Using the Typestate Pattern to avoid insecure misconfiguration

Idea: leverage typestate pattern via a builder to prevent misconfigurations through compile time verification.

Note: this is far from being a fleshed out concept and the issue of having a verifiably secure configuration is a challenging topic.

Configuration

We use the build.rs file to generate a config file. Which allows us to use compile-time verification without having to rebuild our application. A current limitation is that secure can be false due to library limitations, however it is still verified during runtime. It might be interesting to create typed-builder style libraries that allow us to set constraints on which values can be set and which options can co-exist. co-exist.

use library::Configuration;

fn main() {
    Configuration::builder()
        .secure(true) // this is required or compilation fails.
        .build()
        .to_file("config.json");
}

In our simple example the application is very simple. It loads the compilation from the generated file in application/config.json and runs the application.

use std::path::PathBuf;

fn main() {
    let argv = std::env::args().collect::<Vec<String>>();
    library::run(PathBuf::from(argv[1].as_str()));
}

We can run it through this command:

cargo run --package application --bin application -- application/config.json  
# Output: Successfully ran with Configuration { secure: true }