agy-bridge 0.16.1

//! Path normalization and workspace confinement utilities.

use std::path::{Path, PathBuf};

/// Normalize a path by logically resolving `.` and `..` components.
///
/// This function does **not** access the filesystem, so it works for paths
/// that may not exist on disk (e.g. in unit tests). It processes each
/// component in order:
///
/// - [`std::path::Component::CurDir`] (`.`) — skipped
/// - [`std::path::Component::ParentDir`] (`..`) — pops the last pushed
///   component (if any), preventing traversal above the root
/// - All other components — pushed onto the result
///
/// # Security
///
/// This function performs **purely logical** normalization.  It does **not**
/// resolve symbolic links.  If the path contains a symlink component, the
/// normalized result may point to a different location on disk than the
/// logical resolution suggests.
///
/// **For security-sensitive checks** (e.g. workspace confinement), prefer
/// [`canonicalize_path`] which calls [`std::fs::canonicalize`] and resolves
/// symlinks through the real filesystem.  Use this function only as a
/// fallback for paths that may not yet exist on disk.
///
/// # Examples
///
/// ```
/// use std::path::{Path, PathBuf};
///
/// assert_eq!(
///     agy_bridge::policies::normalize_path(Path::new("/workspace/../etc/passwd")),
///     PathBuf::from("/etc/passwd"),
/// );
/// assert_eq!(
///     agy_bridge::policies::normalize_path(Path::new("/workspace/./subdir/file.rs")),
///     PathBuf::from("/workspace/subdir/file.rs"),
/// );
/// ```
#[must_use]
pub fn normalize_path(path: &std::path::Path) -> PathBuf {
    use std::path::Component;

    let mut parts: Vec<Component<'_>> = Vec::new();
    for component in path.components() {
        match component {
            Component::CurDir => { /* skip '.' */ }
            Component::ParentDir => {
                // Pop only Normal components; never pop RootDir/Prefix.
                if matches!(parts.last(), Some(Component::Normal(_))) {
                    parts.pop();
                }
            }
            other => parts.push(other),
        }
    }

    parts.iter().collect()
}

/// Resolve a path to its canonical, absolute form via the filesystem.
///
/// Unlike [`normalize_path`], this function accesses the real filesystem and
/// fully resolves symbolic links, `..`, and `.` components.  The returned
/// path contains no symlink segments and is suitable for security-sensitive
/// comparisons such as workspace confinement checks.
///
/// # Errors
///
/// Returns an error if any component of the path does not exist or is not
/// accessible.
///
/// # Examples
///
/// ```
/// use std::path::Path;
///
/// let canon =
///     agy_bridge::policies::canonicalize_path(Path::new("/tmp")).expect("/tmp must exist");
/// assert!(canon.is_absolute());
/// ```
pub fn canonicalize_path(path: &std::path::Path) -> std::io::Result<PathBuf> {
    std::fs::canonicalize(path)
}

/// Check whether `candidate` falls under any workspace root.
///
/// When the candidate path exists on disk, both it and each workspace root
/// are resolved through [`canonicalize_path`] (which follows symlinks).
/// If canonicalization fails for either side (e.g. the path does not exist
/// yet), the function falls back to [`normalize_path`] for that operand and
/// logs a warning.
///
/// # Examples
///
/// ```
/// use std::path::PathBuf;
///
/// let ws = [PathBuf::from("/workspace")];
/// assert!(agy_bridge::policies::is_path_in_workspace(
///     "/workspace/src/main.rs",
///     &ws
/// ));
/// assert!(!agy_bridge::policies::is_path_in_workspace(
///     "/workspace/../etc/passwd",
///     &ws
/// ));
/// ```
fn resolve_path_preserving_symlinks(path: &Path) -> PathBuf {
    match canonicalize_path(path) {
        Ok(p) => return p,
        Err(e) => {
            tracing::trace!(path = %path.display(), error = %e, "resolve_path_preserving_symlinks: canonicalize failed; falling back to best-effort resolution");
        }
    }
    let normalized = normalize_path(path);
    let mut existing = normalized.as_path();
    let mut remainder = Vec::new();
    while !existing.exists() {
        if let Some(name) = existing.file_name() {
            remainder.push(name.to_os_string());
        }
        match existing.parent() {
            Some(parent) if parent != existing => existing = parent,
            _ => break,
        }
    }
    if existing.exists()
        && let Ok(mut canonical_base) = canonicalize_path(existing)
    {
        for component in remainder.into_iter().rev() {
            canonical_base.push(component);
        }
        return normalize_path(&canonical_base);
    }
    normalized
}

