pulp::view::CapabilitySet Class Reference

A granted-capability set. More...

#include <reload_capabilities.hpp>

Public Member Functions
	CapabilitySet ()=default
void	grant (ReloadCapability c)
bool	has (ReloadCapability c) const
bool	empty () const
bool	is_legacy_default () const noexcept
	True only for a set produced by all(): the unenforced grant every trusted/local realm still receives by default.
std::optional< ReloadCapability >	first_effectful () const noexcept
	Return the first granted effectful capability in stable declaration order.

Static Public Member Functions
static CapabilitySet	all ()
static bool	parse (const std::vector< std::string > &names, CapabilitySet &out)
	Parse a declared-capability name list (from the signed manifest).

Detailed Description

A granted-capability set.

Small fixed universe → a bitmask. Default = EMPTY (most restrictive), which is the consumer/protected-dev default; local-dev constructs all() (unenforced).

Constructor & Destructor Documentation

CapabilitySet()

pulp::view::CapabilitySet::CapabilitySet ( )

default

Member Function Documentation

all()

CapabilitySet pulp::view::CapabilitySet::all ( )

inlinestatic

empty()

bool pulp::view::CapabilitySet::empty ( ) const

inline

first_effectful()

std::optional< ReloadCapability > pulp::view::CapabilitySet::first_effectful ( ) const

inlinenoexcept

Return the first granted effectful capability in stable declaration order.

All current reload capabilities expose native side effects, so a live-realm evaluator must require this to be empty rather than trying to hide selected globals inside the same realm.

grant()

void pulp::view::CapabilitySet::grant ( ReloadCapability c )

inline

has()

bool pulp::view::CapabilitySet::has ( ReloadCapability c ) const

inline

is_legacy_default()

bool pulp::view::CapabilitySet::is_legacy_default ( ) const

inlinenoexcept

True only for a set produced by all(): the unenforced grant every trusted/local realm still receives by default.

A policy that must not fire until that default is replaced by an explicit grant keys on this, so an EXPLICIT grant of the same capabilities counts as a decision while the legacy default does not. Parsing a manifest or granting onto an empty set never yields a legacy-default set.

parse()

bool pulp::view::CapabilitySet::parse ( const std::vector< std::string > & names, CapabilitySet & out )

inlinestatic

Parse a declared-capability name list (from the signed manifest).

Returns false if any token is unknown (fail closed — reject the whole set).

---

The documentation for this class was generated from the following file:

• /home/runner/work/pulp/pulp/core/view/include/pulp/view/reload_capabilities.hpp