Restrict Which Functions Can Be Called Remotely

Question

By default, any process connecting to a q server can ask it to evaluate arbitrary code over IPC — call any function, run any query. How can a server restrict incoming requests to only a known, approved set of functions?

Solution

allowed:`getPrice`getTrades

.z.pg:{[msg]
  if[10h=type msg; '"strings not permitted"];
  f:first msg;
  if[not $[-11h=type f; f in allowed; 0b]; '"function not permitted"];
  value msg
 }

Explanation

.z.pg receives the raw message before evaluation, so it's the natural place to check it against a whitelist first.

A string message (type 10h) could contain any code, so it is rejected outright. Otherwise msg is a list (function;arg1;arg2;...), so first msg is the requested function. Only a function named by a symbol that is in allowed gets through — a lambda sent by the client, or any other name, is rejected before value msg ever runs.

This is the basis of access control over IPC: the server enforces what's permitted centrally, regardless of what any connected client sends. The same idea extends to checking who is asking (.z.w/.z.a/.z.u) and varying the allowed set per caller.