How to achieve importValue similar to the Shadow Realms proposal?

[samuelstroschein]

Hi everyone,

I am elaborating on whether endo/ses can securely run third-party (business logic) code as part of a browser-based application. A (draft) RFC goes into more details and can be read here opral/monorepo#127. The summary goes as follows:

1. Users are able to define a config file in JavaScript with exported functions.
2. An application reads/fetches/imports the config file and executes exported functions as part of the business logic.

Example config file:

// It is of importance that `fs` is provided to the config due to differences in runtime implementations (node, deno, browser). 
export function readFiles(fs) {
    // define how files should be read
    return files
} 

export function writeFiles(fs, files) {
   // define how files should be written
}

The Shadow Realms proposal introduces an importValue function that allows the binding of exported functions. Taking the exemplary config, consuming the export functions looks as follows:

const realm = new ShadowRealm();
const readFiles = await realm.importValue("./config.js", "readFiles")
const writeFiles = await realm.importValue("./config.js", "writeFiles")

// the business logic of how files are read is defined by the user via the config
const files = readFiles(fs)

// do something with the files ....

// write the files back to however the user defined the logic in the config
writeFiles(fs, files)

I am wrapping my head around SES on how I could accomplish the desired effect of "loading" a module into a compartment. The documentation is unclear on how to achieve the desired effect, and if it's even possible. I found the Static Module Record package which seems to go in the direction I want but is dependent on Node and the documentation is minimal.

An illustration of what I want to achieve:

import "ses";
lockdown();

// initialize a compartment with a javascript file (as string)
const compartment = new Compartment(`
    export function readFiles(fs) {
        return files
    } 
    
    export function writeFiles(fs, files) {
    }
`);

// call an exported function in the compartment with the `fs` parameter
const files = compartment.evaluate('readFiles', fs)

Does SES suit the described use case? If so, how could the desired effect of "loading" code into a compartment be achieved?