readonly _capnp = {
39
39
displayName : "SaveResults" ,
40
40
id : "b76848c18c40efbf" ,
41
- size : new $ . ObjectSize ( 0 , 1 ) ,
41
+ size : new $ . ObjectSize ( 0 , 1 )
42
42
} ;
43
43
_adoptSturdyRef ( value : $ . Orphan < $ . Pointer > ) : void {
44
44
$ . utils . adopt ( value , $ . utils . getPointer ( 0 , this ) ) ;
@@ -75,116 +75,109 @@ export class Persistent$Client {
75
75
this . client = client ;
76
76
}
77
77
static readonly methods : [
78
- $ . Method < Persistent_SaveParams , Persistent_SaveResults > ,
78
+ $ . Method < Persistent_SaveParams , Persistent_SaveResults >
79
79
] = [
80
80
{
81
81
ParamsClass : Persistent_SaveParams ,
82
82
ResultsClass : Persistent_SaveResults ,
83
83
interfaceId : Persistent$Client . interfaceId ,
84
84
methodId : 0 ,
85
85
interfaceName : "persistent.capnp:Persistent" ,
86
- methodName : "save" ,
87
- } ,
86
+ methodName : "save"
87
+ }
88
88
] ;
89
- save (
90
- paramsFunc ?: ( params : Persistent_SaveParams ) => void ,
91
- ) : Persistent_SaveResults$Promise {
89
+ save ( paramsFunc ?: ( params : Persistent_SaveParams ) => void ) : Persistent_SaveResults$Promise {
92
90
const answer = this . client . call ( {
93
91
method : Persistent$Client . methods [ 0 ] ,
94
- paramsFunc : paramsFunc ,
92
+ paramsFunc : paramsFunc
95
93
} ) ;
96
94
const pipeline = new $ . Pipeline ( Persistent_SaveResults , answer ) ;
97
95
return new Persistent_SaveResults$Promise ( pipeline ) ;
98
96
}
99
97
}
100
98
$ . Registry . register ( Persistent$Client . interfaceId , Persistent$Client ) ;
101
99
export interface Persistent$Server$Target {
102
- save (
103
- params : Persistent_SaveParams ,
104
- results : Persistent_SaveResults ,
105
- ) : Promise < void > ;
100
+ save ( params : Persistent_SaveParams , results : Persistent_SaveResults ) : Promise < void > ;
106
101
}
107
102
export class Persistent$Server extends $ . Server {
108
103
readonly target : Persistent$Server$Target ;
109
104
constructor ( target : Persistent$Server$Target ) {
110
105
super ( target , [
111
106
{
112
107
...Persistent$Client . methods [ 0 ] ,
113
- impl : target . save ,
114
- } ,
108
+ impl : target . save
109
+ }
115
110
] ) ;
116
111
this . target = target ;
117
112
}
118
- client ( ) : Persistent$Client {
119
- return new Persistent$Client ( this ) ;
120
- }
113
+ client ( ) : Persistent$Client { return new Persistent$Client ( this ) ; }
121
114
}
122
115
/**
123
- * Interface implemented by capabilities that outlive a single connection. A client may save()
124
- * the capability, producing a SturdyRef. The SturdyRef can be stored to disk, then later used to
125
- * obtain a new reference to the capability on a future connection.
126
- *
127
- * The exact format of SturdyRef depends on the "realm" in which the SturdyRef appears. A "realm"
128
- * is an abstract space in which all SturdyRefs have the same format and refer to the same set of
129
- * resources. Every vat is in exactly one realm. All capability clients within that vat must
130
- * produce SturdyRefs of the format appropriate for the realm.
131
- *
132
- * Similarly, every VatNetwork also resides in a particular realm. Usually, a vat's "realm"
133
- * corresponds to the realm of its main VatNetwork. However, a Vat can in fact communicate over
134
- * a VatNetwork in a different realm -- in this case, all SturdyRefs need to be transformed when
135
- * coming or going through said VatNetwork. The RPC system has hooks for registering
136
- * transformation callbacks for this purpose.
