controlling library load

[Viacheslav Usov <via.usov@...>]

If anything like this has been done before, kindly point me to that.

I have an application that hosts one or more lua_State instances. I
want to control what libraries a given instance can load. For that
purpose, I have disabled the default searchers (except the preload)
and have my own searcher that decides what can be loaded. I have also
replaced the global 'require' with my own function, which currently
just calls (eventually) into the original require. So I can already
control what libraries a given instance can load, no problem.

Now I'd like to make this a bit more sophisticated. I want to be able
to say that if library X can be loaded, then all the libraries that X
loads directly or indirectly can also be loaded, without having to
specify them upfront.

For that I have to overcome a few hurdles. The biggest as it seems to
me today is that I will have to understand that library Y is requested
directly or indirectly by X (or not). I am not exactly sure how this
can be done.

In principle, I'd be interested in a design that works equally with
native and pure Lua libraries. But one that works only with pure Lua
libraries would also be a good step forward. To simplify this even
more for the sake of understanding, let's only tackle the direct
require case, i.e., X just does require(Y). In the latter case, I
presume I can use the debug API to examine the call stack and
understand where the call originates. I will need to make sure that
anything that I load gets tagged properly to use the debug API
efficiently. To handle indirect loads, I will have to tag
implicitly-permitted libraries differently from explicitly-permitted,
recursively. This seems messy but will probably work. Is there a
better way?

Any advice is appreciated.

Cheers,
V.