#[must_use]
pub fn is_path_in_workspace(candidate: impl AsRef<Path>, workspaces: &[PathBuf]) -> bool {
    let candidate_path = candidate.as_ref();
    let resolved_candidate = resolve_path_preserving_symlinks(candidate_path);

    workspaces.iter().any(|ws| {
        let resolved_ws = resolve_path_preserving_symlinks(ws);
        resolved_candidate.starts_with(&resolved_ws)
    })
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn is_path_in_workspace_accepts_path() {
        let workspaces = [PathBuf::from("/workspace")];
        let p = std::path::Path::new("/workspace/src/main.rs");
        assert!(is_path_in_workspace(p, &workspaces));
    }

    #[test]
    fn is_path_in_workspace_accepts_pathbuf() {
        let workspaces = [PathBuf::from("/workspace")];
        let p = PathBuf::from("/workspace/src/main.rs");
        assert!(is_path_in_workspace(p, &workspaces));
    }

    // ── canonicalize_path ───────────────────────────────────────────

    #[test]
    fn canonicalize_path_returns_absolute_for_existing_path() {
        let dir = tempfile::tempdir().unwrap();
        let result = canonicalize_path(dir.path()).unwrap();
        assert!(result.is_absolute());
    }

    #[test]
    fn canonicalize_path_resolves_dot_dot() {
        let dir = tempfile::tempdir().unwrap();
        let child = dir.path().join("sub");
        std::fs::create_dir(&child).unwrap();
        let with_dotdot = child.join("..");
        let result = canonicalize_path(&with_dotdot).unwrap();
        let expected = canonicalize_path(dir.path()).unwrap();
        assert_eq!(result, expected);
    }

    #[test]
    fn canonicalize_path_errors_on_nonexistent_path() {
        let err =
            canonicalize_path(Path::new("/tmp/agy_bridge_test_nonexistent_9x7z")).unwrap_err();
        assert_eq!(err.kind(), std::io::ErrorKind::NotFound);
    }

    #[test]
    fn canonicalize_path_resolves_symlinks() {
        let dir = tempfile::tempdir().unwrap();
        let real_file = dir.path().join("real.txt");
        std::fs::write(&real_file, b"data").unwrap();
        let link = dir.path().join("link.txt");
        std::os::unix::fs::symlink(&real_file, &link).unwrap();
        let resolved = canonicalize_path(&link).unwrap();
        let expected = canonicalize_path(&real_file).unwrap();
        assert_eq!(resolved, expected);
    }

    // ── normalize_path ──────────────────────────────────────────────

    #[test]
    fn normalize_path_removes_dot() {
        let result = normalize_path(Path::new("/a/./b/./c"));
        assert_eq!(result, PathBuf::from("/a/b/c"));
    }

    #[test]
    fn normalize_path_resolves_parent() {
        let result = normalize_path(Path::new("/a/b/../c"));
        assert_eq!(result, PathBuf::from("/a/c"));
    }

    #[test]
    fn normalize_path_does_not_go_above_root() {
        let result = normalize_path(Path::new("/a/../../b"));
        assert_eq!(result, PathBuf::from("/b"));
    }

    #[test]
    fn normalize_path_preserves_absolute_simple_path() {
        let result = normalize_path(Path::new("/usr/local/bin"));
        assert_eq!(result, PathBuf::from("/usr/local/bin"));
    }

    #[cfg(unix)]
    #[test]
    fn symlink_traversal_blocked_even_for_non_existent_target_file() {
        let workspace_dir = tempfile::tempdir().unwrap();
        let outside_dir = tempfile::tempdir().unwrap();

        let symlink_in_ws = workspace_dir.path().join("escaped_dir");
        std::os::unix::fs::symlink(outside_dir.path(), &symlink_in_ws).unwrap();

        // Non-existent target file inside the symlinked outside directory
        let candidate = symlink_in_ws.join("new_file.txt");
        let workspaces = vec![workspace_dir.path().to_path_buf()];

        assert!(
            !is_path_in_workspace(&candidate, &workspaces),
            "symlink inside workspace pointing outside must not allow creating new files outside workspace"
        );
    }
}