137
- *
138
- * Since the format of SturdyRef is realm-dependent, it is not defined here. An application should
139
- * choose an appropriate realm for itself as part of its design. Note that under Sandstorm, every
140
- * application exists in its own realm and is therefore free to define its own SturdyRef format;
141
- * the Sandstorm platform handles translating between realms.
142
- *
143
- * Note that whether a capability is persistent is often orthogonal to its type. In these cases,
144
- * the capability's interface should NOT inherit `Persistent`; instead, just perform a cast at
145
- * runtime. It's not type-safe, but trying to be type-safe in these cases will likely lead to
146
- * tears. In cases where a particular interface only makes sense on persistent capabilities, it
147
- * still should not explicitly inherit Persistent because the `SturdyRef` and `Owner` types will
148
- * vary between realms (they may even be different at the call site than they are on the
149
- * implementation). Instead, mark persistent interfaces with the $persistent annotation (defined
150
- * below).
151
- *
152
- * Sealing
153
- * -------
154
- *
155
- * As an added security measure, SturdyRefs may be "sealed" to a particular owner, such that
156
- * if the SturdyRef itself leaks to a third party, that party cannot actually restore it because
157
- * they are not the owner. To restore a sealed capability, you must first prove to its host that
158
- * you are the rightful owner. The precise mechanism for this authentication is defined by the
159
- * realm.
160
- *
161
- * Sealing is a defense-in-depth mechanism meant to mitigate damage in the case of catastrophic
162
- * attacks. For example, say an attacker temporarily gains read access to a database full of
163
- * SturdyRefs: it would be unfortunate if it were then necessary to revoke every single reference
164
- * in the database to prevent the attacker from using them.
165
- *
166
- * In general, an "owner" is a course-grained identity. Because capability-based security is still
167
- * the primary mechanism of security, it is not necessary nor desirable to have a separate "owner"
168
- * identity for every single process or object; that is exactly what capabilities are supposed to
169
- * avoid! Instead, it makes sense for an "owner" to literally identify the owner of the machines
170
- * where the capability is stored. If untrusted third parties are able to run arbitrary code on
171
- * said machines, then the sandbox for that code should be designed using Distributed Confinement
172
- * such that the third-party code never sees the bits of the SturdyRefs and cannot directly
173
- * exercise the owner's power to restore refs. See:
174
- *
175
- * http://www.erights.org/elib/capability/dist-confine.html
176
- *
177
- * Resist the urge to represent an Owner as a simple public key. The whole point of sealing is to
178
- * defend against leaked-storage attacks. Such attacks can easily result in the owner's private
179
- * key being stolen as well. A better solution is for `Owner` to contain a simple globally unique
180
- * identifier for the owner, and for everyone to separately maintain a mapping of owner IDs to
181
- * public keys. If an owner's private key is compromised, then humans will need to communicate
182
- * and agree on a replacement public key, then update the mapping.
183
- *
184
- * As a concrete example, an `Owner` could simply contain a domain name, and restoring a SturdyRef
185
- * would require signing a request using the domain's private key. Authenticating this key could
186
- * be accomplished through certificate authorities or web-of-trust techniques.
187
- * */
116
+ * Interface implemented by capabilities that outlive a single connection. A client may save()
117
+ * the capability, producing a SturdyRef. The SturdyRef can be stored to disk, then later used to
118
+ * obtain a new reference to the capability on a future connection.
119
+ *
120
+ * The exact format of SturdyRef depends on the "realm" in which the SturdyRef appears. A "realm"
121
+ * is an abstract space in which all SturdyRefs have the same format and refer to the same set of
122
+ * resources. Every vat is in exactly one realm. All capability clients within that vat must
123
+ * produce SturdyRefs of the format appropriate for the realm.
124
+ *
125
+ * Similarly, every VatNetwork also resides in a particular realm. Usually, a vat's "realm"
126
+ * corresponds to the realm of its main VatNetwork. However, a Vat can in fact communicate over
127
+ * a VatNetwork in a different realm -- in this case, all SturdyRefs need to be transformed when
128
+ * coming or going through said VatNetwork. The RPC system has hooks for registering
129
+ * transformation callbacks for this purpose.
