Permissions and capabilities

Permissions

A permission is a name your app holds or does not. A call that needs one your app does not hold raises.

Your app gets a permission in one of these ways:

• Its manifest asks for it. A package lists the permissions it needs under capabilities. Before its script runs, DatumHue asks the app that starts it for each one; if any is refused, the app does not start. So datumhue.app.has_permission is true for every permission the manifest lists, from the first line on.
• It asks while running. datumhue.app.request_permission asks for a permission the app can do without. It waits for the answer, which may come from a person (Waiting).
• The app that starts it passes it on, in the permissions option of datumhue.app.spawn (Launch other apps).
• It is the root app. The app a launch starts, such as the one datumhue run runs, holds every permission.

In a browser, a link to the workstation can name its root app in place of the workstation's own window manager. The workstation then first shows the person the app and the registry it comes from, and opens it only when they press Open; Cancel opens the window manager.

A manifest asks for permissions like this:

capabilities "screenshot"

Capabilities

A capability is a handle to one resource, such as a folder (a Dir) or a file (a File). Holding the handle is the grant: your app cannot make one up, and reaches nothing outside what the handle names. Handles arrive in datumhue.args, under the name they were given:

• from the command line: --dir NAME:PATH and --file NAME:PATH grant read-only access, and --dir-rw and --file-rw let the app write too (datumhue run);
• from the app that started yours, in the dirs and files options of datumhue.app.spawn.

So datumhue run --dir photos:pictures app.lua puts a read-only Dir named photos, over the pictures folder, in datumhue.args.dirs. A file someone picks in a file dialog arrives as a handle too (Open, pick and save files).

Grants flow down

Apps form a tree: the root app at the top, usually a window manager, and below each app the apps it started. Every grant comes from the app above.

root app            holds every permission and the launch's handles
+-- window manager  holds what the root app passed it
    +-- your app    holds what the window manager passed it
        +-- child   holds what your app passed it

An app can pass on only what it holds itself: asking datumhue.app.spawn for a permission your app lacks gives the child nothing. A folder can be passed on read-only even when your app may write to it. So a grant only ever narrows on its way down.

Physics needs no grant. Each app simulates its own bodies, and bodies of different apps never touch.

See also

• Packages and identity
• Manifest reference
• Open, pick and save files

Reference used on this page: datumhue.screen.screenshot datumhue.identity datumhue.commerce datumhue.commerce.devices datumhue.app.has_permission datumhue.app.request_permission datumhue.app.spawn datumhue.args