Plugin Security Advanced

Plugin Security and Sandboxing Protocol

Defines comprehensive security mechanisms for plugin isolation, permission management, and threat protection in the ObjectStack ecosystem.

Features:

Fine-grained permission system
Resource access control
Sandboxing and isolation
Security scanning and verification
Runtime security monitoring

Source: packages/spec/src/kernel/plugin-security-advanced.zod.ts

TypeScript Usage

import { KernelSecurityPolicySchema, KernelSecurityScanResultSchema, KernelSecurityVulnerabilitySchema, PermissionActionSchema, PermissionScopeSchema, PluginPermissionSchema, PluginPermissionSetSchema, PluginSecurityManifestSchema, PluginTrustLevelSchema, ResourceTypeSchema, RuntimeConfigSchema, SandboxConfigSchema } from '@objectstack/spec/kernel';
import type { KernelSecurityPolicy, KernelSecurityScanResult, KernelSecurityVulnerability, PermissionAction, PermissionScope, PluginPermission, PluginPermissionSet, PluginSecurityManifest, PluginTrustLevel, ResourceType, RuntimeConfig, SandboxConfig } from '@objectstack/spec/kernel';

// Validate data
const result = KernelSecurityPolicySchema.parse(data);

KernelSecurityPolicy

Properties

Property	Type	Required
csp	`{ directives?: Record<string, string[]>; reportOnly: boolean }`	optional
cors	`{ allowedOrigins: string[]; allowedMethods: string[]; allowedHeaders: string[]; allowCredentials: boolean; … }`	optional
rateLimit	`{ enabled: boolean; maxRequests: integer; windowMs: integer; strategy: Enum<'fixed' \| 'sliding' \| 'token-bucket'> }`	optional
authentication	`{ required: boolean; methods: Enum<'jwt' \| 'oauth2' \| 'api-key' \| 'session' \| 'certificate'>[]; tokenExpiration?: integer }`	optional
encryption	`{ dataAtRest: boolean; dataInTransit: boolean; algorithm?: string; minKeyLength?: integer }`	optional
auditLog	`{ enabled: boolean; events?: string[]; retention?: integer }`	optional

Nested Shape: `KernelSecurityPolicy.rateLimit`

Property	Type	Required	Description
enabled	`boolean`	optional (default: `true`)
maxRequests	`integer`	✅
windowMs	`integer`	✅	Time window in milliseconds
strategy	`Enum<'fixed' \| 'sliding' \| 'token-bucket'>`	optional (default: `"sliding"`)

Nested Shape: `KernelSecurityPolicy.authentication`

Property	Type	Required	Description
required	`boolean`	optional (default: `true`)
methods	`Enum<'jwt' \| 'oauth2' \| 'api-key' \| 'session' \| 'certificate'>[]`	✅
tokenExpiration	`integer`	optional	Token expiration in seconds

Nested Shape: `KernelSecurityPolicy.encryption`

Property	Type	Required	Description
dataAtRest	`boolean`	optional (default: `false`)	Encrypt data at rest
dataInTransit	`boolean`	optional (default: `true`)	Enforce HTTPS/TLS
algorithm	`string`	optional	Encryption algorithm
minKeyLength	`integer`	optional	Minimum key length in bits

Nested Shape: `KernelSecurityPolicy.auditLog`

Property	Type	Required	Description
enabled	`boolean`	optional (default: `true`)
events	`string[]`	optional	Events to log
retention	`integer`	optional	Log retention in days

KernelSecurityScanResult

Properties

Property	Type	Required
timestamp	`string`	✅
scanner	`{ name: string; version: string }`	✅
status	`Enum<'passed' \| 'failed' \| 'warning'>`	✅
vulnerabilities	`{ cve?: string; id: string; severity: Enum<'critical' \| 'high' \| 'medium' \| 'low' \| 'info'>; category?: string; … }[]`	optional
codeIssues	`{ severity: Enum<'error' \| 'warning' \| 'info'>; type: string; file: string; line?: integer; … }[]`	optional
dependencyVulnerabilities	`{ package: string; version: string; vulnerability: object }[]`	optional
licenseCompliance	`{ status: Enum<'compliant' \| 'non-compliant' \| 'unknown'>; issues?: object[] }`	optional
summary	`{ totalVulnerabilities: integer; criticalCount: integer; highCount: integer; mediumCount: integer; … }`	✅