130
+ *
131
+ * Since the format of SturdyRef is realm-dependent, it is not defined here. An application should
132
+ * choose an appropriate realm for itself as part of its design. Note that under Sandstorm, every
133
+ * application exists in its own realm and is therefore free to define its own SturdyRef format;
134
+ * the Sandstorm platform handles translating between realms.
135
+ *
136
+ * Note that whether a capability is persistent is often orthogonal to its type. In these cases,
137
+ * the capability's interface should NOT inherit `Persistent`; instead, just perform a cast at
138
+ * runtime. It's not type-safe, but trying to be type-safe in these cases will likely lead to
139
+ * tears. In cases where a particular interface only makes sense on persistent capabilities, it
140
+ * still should not explicitly inherit Persistent because the `SturdyRef` and `Owner` types will
141
+ * vary between realms (they may even be different at the call site than they are on the
142
+ * implementation). Instead, mark persistent interfaces with the $persistent annotation (defined
143
+ * below).
144
+ *
145
+ * Sealing
146
+ * -------
147
+ *
148
+ * As an added security measure, SturdyRefs may be "sealed" to a particular owner, such that
149
+ * if the SturdyRef itself leaks to a third party, that party cannot actually restore it because
150
+ * they are not the owner. To restore a sealed capability, you must first prove to its host that
151
+ * you are the rightful owner. The precise mechanism for this authentication is defined by the
152
+ * realm.
153
+ *
154
+ * Sealing is a defense-in-depth mechanism meant to mitigate damage in the case of catastrophic
155
+ * attacks. For example, say an attacker temporarily gains read access to a database full of
156
+ * SturdyRefs: it would be unfortunate if it were then necessary to revoke every single reference
157
+ * in the database to prevent the attacker from using them.
158
+ *
159
+ * In general, an "owner" is a course-grained identity. Because capability-based security is still
160
+ * the primary mechanism of security, it is not necessary nor desirable to have a separate "owner"
161
+ * identity for every single process or object; that is exactly what capabilities are supposed to
162
+ * avoid! Instead, it makes sense for an "owner" to literally identify the owner of the machines
163
+ * where the capability is stored. If untrusted third parties are able to run arbitrary code on
164
+ * said machines, then the sandbox for that code should be designed using Distributed Confinement
165
+ * such that the third-party code never sees the bits of the SturdyRefs and cannot directly
166
+ * exercise the owner's power to restore refs. See:
167
+ *
168
+ * http://www.erights.org/elib/capability/dist-confine.html
169
+ *
170
+ * Resist the urge to represent an Owner as a simple public key. The whole point of sealing is to
171
+ * defend against leaked-storage attacks. Such attacks can easily result in the owner's private
172
+ * key being stolen as well. A better solution is for `Owner` to contain a simple globally unique
173
+ * identifier for the owner, and for everyone to separately maintain a mapping of owner IDs to
174
+ * public keys. If an owner's private key is compromised, then humans will need to communicate
175
+ * and agree on a replacement public key, then update the mapping.
176
+ *
177
+ * As a concrete example, an `Owner` could simply contain a domain name, and restoring a SturdyRef
178
+ * would require signing a request using the domain's private key. Authenticating this key could
179
+ * be accomplished through certificate authorities or web-of-trust techniques.
180
+ * */
188
181
export class Persistent extends $ . Interface {
189
182
static readonly SaveParams = Persistent_SaveParams ;
190
183
static readonly SaveResults = Persistent_SaveResults ;
@@ -193,7 +186,7 @@ export class Persistent extends $.Interface {
193
186
static readonly _capnp = {
194
187
displayName : "Persistent" ,
195
188
id : "c8cb212fcd9f5691" ,
196
- size : new $ . ObjectSize ( 0 , 0 ) ,
189
+ size : new $ . ObjectSize ( 0 , 0 )
197
190
} ;
198
191
toString ( ) : string {
199
192
return "Persistent_" + super . toString ( ) ;
0 commit comments