Make telefuncs default safe?

Reading https://telefunc.com/shield I am concerned that someone inevitably will forget to include a throw new Abort() or a shield() command, and thus expose functions that are dangerous.

How about making telefunc default safe / restrictive, and then only opening up based on an explicit whitelisting approach, instead of a blacklisting approach?

So instead of shield() you could have unshield() or expose(), and similar for Abort. All functions could throw new Abort() abort by default, unless the context is set explicitly.

So instead of:

  if( !context.user?.isAdmin ) {
    throw new Abort()
  }
  const result = await database.runSQL(query)
  return result

It could be something like:

  if( context.user?.isAdmin ) {
    const result = await database.runSQL(query)
    return result
  } else {
    throw new Abort() // could be made default, so this else-condition would not be needed
  }

[brillout]

// Environment: Node.js server

import { telefuncConfig } from 'telefunc'
// Enforce all telefunctions to have a permission function
telefuncConfig.permissionFunction = true

// components/Comment.telefunc.js
// Environment: Node.js server

import { permission } from '../auth/permission'
import { shield } from 'telefunc'

// Only admins are allowed to delete comments
shield(onCommentDelete, [shield.type.number], permission('admin'))
export async function onCommentDelete(id) {
  const comment = await Comment.findOne({ id })
  await comment.delete()
}

// auth/permission.js
// Environment: Node.js server

export { permission }

import { getContext } from 'telefunc'

function permission(permissionName) {
  return () => {
    if (permissionName === 'public') {
      return true
    }

    if (permissionName === 'admin') {
      const { user } = getContext()
      return user?.isAdmin
    }

    // ...
  }
}

This means that our telefunctions are guaranteed to be secure (as long as our permission() function is correct).

Thoughts?

[brillout]

I am concerned that someone inevitably will forget to include a throw new Abort() or a shield() command, and thus expose functions that are dangerous.

I agree that’s a problem. It’s actually a problem with RPC in general.

Or something like this:

export async function runSQL(query) {
  const { user } = getContext()
  if (user.isAdmin) {
    allow()
  }
  const result = await database.runSQL(query)
  return result
}

But the problem with that is that allow() cannot be called after await:

export async function someTelefunction() {
  await somePromise;
  // This won't work
  allow()
}

In JavaScript, async call stacks cannot be traced.