Enum Permission 

#[non_exhaustive]
pub enum Permission {
    Network {
        host: &'static str,
        reason: &'static str,
    },
    Files {
        path: &'static str,
        write: bool,
        reason: &'static str,
    },
    Launch {
        program: &'static str,
        reason: &'static str,
    },
    Credentials {
        reason: &'static str,
    },
}

Something an addon needs to be allowed to do (FR-046).

Declared as a set the addon needs in order to work, not as a wish list: the user grants or refuses the whole declaration, because a half-granted addon is a matrix of broken states nobody asked for and every one of them would have to be designed.

Only one of these is enforced, and this type does not pretend otherwise

Self::Credentials is real: the daemon holds the credential store and an addon can only ask, so a refusal is a refusal. The other three are declarations shown to the user, and an ungranted addon is simply not started — which is a genuine control, because a process that is not running opens no sockets. What is not true is that a running addon is confined to what it declared. Nothing stops a granted addon reaching a host it never mentioned.

That gap is ADR-0016’s, deliberately, and it is named in the interface rather than papered over: “may reach api.spotify.com” must not be read as “and nothing else” until platform confinement makes it true.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Network

Reach a host over the network.

One host per declaration rather than a list, so the interface can show them as separate lines and so a diff between two versions of an addon reads as “it now also wants X”.

Fields

host: &'static str

The host, as it appears in a URL: api.spotify.com.

reason: &'static str

Why, in a few words, shown next to it. An addon that cannot explain what it wants a host for is asking the user to guess.

Files

Read or write files under a path.

Fields

path: &'static str

The directory or file, as a path the user would recognise.

write: bool

Whether it writes, or only reads. The distinction is the whole difference between “reads your project list” and “can delete it”.

reason: &'static str

Why.

Launch

Start another program.

Fields

program: &'static str

What it starts. the default browser is a legitimate answer here — this is shown to a person, not matched against anything.

reason: &'static str

Why.

Credentials

Keep credentials of its own, in the OS credential store.

The enforced one. Ungranted, the daemon answers every credential ask with a refusal, which an addon must survive: it is the same answer as “nothing stored yet”, and an addon that handles being signed out already handles this.

Fields

reason: &'static str

Why. “To stay signed in to your Spotify account” — the account is the thing the user is actually deciding about.

Implementations

impl Permission

pub const fn reason(&self) -> &'static str

Why the addon says it needs this.

Trait Implementations

impl Clone for Permission

fn clone(&self) -> Permission

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Permission

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Permission

fn eq(&self, other: &Permission) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for Permission

impl Eq for Permission

impl StructuralPartialEq for Permission