f51924fdbc
Adds optional per-script overrides for the six Rhai sandbox knobs
(max_operations, max_string_size, max_array_size, max_map_size,
max_call_levels, max_expr_depth). The executor merges its defaults
with each script's overrides on every call; the manager validates
overrides against an admin-set ceiling at write time, so the
executor trusts whatever is stored.
Storage chose JSONB on the existing scripts table over six new
columns: lets future knobs land as code-only changes, keeps the
sparse common case (most scripts override nothing) cheap to store
and serialize, and matches how the manager + executor pass the
config across the wire.
* 0002_sandbox.sql — ALTER TABLE scripts ADD COLUMN sandbox
JSONB NOT NULL DEFAULT '{}'
* shared::ScriptSandbox — six Option<u64> fields with
deny_unknown_fields so typos surface as 422
* Script.sandbox + ExecRequest.sandbox_overrides — typed end
to end; cluster mode just serializes the same struct
* executor-core::Limits::with_overrides — field-by-field
replacement; tests cover the override actually tightening
the live engine
* manager-core::SandboxCeiling — built-in conservative
defaults (10M ops, 1 MiB strings, 100k array/map, 128
call/expr depth); env vars override per knob, invalid
values warn-and-skip rather than blocking boot
* manager-core admin API — POST/PUT accept `sandbox`; values
above the ceiling return 422 with the specific field +
requested + ceiling; absent or `{}` keeps platform defaults
* picloud all-in-one — wires SandboxCeiling::from_env() into
AdminState
* memory_limit_mb stays in the schema, marked v1.3+ advisory
(no enforcement until OS-level isolation lands with
cluster-mode executors)
Verified live through Caddy:
* /version reports schema 2, product 0.3.0
* Script with max_operations: 500 → 507 on a 10k-iteration loop
* Same script after PUT raising to 1M → succeeds, returns 10000
* POST with max_operations: 1_000_000_000 → 422 (exceeds ceiling)
Tests:
* 13 executor-core unit tests (added 2 for override semantics)
* 20 integration tests (added 6 for sandbox CRUD + ceiling +
unknown-field rejection + executor honoring overrides)
* default cargo test --workspace stays green (integration tests
remain #[ignore]'d until DATABASE_URL is set)
Bumps:
* schema 1 → 2
* product 0.2.0 → 0.3.0
* SDK unchanged (scripts see nothing new)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
75 lines
2.5 KiB
Rust
75 lines
2.5 KiB
Rust
use picloud_shared::ScriptSandbox;
|
|
|
|
/// Resource and capability limits applied to every script execution.
|
|
///
|
|
/// Defaults are conservative and safe to expose to untrusted Rhai sources.
|
|
/// Per-script overrides (via `Limits::with_overrides`) replace individual
|
|
/// fields; the manager clamps every override against the admin ceiling at
|
|
/// write time, so the executor trusts what arrives in `ExecRequest`.
|
|
#[derive(Debug, Clone, Copy)]
|
|
pub struct Limits {
|
|
/// Hard cap on Rhai operations executed per invocation.
|
|
/// Doubles as a CPU-time proxy without needing real timers.
|
|
pub max_operations: u64,
|
|
|
|
/// Max length of any single string the script constructs.
|
|
pub max_string_size: usize,
|
|
|
|
/// Max number of elements in any array.
|
|
pub max_array_size: usize,
|
|
|
|
/// Max number of properties in any object/map.
|
|
pub max_map_size: usize,
|
|
|
|
/// Max call/expression nesting depth.
|
|
pub max_call_levels: usize,
|
|
pub max_expr_depth: usize,
|
|
}
|
|
|
|
impl Default for Limits {
|
|
fn default() -> Self {
|
|
Self {
|
|
max_operations: 1_000_000,
|
|
max_string_size: 64 * 1024,
|
|
max_array_size: 10_000,
|
|
max_map_size: 10_000,
|
|
max_call_levels: 64,
|
|
max_expr_depth: 64,
|
|
}
|
|
}
|
|
}
|
|
|
|
impl Limits {
|
|
/// Returns a new `Limits` with each field replaced by the matching
|
|
/// override if present, otherwise the existing field. Overrides
|
|
/// arrive as `u64` for JSONB round-tripping cleanliness; they're
|
|
/// narrowed to `usize` here, saturating on the unlikely overflow
|
|
/// (these caps come from admin-clamped writes, so the values are
|
|
/// always small).
|
|
#[must_use]
|
|
pub fn with_overrides(&self, overrides: &ScriptSandbox) -> Self {
|
|
Self {
|
|
max_operations: overrides.max_operations.unwrap_or(self.max_operations),
|
|
max_string_size: overrides
|
|
.max_string_size
|
|
.map_or(self.max_string_size, narrow_usize),
|
|
max_array_size: overrides
|
|
.max_array_size
|
|
.map_or(self.max_array_size, narrow_usize),
|
|
max_map_size: overrides
|
|
.max_map_size
|
|
.map_or(self.max_map_size, narrow_usize),
|
|
max_call_levels: overrides
|
|
.max_call_levels
|
|
.map_or(self.max_call_levels, narrow_usize),
|
|
max_expr_depth: overrides
|
|
.max_expr_depth
|
|
.map_or(self.max_expr_depth, narrow_usize),
|
|
}
|
|
}
|
|
}
|
|
|
|
fn narrow_usize(v: u64) -> usize {
|
|
usize::try_from(v).unwrap_or(usize::MAX)
|
|
}
|