CertificatePermission class

Certificate permissions govern loading X.509 certificates and private keys into a SecurityContext.

WHY THIS IS NOT FilesystemPermission, which already covers the file read. It covers it as an ORDINARY read, and a private key is not an ordinary read: a script scoped to a directory that happens to contain one could hand it to a SecurityContext and serve traffic under the host's identity, with nothing in the grant list saying that was possible. Naming the capability separately is what lets an embedder allow a script to read its own data directory without also allowing it to impersonate the host.

IT GATES THE BYTES VARIANTS TOO, which read nothing. The capability being granted is "install key material into a TLS context", not "open a file" — usePrivateKeyBytes reaches the same end with bytes the script already holds, so gating only the path variants would leave the shorter route open. The path variants are checked TWICE, here and by the filesystem gate, and that is deliberate: they genuinely do both things.

Inheritance

Properties

description → String
Human-readable description of what this permission allows.
no setteroverride
hashCode → int
The hash code for this object.
no setterinherited
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
type → String
The type of permission (e.g., 'filesystem', 'network', 'process').
final

Methods

allows(dynamic operation) → bool
Checks if this permission allows the given operation.
override
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
toString() → String
A string representation of this object.
inherited

Operators

operator ==(Object other) → bool
The equality operator.
inherited

Static Properties

any → CertificatePermission
Allows all certificate operations.
final
load → CertificatePermission
Allows loading certificates and private keys into a SecurityContext.
final