The ONE resolver for :ext/protected-paths.
An extension DECLARES rules ({:glob :access :hint}) and every surface obeys
them: the native file verbs (foundation/editing/core) and the Python
sandbox's own filesystem (sandbox-fs/confined-filesystem). Both consult this
namespace, so a path that is protected for delete is protected for
pathlib.Path.unlink too.
Precedence: first-match-wins WITHIN one extension, most-restrictive-wins
ACROSS extensions (:none > :read-only > :read-write) — no extension can
loosen another's boundary.
A TARGET is {:requested :resolved :absolute :kind}, where :resolved is the
workspace-relative, /-separated address the globs are written against.
The ONE resolver for `:ext/protected-paths`.
An extension DECLARES rules (`{:glob :access :hint}`) and every surface obeys
them: the native file verbs (`foundation/editing/core`) and the Python
sandbox's own filesystem (`sandbox-fs/confined-filesystem`). Both consult this
namespace, so a path that is protected for `delete` is protected for
`pathlib.Path.unlink` too.
Precedence: first-match-wins WITHIN one extension, most-restrictive-wins
ACROSS extensions (`:none` > `:read-only` > `:read-write`) — no extension can
loosen another's boundary.
A TARGET is `{:requested :resolved :absolute :kind}`, where `:resolved` is the
workspace-relative, `/`-separated address the globs are written against.(composite-target? {:keys [kind absolute]})Whether the target addresses a whole subtree (a directory, or a batch scope).
Whether the target addresses a whole subtree (a directory, or a batch scope).
(deny-fn env-thunk root-thunk)Build the predicate the Python sandbox's confine! consults.
env-thunk yields the live environment (whose active extensions declare the
rules); root-thunk yields the workspace root the globs are written against.
Returns (fn [operation abs-path] -> blocked rule | nil), where operation
is the sandbox's own file-read / file-write name. Throws when the rule
registry itself is broken — the caller fails CLOSED.
Build the predicate the Python sandbox's `confine!` consults. `env-thunk` yields the live environment (whose active extensions declare the rules); `root-thunk` yields the workspace root the globs are written against. Returns `(fn [operation abs-path] -> blocked rule | nil)`, where `operation` is the sandbox's own `file-read` / `file-write` name. Throws when the rule registry itself is broken — the caller fails CLOSED.
(glob-matches? glob rel)Whether glob matches the relative path rel (or its last segment).
Whether `glob` matches the relative path `rel` (or its last segment).
(glob-static-prefix glob)The literal directory prefix of glob, before its first wildcard.
The literal directory prefix of `glob`, before its first wildcard.
(path-prefix? ancestor path)Whether ancestor is path or one of its ancestors.
Whether `ancestor` is `path` or one of its ancestors.
(resolve-access rules target)The most restrictive rule matching target, or nil.
The most restrictive rule matching `target`, or nil.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |