search

sandstorm-io / sandstorm

Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager.
https://sandstorm.io
Other
6.7k stars 704 forks source link

SandstormApi.save() doesn't work on promises #2434

Closed kentonv closed 4 years ago

kentonv commented 8 years ago

SandstormApi.save() currently may do the wrong thing when given a promise capability, due to an interaction with RealmGateway: If the promise points back into the sandbox realm, then sandstormpi.save will intercept the SystemPersistent.save() call and change it to AppPersistent.save(). However, if the promise later resolves to a capability outside of the sandbox realm, then the AppPersistent.save() call will bounce back out, but sandstormpi.save blocks outbound save() calls since the app is supposed to call SandstormApi.save() instead.

To solve this, the inbound translation from SystemPersistent to AppPersistent should first wait for promise resolution.

Meanwhile, we should deprecate RealmGateway and use the membrane framework instead.

As a work-around, you can wait for promises to settle before calling save().

kentonv commented 7 years ago

Will be fixed by: https://github.com/sandstorm-io/capnproto/pull/378

ocdtrekkie commented 4 years ago

Can we say this is fixed then, since the referenced PR was merged into capnproto?

kentonv commented 4 years ago

Yes.