Function validate_path_within 

pub fn validate_path_within(
    path: &Path,
    allowed_paths: &[PathBuf],
) -> Result<PathBuf>

Canonicalize path (which must already exist) and verify it falls within one of allowed_paths.

Convenience wrapper around is_path_within for the common case of a target that must already exist (e.g. a directory to cd into, or a file to run diagnostics against) — callers whose target may not yet exist (e.g. a new file being written) must canonicalize via their own symlink-tolerant strategy and call is_path_within directly instead.

Errors

Returns io::ErrorKind::NotFound (via Path::canonicalize) if path does not exist, or io::ErrorKind::PermissionDenied if the canonicalized path falls outside every entry in allowed_paths.

Examples

use zeph_common::security::validate_path_within;

let dir = tempfile::tempdir().unwrap();
// Callers canonicalize `allowed_paths` up front (as `FileExecutor::new` does) so this
// comparison is not defeated by a symlinked temp root (e.g. macOS `/tmp` -> `/private/tmp`).
let allowed = vec![dir.path().canonicalize().unwrap()];
let result = validate_path_within(dir.path(), &allowed);
assert!(result.is_ok());