Struct PathBroker 

pub struct PathBroker { /* private fields */ }

Implementations

impl PathBroker

pub fn new() -> Self

pub fn with_app_name(app_name: &str) -> Self

A broker whose denial text names the app (“open it through {app_name} first”), taken from the shell’s app_name config. An empty name reads as “the app”.

pub fn grant_file(&self, path: impl AsRef<Path>) -> Result<String, ShellError>

Grant an existing file the user chose. Returns the display path.

pub fn grant_save_target( &self, path: impl AsRef<Path>, ) -> Result<String, ShellError>

Grant a path the user picked in a save dialog (it need not exist).

pub fn grant_normalized(&self, path: PathBuf) -> Result<String, ShellError>

pub fn is_granted_normalized(&self, path: &Path) -> Result<bool, ShellError>

pub fn require_file(&self, path: &str) -> Result<String, ShellError>

Canonicalise path and require it to be a granted existing file.

pub fn require_write_target(&self, path: &str) -> Result<String, ShellError>

pub fn record_write_target(&self, path: &Path) -> Result<(), ShellError>

Record a path the app just wrote; evicts the oldest past WRITE_TARGET_RING_CAP.

pub fn was_recently_written(&self, path: &Path) -> Result<bool, ShellError>

pub fn regrant_saved_target(&self, path: &str) -> Result<String, ShellError>

Re-grant a save-as target that was just written (so the renderer cannot ask for any existing path to be granted).

pub fn register_known_path(&self, path: &str) -> Result<String, ShellError>

Mint a one-shot recent-file id for a stored path (re-canonicalised: older rows or platform spelling differences must not grant something later checks reject).

pub fn grant_known(&self, id: &str) -> Result<String, ShellError>

Trade a recent-file id for a grant. One shot: replaying it fails.

pub fn revoke_path(&self, display: &str) -> Result<(), ShellError>

Revoke a grant (its last tab closed) and every stream id for that file, so old stream URLs die now and never revive on reopen. Matches by display string, so a file deleted after opening is still revoked.

pub fn grant_stream(&self, path: &str) -> Result<String, ShellError>

Opaque URL id for a granted file. One stable live id per file: re-reading after an atomic edit overlaps in-flight range requests, and rotating would 403 the URL still loading.

pub fn resolve_stream(&self, id: &str) -> Result<StreamTarget, ShellError>

pub fn grant_site_root( &self, dir: impl AsRef<Path>, ) -> Result<String, ShellError>

Opaque id for a directory the preview may read subresources from. Authorises only containment-checked reads through PathBroker::resolve_in_site_root, never general document access. One id per grant (not deduplicated by directory) so two tabs on the same project do not revoke each other.

pub fn resolve_site_root(&self, id: &str) -> Result<PathBuf, ShellError>

pub fn resolve_in_site_root( &self, id: &str, relative: &str, ) -> Result<PathBuf, ShellError>

Resolve relative under a site root; refuses anything that escapes it (.., symlinks).

pub fn revoke_site_root(&self, id: &str) -> Result<(), ShellError>

Trait Implementations

impl Default for PathBroker

fn default() -> Self

Returns the “default value” for a type.