From 1924883e118dcaa053a8a37c0fa3a5a39194fa56 Mon Sep 17 00:00:00 2001
From: Gudge <gudge@microsoft.com>
Date: Fri, 22 May 2026 16:37:15 -0700
Subject: [PATCH] test(filesystem_dacl): broaden network_path_rejected_e2e
 matcher
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `network_path_rejected_e2e` test (added in #295 / Phase 3) calls
`grant_appcontainer_access` on `\\someserver\share\foo` and previously
asserted the error was `NetworkPathRejected` or `PathNotFound`. On CI
agents whose DNS resolves `someserver` (or returns a non-`NotFound`
Win32 error such as `ERROR_BAD_NETPATH` or `ERROR_LOGON_FAILURE`),
`fs::canonicalize` lands in our `Win32 { reason: "canonicalize: …" }`
fallback, which the matcher did not accept — flaking the test.

Broaden the matcher to accept `Win32 { .. }` as well, and convert the
assertion into a `match` that prints the actual variant on failure so
future flakes are diagnostic. The test's intent ("we never silently
succeed on a UNC path") is preserved — the deterministic verification
of the classifier itself lives in
`ensure_local_canonical_prefix_rejects_unc_namespace` and
`ensure_local_canonical_prefix_rejects_raw_unc` above, both
unaffected.

No production behavior change. Discovered while shepherding #389
(Phase 3.5) through CI on an agent that hit this code path
differently than the dev-box agents used during Phase 3's CI run.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 src/wxc_common/src/filesystem_dacl.rs | 31 +++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/src/wxc_common/src/filesystem_dacl.rs b/src/wxc_common/src/filesystem_dacl.rs
index 59bef6756..6e8b23603 100644
--- a/src/wxc_common/src/filesystem_dacl.rs
+++ b/src/wxc_common/src/filesystem_dacl.rs
@@ -1792,9 +1792,32 @@ mod tests {
             &[PathBuf::from(r"\\someserver\share\foo")],
             &[],
         );
-        assert!(matches!(
-            err,
-            Err(DaclError::NetworkPathRejected(_)) | Err(DaclError::PathNotFound(_))
-        ));
+        // The test's intent is "we never silently succeed on a UNC
+        // path". The exact error variant depends on how
+        // `fs::canonicalize` resolves `\\someserver\share\foo` on the
+        // host running the test:
+        //   * On dev boxes / agents with no DNS resolution for
+        //     `someserver`, canonicalize returns
+        //     `io::ErrorKind::NotFound` → `PathNotFound`.
+        //   * On agents where canonicalize succeeds (rare but
+        //     possible if the share actually exists or is being
+        //     resolved by a redirector), our `ensure_local_canonical_
+        //     prefix` rejects the UNC namespace → `NetworkPathRejected`.
+        //   * On agents where DNS resolves `someserver` to an
+        //     unreachable host or returns a non-NotFound Win32 error
+        //     (e.g. `ERROR_BAD_NETPATH`, `ERROR_LOGON_FAILURE`),
+        //     canonicalize returns a generic IO error that doesn't
+        //     map to `NotFound` → `Win32 { reason: "canonicalize: …" }`.
+        // All three are acceptable. The unit tests of
+        // `ensure_local_canonical_prefix` above verify the
+        // classification function deterministically.
+        match &err {
+            Err(DaclError::NetworkPathRejected(_))
+            | Err(DaclError::PathNotFound(_))
+            | Err(DaclError::Win32 { .. }) => {}
+            other => panic!(
+                "expected NetworkPathRejected | PathNotFound | Win32 for UNC path, got: {other:?}"
+            ),
+        }
     }
 }