-
Notifications
You must be signed in to change notification settings - Fork 95
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Opaque values #1913
Opaque values #1913
Changes from 2 commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -261,6 +261,13 @@ pub enum Term { | |
/// | ||
/// This is a temporary solution, and will be removed in the future. | ||
Closure(CacheIndex), | ||
|
||
#[serde(skip)] | ||
/// An opaque value that cannot be constructed within Nickel code. | ||
/// | ||
/// This can be used by programs that embed Nickel, as they can inject these opaque | ||
/// values into the AST. | ||
Opaque(u64), | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I don't know if we spell There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. It might even be fairly straightforward to make the interpreter generic over these if desired; I don't actually need that for my usecases so it might not be worth it, but it might allow generalizing to other systems nicely. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I think that would be a bit painful, since it would involve carrying around an extra type parameter everywhere that There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I agree with Joe, on paper it's just adding a generic, but API-wise, this is painful, because you often have to propagate this type parameter everywhere (every site that uses a term, which is pretty much everywhere). For less fundamental datastructure we could a parameter and make an alias like |
||
} | ||
|
||
// PartialEq is mostly used for tests, when it's handy to compare something to an expected result. | ||
|
@@ -872,6 +879,7 @@ impl Term { | |
Term::SealingKey(_) => Some("SealingKey".to_owned()), | ||
Term::Sealed(..) => Some("Sealed".to_owned()), | ||
Term::Annotated(..) => Some("Annotated".to_owned()), | ||
Term::Opaque(_) => Some("Opaque".to_owned()), | ||
Term::Let(..) | ||
| Term::LetPattern(..) | ||
| Term::App(_, _) | ||
|
@@ -918,6 +926,7 @@ impl Term { | |
| Term::EnumVariant {..} | ||
| Term::Record(..) | ||
| Term::Array(..) | ||
| Term::Opaque(_) | ||
| Term::SealingKey(_) => true, | ||
Term::Let(..) | ||
| Term::LetPattern(..) | ||
|
@@ -975,6 +984,7 @@ impl Term { | |
| Term::Str(_) | ||
| Term::Lbl(_) | ||
| Term::Enum(_) | ||
| Term::Opaque(_) | ||
| Term::SealingKey(_) => true, | ||
Term::Let(..) | ||
| Term::LetPattern(..) | ||
|
@@ -1017,6 +1027,7 @@ impl Term { | |
| Term::Array(..) | ||
| Term::Var(..) | ||
| Term::SealingKey(..) | ||
| Term::Opaque(..) | ||
| Term::Op1(UnaryOp::StaticAccess(_), _) | ||
| Term::Op2(BinaryOp::DynAccess(), _, _) | ||
// Those special cases aren't really atoms, but mustn't be parenthesized because they | ||
|
@@ -2169,6 +2180,7 @@ impl Traverse<RichTerm> for RichTerm { | |
| Term::Import(_) | ||
| Term::ResolvedImport(_) | ||
| Term::SealingKey(_) | ||
| Term::Opaque(_) | ||
| Term::ParseError(_) | ||
| Term::RuntimeError(_) => None, | ||
Term::StrChunks(chunks) => chunks.iter().find_map(|ch| { | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -269,6 +269,8 @@ pub enum TypeF<Ty, RRows, ERows> { | |
/// | ||
/// See [`crate::term::Term::Sealed`]. | ||
Symbol, | ||
/// An opaque value, the type of `Term::Opaque`. | ||
Opaque, | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I wonder if we should even worry about having a type for that, given that the user can't do much with opaque values, and can't use this type right now (it's not in the grammar, and it would be a breaking change to add it). However it doesn't cost much, and maybe it could be useful for Rust binaries consuming the library? I'm not sure. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I was thinking that the nickel embedder might provide a function like There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Ah, you mean customizing the set of operations possible on opaque values with their own operations? There is still the problem that if the user can't write this type down, it is somehow a second class citizen (and once again, making it possible to spell it out is a breaking change). All of that being said, having the type internally is like 10 additional line of code, so let's not argue about it too much. It doesn't really hurt to have this type internally, and see later if it can be turned into something useful. I'm fine with keeping it as it is for now There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. A second idea to make it not a breaking change is to wait for the let-type RFC, and make it possible to define primitive types - think There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Perhaps a good way to do this would be to have a There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yeah, in fact the |
||
/// A type created from a user-defined contract. | ||
Flat(RichTerm), | ||
/// A function. | ||
|
@@ -543,6 +545,7 @@ impl<Ty, RRows, ERows> TypeF<Ty, RRows, ERows> { | |
