typescript / expert
Snippet
Tamper-Proof Capability Access via Branded WeakMap Encapsulation
Combining TypeScript nominal brand types with ECMAScript private fields (`#`) and static WeakMaps creates capability-based access tokens. Access to sensitive internal state is controlled statically through structural type incompatibility and enforced privately at runtime.
snippet.ts
typescript
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
declare const CapabilityBrand: unique symbol;type CapabilityToken<T extends string> = string & { readonly [CapabilityBrand]: T };class SecureVault<TData> {#secret: TData;static #accessKeys = new WeakMap<object, CapabilityToken<"VAULT_ACCESS">>();constructor(data: TData, token: CapabilityToken<"VAULT_ACCESS">) {this.#secret = data;SecureVault.#accessKeys.set(this, token);}readData(token: CapabilityToken<"VAULT_ACCESS">): TData {if (SecureVault.#accessKeys.get(this) !== token) {throw new Error("Unauthorized vault access attempt");}return this.#secret;}}
Breakdown
1
declare const CapabilityBrand: unique symbol;
Declares a unique symbol used to create nominal nominal/branded types.
2
type CapabilityToken<T extends string> = string & { readonly [CapabilityBrand]: T };
Constructs a branded string type preventing arbitrary string assignments.
3
class SecureVault<TData> {
Defines a generic secure container class.
4
#secret: TData;
Declares a hard ECMAScript private field inaccessible from outside the class instance.
5
static #accessKeys = new WeakMap<object, CapabilityToken<"VAULT_ACCESS">>();
Stores capability mappings privately across instances without memory leakage.
6
readData(token: CapabilityToken<"VAULT_ACCESS">): TData {
Requires a valid branded token parameter to unlock internal vault data.