1. ErlHive Safe Erlang Reloaded An angle on community web development Ulf Wiger, Ericsson AB

2. The Goal Web-based multi-user information management Blog, forum, wiki, chat, access control,... What set of abstractions could allow us to treat these as convenient building blocks? Extensible and safe

3. The Frustration Installed and tested lots of blogs, wikis and forums Surprisingly difficult Not particularly modular Picky about perl/python/php/mysql versions Esp. multi-user versions worked poorly Obvious room for improvement But with Erlang, lots of assembly required also.

4. The Tuple Store Joe Armstrong’s idea A simple on-line database for web development Storing objects, sets and streams per user Joe wrote the front-end I wrote the back-end Authentication, etc. tuple store DB HTTP

5. Stored modules extend the vision Authentication, etc. erlhive DB Public code and data Private code and data Safe, web-based community web application development User AUser E

6. Back-end Concepts Each account contains: –Variable declarations (scalars, arrays, streams, and modules) –Areas (public and private)

7. Classes of Variable Scalar – can be of any type (a type grammar exists and is enforced) Array – an associative array (ordered set) Stream – like an inbox (append, lookup, delete) Module – a safe-compiled Erlang module

8. Access control Data and code in the private area accessible only to the owner The owner’s public modules can call the owner’s private modules OwnerOther Users Scalars & arraysRead/write/deleteRead StreamsAppend/read/deleteAppend ModulesRead/write/delete/callRead/call In the public area:

9. Safe code execution Only side-effects allowed are through the erlhive API Allow calls to modules/functions known to be safe (lists, ordsets, calendar, etc.) No spawn, send, receive, link, etc. Meta calls filtered at run-time (and possibly blocked) Everything runs in mnesia transactions Otherwise, no restrictions

10. -module(ex3_joe). -export([f/0]). f() -> [{’?MODULE’, ?MODULE},..., {ex3_pub, erlhive.ulf.ex3_pub:f()}]. Code example -module(ex3_pub). -export([f/0]). f() -> [{’?MODULE’, ?MODULE}, {time, calendar:universal_time()}, {caller, erlhive.user:caller()}, {from_module, erlhive.user:from_module()}, {owner, erlhive.user:owner()}, {ex3_priv, ex3_priv:f()}]. -module(ex3_priv). -export([f/0]). f() -> [{’?MODULE’, ?MODULE},...]. Owned by user > 1> erlhive:with_user( >, fun(M) -> M:set_variable(ex3_pub, [{class, module},{area, public}]), M:store_module(ex3_pub, ”-module(ex3_pub).\n...”) end).

11. -module(ex3_joe). -export([f/0]). f() -> [{’?MODULE’, ?MODULE},..., {ex3_pub, erlhive.ulf.ex3_pub:f()}]. Code example -module(ex3_pub). -export([f/0]). f() -> [{’?MODULE’, ?MODULE}, {time, calendar:universal_time()}, {caller, erlhive.user:caller()}, {from_module, erlhive.user:from_module()}, {owner, erlhive.user:owner()}, {ex3_priv, ex3_priv:f()}]. -module(ex3_priv). -export([f/0]). f() -> [{’?MODULE’, ?MODULE},...]. Package syntax for calling other users’ modules ”Meta functions” for introspection

12. -module(ex3_joe). -export([f/0]). f() -> [{’?MODULE’, ?MODULE},..., {ex3_pub, erlhive.ulf.ex3_pub:f()}]. Execution -module(ex3_pub). -export([f/0]). f() -> [{’?MODULE’, ?MODULE}, {time, calendar:universal_time()}, {caller, erlhive.user:caller()}, {from_module, erlhive.user:from_module()}, {owner, erlhive.user:owner()}, {ex3_priv, ex3_priv:f()}]. -module(ex3_priv). -export([f/0]). f() -> [{’?MODULE’, ?MODULE},...]. 2> erlhive:with_user( >, fun(M) -> M:apply(erlhive.joe.ex3_joe, f, []) end). [{’?MODULE’, ’erlhive.joe.ex3_joe’}, {caller, >}, {from_module, ’erlhive.user’}, {owner, >}, {ex3_pub, [{’?MODULE’, ’erlhive.ulf.ex3_pub’}, {time, {{2006,11,9},{16,53,17}}, {caller, >}, {owner, >}, {ex3_priv, [{’?MODULE’, ’erlhive.ulf.ex3_priv’}, {caller, >}, {from_module, ’erlhive.ulf.ex3_pub’}, {owner, >}]}]}]

13. -module(ex3_joe). -export([f/0]). f() -> [{’?MODULE’, ?MODULE},..., {ex3_pub, erlhive.ulf.ex3_pub:f()}]. Execution -module(ex3_pub). -export([f/0]). f() -> [{’?MODULE’, ?MODULE}, {caller, erlhive.user:caller()}, {from_module, erlhive.user:from_module()}, {owner, erlhive.user:owner()}, {ex3_priv, ex3_priv:f()}]. -module(ex3_priv). -export([f/0]). f() -> [{’?MODULE’, ?MODULE},...]. 2> erlhive:with_user( >, fun(M) -> M:apply(erlhive.ulf.ex3_priv, f, []) end). ** exited: {aborted, {{undef,[{{’erlhive.ulf.ex3_priv’, >, ’erlhive.user’}, f, 0}, {erlhive,with_watchdog,1},...]},...} Cannot call another user’s private modules. Restricted calls appear as undefs.

14. -module(ex3_joe). -export([f/0]). f() -> [{’?MODULE’, ?MODULE},..., {ex3_pub, erlhive.ulf.ex3_pub:f()}]. Profiling -module(ex3_pub). -export([f/0]). f() -> [{’?MODULE’, ?MODULE}, {caller, erlhive.user:caller()}, {from_module, erlhive.user:from_module()}, {owner, erlhive.user:owner()}, {ex3_priv, ex3_priv:f()}]. -module(ex3_priv). -export([f/0]). f() -> [{’?MODULE’, ?MODULE},...]. 2> erlhive:profile( >, fun(M) -> M:apply(ex3_joe, f, []) end). {[{’?MODULE’,’erlhive.joe.ex3_joe’},...], [{trace,,call,{erlhive_user,apply,4}}, {trace,,call,{’erlhive.joe.ex3_joe’,f,1}}, {trace,,call,{’erlhive.ulf.ex3_pub’,f,1}}, {trace,,return_to,{’erlhive.ulf.ex3_pub’,f,1}}, {trace,,return_to,{’erlhive.ulf.ex3_pub’,f,1}}]} A censored call trace. Can be followed by a specific trace on ’visible’ modules. (work in progress...)

15. Status Beta version at Sourceforge http://www.sourceforge.net/projects/erlhive http://www.sourceforge.net/projects/erlhive Authenticating web server front-end Components –Simple web-based management front-end –Blog with threaded comments –Wiki code syntax library –Role-Based Access Control library Any day now!

16. Questions?