TypeF::Number => Ok(TypeF::Number), | ||
TypeF::Bool => Ok(TypeF::Bool), | ||
TypeF::String => Ok(TypeF::String), | ||
TypeF::Opaque => Ok(TypeF::Opaque), | ||
TypeF::Symbol => Ok(TypeF::Symbol), | ||
TypeF::Flat(t) => Ok(TypeF::Flat(t)), | ||
TypeF::Arrow(dom, codom) => Ok(TypeF::Arrow(f(dom, state)?, f(codom, state)?)), | ||
|
@@ -818,6 +821,7 @@ impl Subcontract for Type { | |
TypeF::Number => internals::num(), | ||
TypeF::Bool => internals::bool(), | ||
TypeF::String => internals::string(), | ||
TypeF::Opaque => internals::opaque(), | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I think this contract can never be instantiated in practice (unless programmatically) . For example, we don't even bother elaborating a contract for There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. That being said, if you keep the type, I think keeping the contract as well makes sense rather than replace it with a |
||
// Array Dyn is specialized to array_dyn, which is constant time | ||
TypeF::Array(ref ty) if matches!(ty.typ, TypeF::Dyn) => internals::array_dyn(), | ||
TypeF::Array(ref ty) => mk_app!(internals::array(), ty.subcontract(vars, pol, sy)?), | ||
|
@@ -1402,6 +1406,7 @@ impl Traverse<Type> for Type { | |
| TypeF::Number | ||
| TypeF::Bool | ||
| TypeF::String | ||
| TypeF::Opaque | ||
| TypeF::Symbol | ||
| TypeF::Var(_) | ||
| TypeF::Enum(_) | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could be worth to insist on the fact that they cannot be constructed, but also should never be observable from within Nickel code (compared or distinguished by any means).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I made sure they can't be compared for equality; is there some other kind of observability that needs to be handled?
I was imagining that these values could be copied around (and possibly manipulated by functions provided by the nickel embedder). So you'd be able to write a contract like
{ username | String, token | ForeignId }
, and then by applying this contract you could observe the presence or absence of the token.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Right, I said observable, but the right technical term is probably separable, which means "distinguishable".
That is, for every context
C
(that you can think of just as a function here), for any pair of foreign keysk1
andk2
, then ifC k1 k2 ~> v
(the context evaluates to the valuev
), then for all other foreign keysk
andl
,C k l ~> v'
withv ~ v'
(I won't define the precise meaning of~
, but let's say it's an observational equivalence). Maybe we need to extend that to arbitrarily long finite lists of key.Put differently, no result of an expression can depend on the actual values of the keys. They must be all interchangeable without affecting the semantics. We need to include error messages as well (so my above specification is incomplete), because that's another way for a malicious user to get the value of the key indirectly - but you properly don't print the content of the key in the pretty printer, which is all good.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
comparing by equality between foreignIds is actually specifically fine and useful. Even being able to use them as keys in maps is fine and useful as long as that doesn't reveal the content of the opaque reference directly or indirectly. (though there is some subtlety of exactly which equality is being checked, since there could be two copies of the same reference, two different references to the same local data, or two different references to promises which will eventually become the same)
It's being able to forge them or inspect the backing data that's the problem, and as long as there's no way to make a new opaque reference (from inside the language; making them from foreign functions into the trusted platform is fine) that is satisfied, and no way to look up what's behind the foreign reference. Being able to check the arbitrary number in the foreign reference that indexes the backing table isn't even a security issue as long as the table itself is impossible to access, but it is good practice to forbid that since any kind of behavioral reliance on the specific values of those numbers is fragile and should be prevented, and if the numbers are viewable in the first place someone accidentally allowing forgery is more likely.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think using them as map keys is much more invasive. Currently record fields in Nickel are all strings, that you can list with stdlib functions. So opaque value would need special casing here.
Regarding equality, this is easy to add - I just wonder if there are other use-cases where you would want to not even have equality. In any case, I would propose to start the most restrictive possible and move forward with this PR, and then see cases by case what we would add and why, if that sounds good to you all.