orbit/orbit
orbit/orbit
0
0
Fork 0
Code Issues 3 Pull requests 5 Projects Releases Packages Wiki Activity Actions

sandbox: split raw irc.send into its own irc-raw permission (not bundled with irc)

Browse source
This commit is contained in:
Jean Chevronnet 2026-07-05 23:01:23 +00:00
parent badab01d50
commit 02d032d6d0
No known key found for this signature in database
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/modules/sandbox/protocol.ts
View file

@ -11,7 +11,11 @@
// on its own — the part that must never regress.
/** Permissions an operator can grant a sandboxed plugin in config.json. */
export const PERMISSIONS = ['irc', 'notify', 'storage'] as const;
// 'irc-raw' is deliberately separate from 'irc': the structured verbs (say/msg/
// join/part/list) are far less dangerous than raw wire access (irc.send can issue
// ANY command as the user — MODE, KICK, QUIT, …), so an operator must grant it on
// purpose rather than getting it bundled with 'irc'.
export const PERMISSIONS = ['irc', 'irc-raw', 'notify', 'storage'] as const;
export type Permission = (typeof PERMISSIONS)[number];
/** RPC methods the guest may call, mapped to the permission each one needs.
@ -19,7 +23,7 @@ export type Permission = (typeof PERMISSIONS)[number];
export const RPC_CAPABILITY: Record<string, Permission | null> = {
'irc.say': 'irc',
'irc.msg': 'irc',
'irc.send': 'irc',
'irc.send': 'irc-raw',
'irc.join': 'irc',
'irc.part': 'irc',
'irc.list': 'irc',