proposal: Capability Permissions for External Packages

[PyXiion]

Problem

Remote or third-party Lua packages execute inside the server runtime. Server owners may want to use a package without granting it unrestricted access to networking, storage, commands, or world mutation.

This is separate from player permissions such as player:hasPermission().

Proposal

Allow packages to declare requested capabilities:

{
  "id": "discord_bridge",
  "permissions": [
    "network.http",
    "events.register",
    "storage.write"
  ]
}

Server configuration could approve capabilities:

[packages.discord_bridge]
enabled = true
allow = ["network.http", "events.register"]

Possible capabilities:

• events.register
• commands.register
• network.http
• storage.read
• storage.write
• world.read
• world.modify
• ui
• server.execute

Important design constraint

Checking permissions only while a module is loading is insufficient. A module can register a callback and use the API later. Runtime calls must retain the module/package capability context.

A simple first version could restrict or approve entire remote packages globally. A stronger version could load each package with its own Lua environment and a filtered mc API.

Initial scope

• Apply this primarily to external packages.
• Keep existing local scripts trusted for backwards compatibility.
• Make remote imports opt-in by default.
• Produce explicit errors when a capability is denied.
• Do not treat this as a perfect security sandbox.

Open questions

• Should capabilities be package-wide or per module?
• How should package dependencies inherit permissions?
• Is a filtered environment practical with the current shared Lua state?