Nested Shape: `KernelSecurityScanResult.codeIssues[number]`

Property	Type	Required	Description
severity	`Enum<'error' \| 'warning' \| 'info'>`	✅
type	`string`	✅	Issue type (e.g., sql-injection, xss)
file	`string`	✅
line	`integer`	optional
message	`string`	✅
suggestion	`string`	optional

KernelSecurityVulnerability

Properties

Property	Type	Required
cve	`string`	optional
id	`string`	✅
severity	`Enum<'critical' \| 'high' \| 'medium' \| 'low' \| 'info'>`	✅
category	`string`	optional
title	`string`	✅
location	`string`	optional
remediation	`string`	optional
description	`string`	✅
affectedVersions	`string[]`	✅
fixedIn	`string[]`	optional
cvssScore	`number`	optional
exploitAvailable	`boolean`	optional (default: `false`)
patchAvailable	`boolean`	optional (default: `false`)
workaround	`string`	optional
references	`string[]`	optional
discoveredDate	`string`	optional
publishedDate	`string`	optional

PermissionAction

Type of action being permitted

Allowed Values

create
read
update
delete
execute
manage
configure
share
export
import
admin

PermissionScope

Scope of permission application

Allowed Values

global
tenant
user
resource
plugin

PluginPermission

Properties

Property	Type	Required	Description
id	`string`	✅	Unique permission identifier
resource	`Enum<'data.object' \| 'data.record' \| 'data.field' \| 'ui.view' \| 'ui.dashboard' \| 'ui.report' \| 'system.config' \| 'system.plugin' \| 'system.api' \| 'system.service' \| … +6 more>`	✅	Type of resource being accessed
actions	`Enum<'create' \| 'read' \| 'update' \| 'delete' \| 'execute' \| 'manage' \| 'configure' \| 'share' \| 'export' \| 'import' \| 'admin'>[]`	✅
scope	`Enum<'global' \| 'tenant' \| 'user' \| 'resource' \| 'plugin'>`	optional (default: `"plugin"`)	Scope of permission application
filter	`{ resourceIds?: string[]; condition?: string \| object; fields?: string[] }`	optional
description	`string`	✅
required	`boolean`	optional (default: `true`)
justification	`string`	optional	Why this permission is needed

Allowed Values: `PluginPermission.resource`

data.object
data.record
data.field
ui.view
ui.dashboard
ui.report
system.config
system.plugin
system.api
system.service
storage.file
storage.database
network.http
network.websocket
process.spawn
process.env

Nested Shape: `PluginPermission.filter`

Property	Type	Required	Description
resourceIds	`string[]`	optional
condition	`string \| { dialect: Enum<'cel' \| 'cron' \| 'template'>; source?: string; ast?: any; meta?: object }`	optional	Predicate (CEL) filter, e.g. P`record.owner == os.user.id`.
fields	`string[]`	optional	Allowed fields for data resources

PluginPermissionSet

Properties

Property	Type	Required
permissions	`{ id: string; resource: Enum<'data.object' \| 'data.record' \| 'data.field' \| 'ui.view' \| 'ui.dashboard' \| …>; actions: Enum<'create' \| 'read' \| 'update' \| 'delete' \| 'execute' \| 'manage' \| 'configure' \| …>[]; scope?: Enum<'global' \| 'tenant' \| 'user' \| 'resource' \| 'plugin'>; … }[]`	✅
groups	`{ name: string; description: string; permissions: string[] }[]`	optional
defaultGrant	`Enum<'prompt' \| 'allow' \| 'deny' \| 'inherit'>`	optional (default: `"prompt"`)

