Plugin Security and Sandboxing Protocol

Defines comprehensive security mechanisms for plugin isolation, permission management, and threat protection in the ObjectStack ecosystem.

Features:

Fine-grained permission system
Resource access control
Sandboxing and isolation
Security scanning and verification
Runtime security monitoring

Source: packages/spec/src/kernel/plugin-security-advanced.zod.ts

TypeScript Usage

import { KernelSecurityPolicySchema, KernelSecurityScanResultSchema, KernelSecurityVulnerabilitySchema, PermissionActionSchema, PermissionScopeSchema, PluginPermissionSchema, PluginPermissionSetSchema, PluginSecurityManifestSchema, PluginTrustLevelSchema, ResourceTypeSchema, RuntimeConfigSchema, SandboxConfigSchema } from '@objectstack/spec/kernel';
import type { KernelSecurityPolicy, KernelSecurityScanResult, KernelSecurityVulnerability, PermissionAction, PermissionScope, PluginPermission, PluginPermissionSet, PluginSecurityManifest, PluginTrustLevel, ResourceType, RuntimeConfig, SandboxConfig } from '@objectstack/spec/kernel';

// Validate data
const result = KernelSecurityPolicySchema.parse(data);

KernelSecurityPolicy

Properties

Property	Type	Required
csp	`{ directives?: Record<string, string[]>; reportOnly: boolean }`	optional
cors	`{ allowedOrigins: string[]; allowedMethods: string[]; allowedHeaders: string[]; allowCredentials: boolean; … }`	optional
rateLimit	`{ enabled: boolean; maxRequests: integer; windowMs: integer; strategy: Enum<'fixed' \| 'sliding' \| 'token-bucket'> }`	optional
authentication	`{ required: boolean; methods: Enum<'jwt' \| 'oauth2' \| 'api-key' \| 'session' \| 'certificate'>[]; tokenExpiration?: integer }`	optional
encryption	`{ dataAtRest: boolean; dataInTransit: boolean; algorithm?: string; minKeyLength?: integer }`	optional
auditLog	`{ enabled: boolean; events?: string[]; retention?: integer }`	optional

KernelSecurityScanResult

Properties

Property	Type	Required
timestamp	`string`	✅
scanner	`{ name: string; version: string }`	✅
status	`Enum<'passed' \| 'failed' \| 'warning'>`	✅
vulnerabilities	`{ cve?: string; id: string; severity: Enum<'critical' \| 'high' \| 'medium' \| 'low' \| 'info'>; category?: string; … }[]`	optional
codeIssues	`{ severity: Enum<'error' \| 'warning' \| 'info'>; type: string; file: string; line?: integer; … }[]`	optional
dependencyVulnerabilities	`{ package: string; version: string; vulnerability: object }[]`	optional
licenseCompliance	`{ status: Enum<'compliant' \| 'non-compliant' \| 'unknown'>; issues?: object[] }`	optional
summary	`{ totalVulnerabilities: integer; criticalCount: integer; highCount: integer; mediumCount: integer; … }`	✅

KernelSecurityVulnerability

Properties

Property	Type	Required
cve	`string`	optional
id	`string`	✅
severity	`Enum<'critical' \| 'high' \| 'medium' \| 'low' \| 'info'>`	✅
category	`string`	optional
title	`string`	✅
location	`string`	optional
remediation	`string`	optional
description	`string`	✅
affectedVersions	`string[]`	✅
fixedIn	`string[]`	optional
cvssScore	`number`	optional
exploitAvailable	`boolean`	✅
patchAvailable	`boolean`	✅
workaround	`string`	optional
references	`string[]`	optional
discoveredDate	`string`	optional
publishedDate	`string`	optional

PermissionAction

Type of action being permitted

Allowed Values

create
read
update
delete
execute
manage
configure
share
export
import
admin

PermissionScope

Scope of permission application

Allowed Values

global
tenant
user
resource
plugin

PluginPermission

Properties

Property	Type	Required	Description
id	`string`	✅	Unique permission identifier
resource	`Enum<'data.object' \| 'data.record' \| 'data.field' \| 'ui.view' \| 'ui.dashboard' \| 'ui.report' \| 'system.config' \| 'system.plugin' \| 'system.api' \| 'system.service' \| … +6 more>`	✅	Type of resource being accessed
actions	`Enum<'create' \| 'read' \| 'update' \| 'delete' \| 'execute' \| 'manage' \| 'configure' \| 'share' \| 'export' \| 'import' \| 'admin'>[]`	✅
scope	`Enum<'global' \| 'tenant' \| 'user' \| 'resource' \| 'plugin'>`	optional	Scope of permission application
filter	`{ resourceIds?: string[]; condition?: string \| object; fields?: string[] }`	optional
description	`string`	✅
required	`boolean`	optional
justification	`string`	optional	Why this permission is needed

