How to maintain the sandbox when dispatching events from C?

[Derpius]

Hi all, I've tried and failed to find any prior art on setting up event callbacks in Luau (or even regular Lua) in a way that's compatible with the multiple thread setup needed (or recommended) for sandboxing.

Note that I'm exclusively referring to Lua threads (lua_State) when I use "thread" below

What we currently have is:

1. Trusted engine Lua is run on the main thread before the global table is made immutable, and defines various APIs along with event dispatchers
2. Each event dispatcher has a local table in Lua (on the main thread) per event id containing a list of all callbacks, and exposes a method to C++ in order to dispatch events
   • Storing the event callbacks in Lua is to minimise C function call overhead when dispatching, but not a hard requirement
3. Untrusted user-created Lua is run on a separate thread (either per package or per file like the Luau REPL I'm using as reference), and can bind event listeners by doing Foo.addEventListener("bar", function() ... end)
   • The important part here is that code on a child thread passes a closure to (as far as I can tell) a table on the main thread
4. The engine's C++ dispatches an event, which results in Lua on the main thread looping over those callbacks, and presumably also calls those on the main thread

That last part appears to completely bypass at least some of the sandboxing...

My gut feeling is that I need to store and execute event callbacks per-thread, which if I'm creating threads for each required file as the REPL does would be awkward to track (as I also need to know which packages these belong to) and lose most of the benefit of dispatching events partially in lua.

My two questions are:

• What is the correct/best-practice way to dispatch events from the C API without bypassing any sandboxing?
• Do I need to create a new thread for each required file, or is it sufficient to create a thread only per-package/mod/addon?
  • Do I also need to create a new thread for each group of events, or is it fine for the original to be long-lived?
  • I note the following comment in luaL_sandboxthread: // we can set safeenv now although it's important to set it to false if code is loaded twice into the thread

[Derpius]

Solved this myself (obvious once you think about it...)

When the chunk is loaded, any functions to be passed to event registration functions have already had their global env bound, and that doesn't change when called from another thread (i.e. the main thread). Verified (I think) by printing the global env from inside one of those event listeners

On the second question above, I've assumed yes as it was convenient to have a per-file global env anyway