Need to thread configuration data through to lockdown

[erights]

See #488 for one of the uses that would benefit.

[dckc]

I'm manually editing install-ses.js to change stackFiltering to verbose. There has to be a better way. Is this a time and place for environment variables? hm.

@erights writes:

Yes, we need to figure out some way to provide lockdown parameters as data somehow, other than by editing code. We also need lockdown to accept configuration data rather than just named choices as these parameters. Environment variables are on the table as a candidate, which shows just how desperately we need this :/

[erights]

See Agoric/agoric-sdk#2160
See https://github.com/Agoric/agoric-sdk/wiki/Code-Review-Checklist

[FUDCo]

@erights inquired on keybase how one might do this without resorting to environment variables.

My take is that the primary use case for needing this is tests, which may be a special case but it's a very important, very common case whose actual needs are simple.

Tests know that they're tests and that (1) things go wrong in tests so we should be prepared to be maximally helpful when that happens, and (2) tests aren't usually a place where we care much about security rigor (except, of course, for tests that are testing the security rigor itself, but that's mostly not what we're dealing with here).

In tests, for a control affordance I would kind of like to just replace import test from 'ava'; with import test from '@agoric/something';

Alternatively, replace import '@agoric/install-ses'; with import '@agoric/install-somethingelse'; where somethingelse understands that it's being incorporated into a test environment.

Since there's already standard boilerplate at the top of each test file, it's not a particular burden to have to modify that boilerplate into something else, as long as there's a convenient something else available to modify it to.

[dckc]

... Alternatively, replace import '@agoric/install-ses'; with import '@agoric/install-somethingelse'; where somethingelse understands that it's being incorporated into a test environment.

The other day we were chatting bout this as an enhancement to #2571 :

import test from '@agoric/swingset-vat/tools/prepare-test-env';

for reference...

https://github.com/Agoric/agoric-sdk/blob/master/packages/SwingSet/test/test-comms.js

https://github.com/Agoric/agoric-sdk/blob/master/packages/SwingSet/tools/prepare-test-env.js

[kumavis]

ill just add that you can use esm query params to import a parameterized package and im sure its a marvelous foot gun that doesnt actually solve this problem

[dckc]

esm query params... pointer to details? A quick search didn't find much.

I don't think it helps in our use case (changing parameters without changing references to the package / module) but it seems interesting for cases when the reference can change.

[kumavis]

@dckc import xyz from './abc.js?didYouKnow=false&thatYouCanDoThis=true' and then read in import.meta

[dckc]

ah. so just inspection of import.meta.url.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/import.meta