Function validateFilesystem

packages/core/src/additional-permissions.ts:103–157

(
  input: unknown,
)

}

function validateFilesystem(
  input: unknown,
):
  | { ok: true; entries: AdditionalFileSystemPermission[] }
  | Extract<AdditionalPermissionValidationResult, { ok: false }> {
  if (input === undefined) return { ok: true, entries: [] };
  if (!isRecord(input) || hasUnexpectedKeys(input, ['entries']) || !Array.isArray(input.entries)) {
    return invalid('invalid_profile', 'fileSystem must contain an entries array.');
  }
  if (input.entries.length > MAX_ADDITIONAL_FILESYSTEM_ENTRIES) {
    return invalid(
      'too_many_entries',
      `Additional filesystem permissions are limited to ${MAX_ADDITIONAL_FILESYSTEM_ENTRIES} entries.`,
    );
  }
  const entries: AdditionalFileSystemPermission[] = [];
  for (const candidate of input.entries) {
    if (!isRecord(candidate) || hasUnexpectedKeys(candidate, ['path', 'access', 'scope'])) {
      return invalid(
        'invalid_entry',
        'Additional filesystem permission contains unsupported fields.',
      );
    }
    if (
      typeof candidate.path !== 'string' ||
      !ADDITIONAL_PERMISSION_ACCESS_MODES.includes(
        candidate.access as AdditionalPermissionAccess,
      ) ||
      !ADDITIONAL_PERMISSION_SCOPES.includes(candidate.scope as AdditionalPermissionScope)
    ) {
      return invalid(
        'invalid_entry',
        'Additional filesystem permission must contain path, access, and scope.',
      );
    }
    if (!isNormalizedAbsolutePath(candidate.path)) {
      return invalid(
        'invalid_path',
        'Additional filesystem permission path must be a normalized absolute path.',
      );
    }
    if (candidate.path.length > MAX_ADDITIONAL_PERMISSION_PATH_CHARS) {
      return invalid(
        'path_too_long',
        'Additional filesystem permission path exceeds the length limit.',
      );
    }
    entries.push({
      path: trimTrailingSlashes(candidate.path),
      access: candidate.access as AdditionalPermissionAccess,
      scope: candidate.scope as AdditionalPermissionScope,
    });
  }
  return { ok: true, entries };
}

function validateNetwork(
  input: unknown,