Allowed Values: `PluginPermission.resource`

data.object
data.record
data.field
ui.view
ui.dashboard
ui.report
system.config
system.plugin
system.api
system.service
storage.file
storage.database
network.http
network.websocket
process.spawn
process.env

PluginPermissionSet

Properties

Property	Type	Required
permissions	`{ id: string; resource: Enum<'data.object' \| 'data.record' \| 'data.field' \| 'ui.view' \| 'ui.dashboard' \| … +11 more>; actions: Enum<'create' \| 'read' \| 'update' \| 'delete' \| 'execute' \| 'manage' \| 'configure' \| … +4 more>[]; scope?: Enum<'global' \| 'tenant' \| 'user' \| 'resource' \| 'plugin'>; … }[]`	✅
groups	`{ name: string; description: string; permissions: string[] }[]`	optional
defaultGrant	`Enum<'prompt' \| 'allow' \| 'deny' \| 'inherit'>`	optional

PluginSecurityManifest

Properties

Property	Type	Required	Description
pluginId	`string`	✅
trustLevel	`Enum<'verified' \| 'trusted' \| 'community' \| 'untrusted' \| 'blocked'>`	✅	Trust level of the plugin
permissions	`{ permissions: object[]; groups?: object[]; defaultGrant?: Enum<'prompt' \| 'allow' \| 'deny' \| 'inherit'> }`	✅
sandbox	`{ enabled?: boolean; level?: Enum<'none' \| 'minimal' \| 'standard' \| 'strict' \| 'paranoid'>; runtime?: object; filesystem?: object; … }`	✅
policy	`{ csp?: object; cors?: object; rateLimit?: object; authentication?: object; … }`	optional
scanResults	`{ timestamp: string; scanner: object; status: Enum<'passed' \| 'failed' \| 'warning'>; vulnerabilities?: object[]; … }[]`	optional
vulnerabilities	`{ cve?: string; id: string; severity: Enum<'critical' \| 'high' \| 'medium' \| 'low' \| 'info'>; category?: string; … }[]`	optional
codeSigning	`{ signed: boolean; signature?: string; certificate?: string; algorithm?: string; … }`	optional
certifications	`{ name: string; issuer: string; issuedDate: string; expiryDate?: string; … }[]`	optional
securityContact	`{ email?: string; url?: string; pgpKey?: string }`	optional
vulnerabilityDisclosure	`{ policyUrl?: string; responseTime?: integer; bugBounty?: boolean }`	optional

PluginTrustLevel

Trust level of the plugin

Allowed Values

verified
trusted
community
untrusted
blocked

ResourceType

Type of resource being accessed

Allowed Values

data.object
data.record
data.field
ui.view
ui.dashboard
ui.report
system.config
system.plugin
system.api
system.service
storage.file
storage.database
network.http
network.websocket
process.spawn
process.env

RuntimeConfig

Properties

Property	Type	Required	Description
engine	`Enum<'v8-isolate' \| 'wasm' \| 'container' \| 'process'>`	✅	Execution environment engine
engineConfig	`{ wasm?: object; container?: object; v8Isolate?: object }`	optional
resourceLimits	`{ maxMemory?: integer; maxCpu?: number; timeout?: integer }`	optional

SandboxConfig

Properties

Property	Type	Required	Description
enabled	`boolean`	✅
level	`Enum<'none' \| 'minimal' \| 'standard' \| 'strict' \| 'paranoid'>`	✅
runtime	`{ engine: Enum<'v8-isolate' \| 'wasm' \| 'container' \| 'process'>; engineConfig?: object; resourceLimits?: object }`	optional	Execution environment and isolation settings
filesystem	`{ mode: Enum<'none' \| 'readonly' \| 'restricted' \| 'full'>; allowedPaths?: string[]; deniedPaths?: string[]; maxFileSize?: integer }`	optional
network	`{ mode: Enum<'none' \| 'local' \| 'restricted' \| 'full'>; allowedHosts?: string[]; deniedHosts?: string[]; allowedPorts?: number[]; … }`	optional
process	`{ allowSpawn: boolean; allowedCommands?: string[]; timeout?: integer }`	optional
memory	`{ maxHeap?: integer; maxStack?: integer }`	optional
cpu	`{ maxCpuPercent?: number; maxThreads?: integer }`	optional
environment	`{ mode: Enum<'none' \| 'readonly' \| 'restricted' \| 'full'>; allowedVars?: string[]; deniedVars?: string[] }`	optional

Plugin Security Advanced

Plugin Security and Sandboxing Protocol

TypeScript Usage

KernelSecurityPolicy

Properties

KernelSecurityScanResult

Properties

KernelSecurityVulnerability

Properties

PermissionAction

Allowed Values

PermissionScope

Allowed Values

PluginPermission

Properties

Allowed Values: `PluginPermission.resource`

PluginPermissionSet

Properties

PluginSecurityManifest

Properties

PluginTrustLevel

Allowed Values

ResourceType

Allowed Values

RuntimeConfig

Properties

SandboxConfig

Properties

On this page