mirror of
https://github.com/morluto/rea.git
synced 2026-10-30 11:25:39 +00:00
Electron and process scenario path admission caught every realpath or stat failure as an invalid_value input issue, so a correct path beneath a directory without search permission returned invalid_request with schema-correction recovery instead of a host access denial. Admission now classifies EACCES/EPERM from path resolution and metadata reads as the existing AnalysisAccessDeniedError (selected path, system_code, filesystem-read boundary). Missing, looping or otherwise unresolvable paths and reachable files without execute permission keep their input-error semantics. Electron reports invalid selections before a denial on another field. Process PATH search still continues past a denied directory; only an explicitly selected executable reports denial. Fixes #6117 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
147 lines
4.1 KiB
TypeScript
147 lines
4.1 KiB
TypeScript
import { chmod, mkdir, writeFile } from "node:fs/promises";
|
|
import { join } from "node:path";
|
|
import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
|
|
import { describe, expect } from "vitest";
|
|
|
|
import { cliTest } from "../../support/cli/cliFixture.js";
|
|
|
|
describe("scenario CLI schema diagnostics", () => {
|
|
cliTest("reports browser scenario schema paths", async ({ cli }) => {
|
|
const result = await cli.run({
|
|
arguments: ["capture-browser-scenario", "{}", "--json"],
|
|
environment: { REA_LOG_LEVEL: "silent" },
|
|
});
|
|
|
|
expect(result.exitCode).not.toBe(0);
|
|
expect(result.json).toMatchObject({
|
|
code: "invalid_request",
|
|
details: {
|
|
operation: "capture_browser_scenario",
|
|
issues: expect.arrayContaining([
|
|
{
|
|
path: ["browser"],
|
|
reason: "missing_argument",
|
|
expected: "object",
|
|
},
|
|
{
|
|
path: ["start_url"],
|
|
reason: "missing_argument",
|
|
expected: "object",
|
|
},
|
|
{
|
|
path: ["actions"],
|
|
reason: "missing_argument",
|
|
expected: "array",
|
|
},
|
|
]),
|
|
},
|
|
});
|
|
});
|
|
|
|
cliTest("reports Electron scenario schema paths", async ({ cli }) => {
|
|
const result = await cli.run({
|
|
arguments: ["capture-electron-scenario", "{}", "--json"],
|
|
environment: { REA_LOG_LEVEL: "silent" },
|
|
});
|
|
|
|
expect(result.exitCode).not.toBe(0);
|
|
expect(result.json).toMatchObject({
|
|
code: "invalid_request",
|
|
details: {
|
|
operation: "capture_electron_scenario",
|
|
issues: expect.arrayContaining([
|
|
{
|
|
path: ["executable_path"],
|
|
reason: "missing_argument",
|
|
expected: "string",
|
|
},
|
|
{
|
|
path: ["application_path"],
|
|
reason: "missing_argument",
|
|
expected: "string",
|
|
},
|
|
]),
|
|
},
|
|
});
|
|
});
|
|
});
|
|
|
|
for (const field of [
|
|
"executable_path",
|
|
"application_path",
|
|
"application_root",
|
|
] as const) {
|
|
cliTest(`names the unresolved Electron ${field}`, async ({ cli }) => {
|
|
const root = await createTestTempDirectory("rea-electron-path-");
|
|
const missing = join(root, "missing");
|
|
const result = await cli.run({
|
|
arguments: [
|
|
"capture-electron-scenario",
|
|
JSON.stringify({
|
|
executable_path: process.execPath,
|
|
application_path: root,
|
|
application_root: root,
|
|
actions: [],
|
|
[field]: missing,
|
|
}),
|
|
"--json",
|
|
],
|
|
environment: { REA_LOG_LEVEL: "silent" },
|
|
});
|
|
expect(result.exitCode).toBe(1);
|
|
expect(result.json).toMatchObject({
|
|
code: "invalid_request",
|
|
details: {
|
|
issues: [
|
|
{
|
|
path: [field],
|
|
reason: "invalid_value",
|
|
message: expect.stringContaining("ENOENT"),
|
|
},
|
|
],
|
|
},
|
|
});
|
|
expect(JSON.stringify(result.json)).toContain(missing);
|
|
});
|
|
}
|
|
|
|
cliTest.skipIf(process.platform === "win32" || process.getuid?.() === 0)(
|
|
"reports a search-denied Electron application_path as access denied",
|
|
async ({ cli }) => {
|
|
const root = await createTestTempDirectory("rea-electron-denied-");
|
|
const denied = join(root, "denied");
|
|
await mkdir(denied);
|
|
const application = join(denied, "main.js");
|
|
await writeFile(application, "module.exports = {};\n");
|
|
await chmod(denied, 0o000);
|
|
let result;
|
|
try {
|
|
result = await cli.run({
|
|
arguments: [
|
|
"capture-electron-scenario",
|
|
JSON.stringify({
|
|
executable_path: process.execPath,
|
|
application_path: application,
|
|
actions: [],
|
|
}),
|
|
"--json",
|
|
],
|
|
environment: { REA_LOG_LEVEL: "silent" },
|
|
});
|
|
} finally {
|
|
await chmod(denied, 0o700);
|
|
}
|
|
expect(result.exitCode).toBe(1);
|
|
expect(result.json).toMatchObject({
|
|
code: "access_denied",
|
|
category: "unavailable",
|
|
details: {
|
|
operation: "capture_electron_scenario",
|
|
path: application,
|
|
system_code: "EACCES",
|
|
boundary: "filesystem-read",
|
|
},
|
|
});
|
|
},
|
|
);
|