fix(files): refresh expired outside-workspace grants (#3078)

* fix(files): refresh expired outside file grants

* fix(files): scope outside grants to local runtime

packages/ui/src/lib/outsideFileGrants.ts

@@ -1,13 +1,17 @@
 import { requestExistingFileAccess } from '@/lib/desktop';
 import { isFilePathWithinDirectory, normalizeFilePath } from '@/lib/path-utils';
+import { getRuntimeKey } from '@/lib/runtime-switch';
 
 type OutsideFileGrantEntry = {
   outsideFileGrant: string;
   expiresAt: number;
 };
 
-const DEFAULT_GRANT_TTL_MS = 10 * 60 * 1000;
-const grantsByPath = new Map<string, OutsideFileGrantEntry>();
+const GRANT_RENEWAL_BUFFER_MS = 5_000;
+const grantsByCacheKey = new Map<string, OutsideFileGrantEntry>();
+const pendingGrantsByCacheKey = new Map<string, Promise<string | undefined>>();
+
+const grantCacheKey = (path: string, runtimeKey = getRuntimeKey()): string => `${runtimeKey}\0${path}`;
 
 export const getOutsideFileGrant = (path: string): string | undefined => {
   const normalizedPath = normalizeFilePath(path);
@@ -15,13 +19,14 @@ export const getOutsideFileGrant = (path: string): string | undefined => {
     return undefined;
   }
 
-  const entry = grantsByPath.get(normalizedPath);
+  const cacheKey = grantCacheKey(normalizedPath);
+  const entry = grantsByCacheKey.get(cacheKey);
   if (!entry) {
     return undefined;
   }
 
   if (entry.expiresAt <= Date.now()) {
-    grantsByPath.delete(normalizedPath);
+    grantsByCacheKey.delete(cacheKey);
     return undefined;
   }
 
@@ -31,18 +36,17 @@ export const getOutsideFileGrant = (path: string): string | undefined => {
 const rememberOutsideFileGrant = (
   path: string,
   outsideFileGrant: string,
-  expiresAt?: number,
+  expiresAt: number,
+  runtimeKey: string,
 ): void => {
   const normalizedPath = normalizeFilePath(path);
   if (!normalizedPath || !outsideFileGrant) {
     return;
   }
 
-  grantsByPath.set(normalizedPath, {
+  grantsByCacheKey.set(grantCacheKey(normalizedPath, runtimeKey), {
     outsideFileGrant,
-    expiresAt: typeof expiresAt === 'number' && Number.isFinite(expiresAt)
-      ? expiresAt
-      : Date.now() + DEFAULT_GRANT_TTL_MS,
+    expiresAt: expiresAt - GRANT_RENEWAL_BUFFER_MS,
   });
 };
 
@@ -55,19 +59,58 @@ export const ensureOutsideFileGrantForDesktop = async (
     return undefined;
   }
 
+  const runtimeKey = getRuntimeKey();
+  if (runtimeKey !== 'local') {
+    return undefined;
+  }
+  const cacheKey = grantCacheKey(normalizedPath, runtimeKey);
   const existing = getOutsideFileGrant(normalizedPath);
   if (existing) {
     return existing;
   }
 
-  const result = await requestExistingFileAccess(normalizedPath);
-  if (!result.success || !result.path || !result.outsideFileGrant) {
-    return undefined;
+  const pending = pendingGrantsByCacheKey.get(cacheKey);
+  if (pending) {
+    return pending;
   }
 
-  rememberOutsideFileGrant(result.path, result.outsideFileGrant);
-  if (normalizeFilePath(result.path) !== normalizedPath) {
-    rememberOutsideFileGrant(normalizedPath, result.outsideFileGrant);
+  const request = requestExistingFileAccess(normalizedPath).then((result) => {
+    if (!result.success || getRuntimeKey() !== runtimeKey) {
+      return undefined;
+    }
+
+    const { path: grantedPath, outsideFileGrant, expiresAt } = result;
+    if (expiresAt <= Date.now() + GRANT_RENEWAL_BUFFER_MS) {
+      return undefined;
+    }
+    rememberOutsideFileGrant(grantedPath, outsideFileGrant, expiresAt, runtimeKey);
+    if (normalizeFilePath(grantedPath) !== normalizedPath) {
+      rememberOutsideFileGrant(normalizedPath, outsideFileGrant, expiresAt, runtimeKey);
+    }
+    return outsideFileGrant;
+  });
+  pendingGrantsByCacheKey.set(cacheKey, request);
+  try {
+    return await request;
+  } finally {
+    pendingGrantsByCacheKey.delete(cacheKey);
   }
-  return result.outsideFileGrant;
+};
+
+export const resolveOutsideFileReadOptions = async (
+  path: string,
+  workspaceRoot: string,
+  enabled: boolean,
+): Promise<{ allowOutsideWorkspace: boolean; outsideFileGrant?: string }> => {
+  const allowOutsideWorkspace = enabled
+    && Boolean(workspaceRoot)
+    && !isFilePathWithinDirectory(path, workspaceRoot);
+  if (!allowOutsideWorkspace) {
+    return { allowOutsideWorkspace: false };
+  }
+
+  return {
+    allowOutsideWorkspace: true,
+    outsideFileGrant: await ensureOutsideFileGrantForDesktop(path, workspaceRoot),
+  };
 };