grep_permission_test.go RawHistoryFolder

1package tools
2
3import (
4	"context"
5	"errors"
6	"os"
7	"path/filepath"
8	"strings"
9	"testing"
10)
11
12func TestGrepChecksDeclaredReadScopeBeforeRunning(t *testing.T) {
13	skipGrepScriptTestsOnWindows(t)
14	base := t.TempDir()
15	root := filepath.Join(base, "workspace")
16	allowed := filepath.Join(base, "allowed")
17	if err := os.Mkdir(root, 0o755); err != nil {
18		t.Fatal(err)
19	}
20	if err := os.Mkdir(allowed, 0o755); err != nil {
21		t.Fatal(err)
22	}
23	sandbox := NewSandbox(base)
24	sandbox.Lock()
25	permissions := &PermissionSet{}
26	permissions.FS.Read = []string{allowed}
27	sandbox.SetPermissions(permissions)
28	called := false
29	tool := &GrepTool{
30		CWD:     base,
31		Sandbox: sandbox,
32		LookPath: func(string) (string, error) {
33			called = true
34			return "", errors.New("lookup should not run")
35		},
36	}
37	_, err := tool.Execute(context.Background(), grepArgsJSON("needle", root), nil)
38	if err == nil || !strings.Contains(err.Error(), "permission denied") {
39		t.Fatalf("error = %v, want declared read-scope denial", err)
40	}
41	if called {
42		t.Fatal("executable lookup ran before the read-scope check")
43	}
44}