Nested Shape: `PluginPermissionSet.permissions[number]`

Property	Type	Required	Description
id	`string`	✅	Unique permission identifier
resource	`Enum<'data.object' \| 'data.record' \| 'data.field' \| 'ui.view' \| 'ui.dashboard' \| …>`	✅	Type of resource being accessed
actions	`Enum<'create' \| 'read' \| 'update' \| 'delete' \| 'execute' \| 'manage' \| 'configure' \| …>[]`	✅
scope	`Enum<'global' \| 'tenant' \| 'user' \| 'resource' \| 'plugin'>`	optional (default: `"plugin"`)	Scope of permission application
filter	`{ resourceIds?: string[]; condition?: string \| object; fields?: string[] }`	optional
description	`string`	✅
required	`boolean`	optional (default: `true`)
justification	`string`	optional	Why this permission is needed

Nested Shape: `PluginPermissionSet.groups[number]`

Property	Type	Required	Description
name	`string`	✅	Group name
description	`string`	✅
permissions	`string[]`	✅	Permission IDs in this group

PluginSecurityManifest

Properties

Property	Type	Required	Description
pluginId	`string`	✅
trustLevel	`Enum<'verified' \| 'trusted' \| 'community' \| 'untrusted' \| 'blocked'>`	✅	Trust level of the plugin
permissions	`{ permissions: object[]; groups?: object[]; defaultGrant?: Enum<'prompt' \| 'allow' \| 'deny' \| 'inherit'> }`	✅
sandbox	`{ enabled?: boolean; level?: Enum<'none' \| 'minimal' \| 'standard' \| 'strict' \| 'paranoid'>; runtime?: object; filesystem?: object; … }`	✅
policy	`{ csp?: object; cors?: object; rateLimit?: object; authentication?: object; … }`	optional
scanResults	`{ timestamp: string; scanner: object; status: Enum<'passed' \| 'failed' \| 'warning'>; vulnerabilities?: object[]; … }[]`	optional
vulnerabilities	`{ cve?: string; id: string; severity: Enum<'critical' \| 'high' \| 'medium' \| 'low' \| 'info'>; category?: string; … }[]`	optional
codeSigning	`{ signed: boolean; signature?: string; certificate?: string; algorithm?: string; … }`	optional
certifications	`{ name: string; issuer: string; issuedDate: string; expiryDate?: string; … }[]`	optional
securityContact	`{ email?: string; url?: string; pgpKey?: string }`	optional
vulnerabilityDisclosure	`{ policyUrl?: string; responseTime?: integer; bugBounty?: boolean }`	optional

Nested Shape: `PluginSecurityManifest.sandbox`

Property	Type	Required	Description
enabled	`boolean`	optional (default: `true`)
level	`Enum<'none' \| 'minimal' \| 'standard' \| 'strict' \| 'paranoid'>`	optional (default: `"standard"`)
runtime	`{ engine?: Enum<'v8-isolate' \| 'wasm' \| 'container' \| 'process'>; engineConfig?: object; resourceLimits?: object }`	optional	Execution environment and isolation settings
filesystem	`{ mode?: Enum<'none' \| 'readonly' \| 'restricted' \| 'full'>; allowedPaths?: string[]; deniedPaths?: string[]; maxFileSize?: integer }`	optional
network	`{ mode?: Enum<'none' \| 'local' \| 'restricted' \| 'full'>; allowedHosts?: string[]; deniedHosts?: string[]; allowedPorts?: number[]; … }`	optional
process	`{ allowSpawn?: boolean; allowedCommands?: string[]; timeout?: integer }`	optional
memory	`{ maxHeap?: integer; maxStack?: integer }`	optional
cpu	`{ maxCpuPercent?: number; maxThreads?: integer }`	optional
environment	`{ mode?: Enum<'none' \| 'readonly' \| 'restricted' \| 'full'>; allowedVars?: string[]; deniedVars?: string[] }`	optional

Nested Shape: `PluginSecurityManifest.certifications[number]`

Property	Type	Required	Description
name	`string`	✅	Certification name (e.g., SOC 2, ISO 27001)
issuer	`string`	✅
issuedDate	`string`	✅
expiryDate	`string`	optional
certificateUrl	`string`	optional

Nested Shape: `PluginSecurityManifest.vulnerabilityDisclosure`

Property	Type	Required	Description
policyUrl	`string`	optional
responseTime	`integer`	optional	Expected response time in hours
bugBounty	`boolean`	optional (default: `false`)

