Hannes (Nov 30 2024 at 02:14): Hannes (Nov 30 2024 at 02:14):After writing the roc-turtle library, I realised that it should be possible to take arbitrary Roc code that uses roc-turtle, compile it, run the executable and display the drawing to the user.
So I wrote a small webapp that does exactly that, it's available here:
https://roc-turtle-editor.fly.dev/
Currently, I have a backend running on fly.io which does the compilation, but I would like to switch to running the Roc compiler in wasm like the web-repl does. I believe Roc's managed effects should protect me from malicious input, but I have no idea how secure this is in practice. If there's something obviously insecure then please let me know, or just have fun trying to break it! :sweat_smile:
Sky Rose (Dec 01 2024 at 15:01):It's a module instead of an application. Can you say more about how that works? Do you have an application on the backend that calls this module? What platform are you using, what effects does it have, and could a malicious module call one of those effects? Providing main to a wrapping application that you can't see seems a lot like the "can I write a platform in Roc" question that comes up all the time.
From a security and developer experience perspective, would you rather have the user of this webapp define an application instead of a module? This is an interesting use case, and I wonder if this would be a reason to support defining a platform in Roc on top of another platform (old topic about this: #ideas > nested platforms?)
Hannes (Dec 02 2024 at 00:33):Yeah, the way it works is the server writes a main.roc file with an app header here and that file imports the user's Roc script. I did that to avoid the clutter of the app header and so that the user couldn't just import whatever effects they wanted from the platform.
The reason for that is that I was too lazy to make my own platform, so I just used basic-cli and only used Stdout.line. I agree that I'm basically making my own "platform" on top of the basic-cli platform, I probably should've just forked basic-cli and made my own stdout-only-platform :shrug:
Anton (Dec 02 2024 at 10:01):I probably should've just forked basic-cli and made my own stdout-only-platform
I don't know, the way you did it seems pretty easy :)
Oskar Hahn (Dec 02 2024 at 10:25):If you really only need an Stdout.line, then you could use the templates from @Luke Boswell . The zig, go and rust templates, do exactly that.
Luke Boswell (Dec 02 2024 at 10:37):Ooh, I think now we've figured out how to get emscripten working in roc-ray if we revisited the whole roc wasm playground thing we could have a platform using the gen-wasm backend that JIT compiles and runs something like this all in the client. :grinning_face_with_smiling_eyes:
Luke Boswell (Dec 02 2024 at 10:39):I had something working using WASI but couldn't find a good way to get that running in the browser.
Anthony Bullard (Dec 03 2024 at 01:08):I’d love to have something sorta like that one lovely Elm app that let you write and share Elm with others and it all ran in the browser except saving the file
Luke Boswell (Dec 03 2024 at 01:13):Are you thinking of Ellie?
Anthony Bullard (Dec 03 2024 at 01:48):Luke Boswell said:
Are you thinking of Ellie?
Yes!
Anthony Bullard (Dec 03 2024 at 01:49):Loved that app
Last updated: Jul 05 2025 at 12:14 UTC