aws / aws/aws-toolkit-vscode

Support minimum-trust workspace

Open
#1,823 1 comment 0 reactions 0 assignees View on GitHub
feature-request filesystem network
Dominant language
TypeScript
Stars
2k
Forks
807
Avg merge
10h 12m
Merged PRs (30d)
7

Description

from https://github.com/aws/aws-toolkit-vscode/pull/1821:

> VS code 1.57 introduced a 'trust' feature that is applied to the current workspace, restricting extension access based on trust level. The insiders build allows individual extensions to have a trust level, by default they are untrusted. Untrusted extensions cannot be activated, thus failing the test. We are not particularly concerned with this functionality in regards to other extensions, so we will just disable it entirely when testing.
>
> We should look into this more for our own extension as far as UX is concerned (what should our extension be capable of given a minimum trust level?)
>
> Refer to this issue: [microsoft/vscode#120251](https://github.com/microsoft/vscode/issues/120251)
>
> Considerations for the toolkit (to be added to `package.json`):
>
> ```js
> capabilities:
> untrustedWorkspaces:
> { supported: true } |
> { supported: false, description: string } |
> { supported: 'limited', description: string, restrictedConfigurations?: string[] }
> ```
>
> By default, extensions do not support untrusted workspaces. This seems to be the best option for the toolkit for now. In other words, we do not need to update anything unless we want to add a `description` string for why we do not support untrusted workspaces.

## Proposal

- Most Toolkit features don't need to write to the workspace, so we should be able to support untrusted model.
- remote AWS explorer mostly reads/writes to the network (what trust level does network access require?)
- CDK explorer can display its tree with just "read" access to the filesystem
- Trust is needed for:
- write-level access: CDK deploy, SAM local run/debug
- ?

Contributor guide

Open the contributing guide

Research direction

Start with the proposal in this issue and the capabilities.untrustedWorkspaces entry in package.json. Review the linked VS Code trust issue, then map which Toolkit features need read, write, or network access. Done means the supported trust level and affected features are agreed and documented for implementation.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript, vscode
Domain
developer-experience, devtools
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.