Merge pull request #39 from bordumb/dev-securityHardening

chore: security hardening with tests and cleanup

Author: bordumb

crates/capsec-core/src/attenuate.rs

@@ -173,6 +173,17 @@ mod tests {
         assert!(scope.check("evil.com:8080").is_err());
     }
 
+    #[test]
+    fn host_scope_rejects_domain_confusion() {
+        let scope = HostScope::new(["api.example.com"]);
+        // "api.example.com.evil.com" must NOT match "api.example.com"
+        assert!(scope.check("api.example.com.evil.com").is_err());
+        // But exact match and valid suffixes must still work
+        assert!(scope.check("api.example.com").is_ok());
+        assert!(scope.check("api.example.com:443").is_ok());
+        assert!(scope.check("api.example.com/path").is_ok());
+    }
+
     #[test]
     fn dir_scope_rejects_traversal() {
         // Create a scope for a real directory

crates/capsec-core/src/has.rs

@@ -154,6 +154,12 @@ macro_rules! impl_tuple_has_second {
     ($single:ident) => {};
 }
 
+// NOTE: Scaling cliff — these macros enumerate all concrete permission pairs.
+// Current: 10 types → 190 impls (100 first-element + 90 second-element).
+// Adding 3 more types → ~319 impls. 3-tuples are not supported at all.
+// This is a Rust coherence limitation (no generic impl without specialization).
+// Workaround: use #[capsec::context] structs instead of tuples for >2 permissions.
+// If the permission count grows significantly, consider generating impls via build script.
 impl_tuple_has_first!(
     [FsRead, FsWrite, FsAll, NetConnect, NetBind, NetAll, EnvRead, EnvWrite, Spawn, Ambient];
     [FsRead, FsWrite, FsAll, NetConnect, NetBind, NetAll, EnvRead, EnvWrite, Spawn, Ambient]

crates/capsec/examples/domain_wrapper.rs

@@ -139,9 +139,8 @@ fn process_and_save(config: &ConfigService, output: &OutputWriter) {
 
 // ─── Entry point ─────────────────────────────────────────────────
 
-fn main() {
-    let root = capsec::root();
-
+#[capsec::main]
+fn main(root: CapRoot) {
     // Inject capabilities at the domain wrapper boundary.
     // After this point, no function sees Cap<P> or Has<P>.
     let config = ConfigService::new("/tmp/capsec-demo/config", root.grant::<FsRead>());