dotCooCoo cde367b889 Plug-ins: only an approval records a grant, and installs need one ...

registry::grant takes a GrantToken, which the engine makes after a
person's approval and when it loads grants.json. registry::install,
install_bytes and folder loads refuse a module that lists permissions no
recorded grant gives this very module (Error::NeedsApproval), and leave
the plug-in under its id and the revision as they were. A folder load's
approve callback only narrows what installs. A module without
permissions, or with an empty list, installs as before.

A folder load in a session with a plug-in store records the store's
grant for each module it approves, so those modules still load.

docs/plugins.md says what the approval does not protect against: native
code linked into the app, and another program running as the same user,
which can edit the Plug-ins folder and its unsigned grants.json.

2026-11-11 17:35:06 -08:00

..

examples

…

src

Plug-ins: only an approval records a grant, and installs need one

2026-11-11 17:35:06 -08:00

tests

Plug-ins: only an approval records a grant, and installs need one

2026-11-11 17:35:06 -08:00

Cargo.toml

…