gno.land/p/moul/nestedpkg

Access control by package path. Instead of "is the caller this address", ask "is the caller inside my namespace, below me, or above me in the tree".

1func IsCallerSubPath(_ int, rlm realm) bool
2func IsCallerParentPath(_ int, rlm realm) bool
3func IsSameNamespace(_ int, rlm realm) bool
4
5func AssertCallerIsSubPath(_ int, rlm realm)     // panics instead
6func AssertCallerIsParentPath(_ int, rlm realm)
7func AssertIsSameNamespace(_ int, rlm realm)

Each helper compares rlm.PkgPath() with rlm.Previous().PkgPath():

That is what makes upgrade patterns work: r/moul/app/v2 can be allowed to read r/moul/app/v1's state without either version knowing the other's address, because the namespace is the credential.

Security: why every helper takes rlm realm

A realm value can be captured and stashed. A hostile realm that kept one from an earlier call could hand it back later to impersonate the path it names. Every helper here gates on rlm.IsCurrent() first, before reading any path, which closes that forgery: the value must be the live one for this call.

The two families fail differently, on purpose:

• Is* returns false on a stale rlm (fail closed, so a check cannot be turned into a pass by replaying an old value);
• Assert* panics.

The leading _ int parameter is unused (_). Pass 0.

Part of moul/gno-contracts — moul's versioned gno.land contracts. See the repository for the full catalog, build/test tooling, and usage.

⚠️ Disclaimer: provided as-is, without warranty; not security-audited. Full disclaimer: DISCLAIMER.