1. 1//! Office document tools (docs/design/72-openxml-documents.md): `doc_read`
2. 2//! is a path-scoped read, `office_apply` a path-scoped write.
3. 3
4. 4#![allow(clippy::unwrap_used, clippy::expect_used)]
5. 5
6. 6use serde_json::json;
7. 7use vak_permission::{Decision, Mode, PermissionEngine};
8. 8
9. 9fn decide(tool: &str, path: &str, mode: Mode) -> Decision {
10. 10 let workspace = std::env::temp_dir().join(format!(
11. 11 "vak-perm-documents-{}-{:?}",
12. 12 std::process::id(),
13. 13 std::thread::current().id()
14. 14 ));
15. 15 std::fs::create_dir_all(&workspace).unwrap();
16. 16 let decision =
17. 17 PermissionEngine::default().evaluate(tool, &json!({ "path": path }), mode, &workspace);
18. 18 let _ = std::fs::remove_dir_all(&workspace);
19. 19 decision
20. 20}
21. 21
22. 22#[test]
23. 23fn doc_read_is_a_read_confined_to_the_workspace() {
24. 24 for mode in [Mode::ReadOnly, Mode::WorkspaceWrite] {
25. 25 assert!(
26. 26 matches!(decide("doc_read", "report.docx", mode), Decision::Allow),
27. 27 "{mode:?}"
28. 28 );
29. 29 assert!(
30. 30 matches!(
31. 31 decide("doc_read", "/etc/passwd", mode),
32. 32 Decision::Deny { .. }
33. 33 ),
34. 34 "{mode:?}"
35. 35 );
36. 36 }
37. 37}
38. 38
39. 39#[test]
40. 40fn office_apply_is_a_write() {
41. 41 assert!(matches!(
42. 42 decide("office_apply", "report.docx", Mode::WorkspaceWrite),
43. 43 Decision::Allow
44. 44 ));
45. 45 assert!(matches!(
46. 46 decide(
47. 47 "office_apply",
48. 48 "/elsewhere/report.docx",
49. 49 Mode::WorkspaceWrite
50. 50 ),
51. 51 Decision::Ask { .. }
52. 52 ));
53. 53 assert!(matches!(
54. 54 decide("office_apply", "report.docx", Mode::ReadOnly),
55. 55 Decision::Deny { .. }
56. 56 ));
57. 57}
58. 58