PluginTrustLevel

Trust level of the plugin

Allowed Values

verified
trusted
community
untrusted
blocked

ResourceType

Type of resource being accessed

Allowed Values

data.object
data.record
data.field
ui.view
ui.dashboard
ui.report
system.config
system.plugin
system.api
system.service
storage.file
storage.database
network.http
network.websocket
process.spawn
process.env

RuntimeConfig

Properties

Property	Type	Required	Description
engine	`Enum<'v8-isolate' \| 'wasm' \| 'container' \| 'process'>`	optional (default: `"v8-isolate"`)	Execution environment engine
engineConfig	`{ wasm?: object; container?: object; v8Isolate?: object }`	optional
resourceLimits	`{ maxMemory?: integer; maxCpu?: number; timeout?: integer }`	optional

Nested Shape: `RuntimeConfig.resourceLimits`

Property	Type	Required	Description
maxMemory	`integer`	optional	Maximum memory allocation
maxCpu	`number`	optional	Maximum CPU usage percentage
timeout	`integer`	optional	Maximum execution time

SandboxConfig

Properties

Property	Type	Required	Description
enabled	`boolean`	optional (default: `true`)
level	`Enum<'none' \| 'minimal' \| 'standard' \| 'strict' \| 'paranoid'>`	optional (default: `"standard"`)
runtime	`{ engine: Enum<'v8-isolate' \| 'wasm' \| 'container' \| 'process'>; engineConfig?: object; resourceLimits?: object }`	optional	Execution environment and isolation settings
filesystem	`{ mode: Enum<'none' \| 'readonly' \| 'restricted' \| 'full'>; allowedPaths?: string[]; deniedPaths?: string[]; maxFileSize?: integer }`	optional
network	`{ mode: Enum<'none' \| 'local' \| 'restricted' \| 'full'>; allowedHosts?: string[]; deniedHosts?: string[]; allowedPorts?: number[]; … }`	optional
process	`{ allowSpawn: boolean; allowedCommands?: string[]; timeout?: integer }`	optional
memory	`{ maxHeap?: integer; maxStack?: integer }`	optional
cpu	`{ maxCpuPercent?: number; maxThreads?: integer }`	optional
environment	`{ mode: Enum<'none' \| 'readonly' \| 'restricted' \| 'full'>; allowedVars?: string[]; deniedVars?: string[] }`	optional

Nested Shape: `SandboxConfig.runtime`

Property	Type	Required	Description
engine	`Enum<'v8-isolate' \| 'wasm' \| 'container' \| 'process'>`	optional (default: `"v8-isolate"`)	Execution environment engine
engineConfig	`{ wasm?: object; container?: object; v8Isolate?: object }`	optional
resourceLimits	`{ maxMemory?: integer; maxCpu?: number; timeout?: integer }`	optional

Nested Shape: `SandboxConfig.filesystem`

Property	Type	Required	Description
mode	`Enum<'none' \| 'readonly' \| 'restricted' \| 'full'>`	optional (default: `"restricted"`)
allowedPaths	`string[]`	optional	Whitelisted paths
deniedPaths	`string[]`	optional	Blacklisted paths
maxFileSize	`integer`	optional	Maximum file size in bytes

Nested Shape: `SandboxConfig.network`

Property	Type	Required	Description
mode	`Enum<'none' \| 'local' \| 'restricted' \| 'full'>`	optional (default: `"restricted"`)
allowedHosts	`string[]`	optional	Whitelisted hosts
deniedHosts	`string[]`	optional	Blacklisted hosts
allowedPorts	`number[]`	optional	Allowed port numbers
maxConnections	`integer`	optional

Nested Shape: `SandboxConfig.process`

Property	Type	Required	Description
allowSpawn	`boolean`	optional (default: `false`)	Allow spawning child processes
allowedCommands	`string[]`	optional	Whitelisted commands
timeout	`integer`	optional	Process timeout in ms

Nested Shape: `SandboxConfig.memory`

Property	Type	Required	Description
maxHeap	`integer`	optional	Maximum heap size in bytes
maxStack	`integer`	optional	Maximum stack size in bytes

Plugin Security Advanced

On this page