endojs / endo

Endo is a distributed secure JavaScript sandbox, based on SES
Apache License 2.0
761 stars 68 forks source link

importing @endo/errors without importing SES #2319

Open turadg opened 2 weeks ago

turadg commented 2 weeks ago

What is the Problem Being Solved?

The assertion functions from SES are used by libraries such as @agoric/ertp. When one imports, say AmountMath, it's surprising to find that it fails unless you also init SES first. There's also no feedback about the problem or solution, just a failure to find the global assert.

Description of the Design

Migrate downstream clients to use @endo/errors instead of the global assert. E.g. https://github.com/Agoric/agoric-sdk/issues/5672

Make @endo/errors exports work without having initialized SES

Security Considerations

Scaling Considerations

Test Plan

Compatibility Considerations

Upgrade Considerations

kriskowal commented 1 week ago

Scaling and correctness considerations: Making @endo/errors work without ses running first means that anything using @endo/errors will entrain a copy of the assert internals of SES and will need to work if it is an eval twin of the globalThis.assert provided by SES, such that the tamed global console provided by ses can still unredact errors emitted by the @endo/errors eval twin. We may be able to mitigate this by allowing bundles to exit to a endo:assert host module if they are bundled in the presence of the "endo" tag for purposes of package conditional imports/exports like #1625.