From 360591d6e18d8676a2f86185ed42f46852387f85 Mon Sep 17 00:00:00 2001
From: Lukasz Kasprzak <lukas@labunix.xyz>
Date: Mon, 14 Sep 2026 21:40:12 +0200
Subject: plan 9: content excludes fail closed; krino.conf excludes checked
 without directories

---
 internal/engine/exclude_test.go | 53 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

(limited to 'internal/engine/exclude_test.go')

diff --git a/internal/engine/exclude_test.go b/internal/engine/exclude_test.go
index 8b26450..87fa16c 100644
--- a/internal/engine/exclude_test.go
+++ b/internal/engine/exclude_test.go
@@ -207,3 +207,56 @@ func TestExplainReportsExclusionAndSize(t *testing.T) {
 		t.Errorf("Skip = %q, want too big", big.Skip)
 	}
 }
+
+// TestExcludeFailsClosedOnUnreadableContent: an exclude meant to protect
+// files holds when its content test cannot read a file (over max-read), so
+// no rule acts on a file krino could not check (review M11, Łukasz's
+// decision).
+func TestExcludeFailsClosedOnUnreadableContent(t *testing.T) {
+	big := "confidential " + strings.Repeat("x", 2048)
+	h, dl := excludeTree(t, map[string]string{"big.txt": big, "small.txt": "nothing to hide"})
+	main := writeConfig(t, h, `(include "dl")`, map[string]string{"dl": `
+(path "~/dl")
+(max-read 1K)
+(exclude (type txt) (content "confidential"))
+(rule "old" (delete))
+`})
+	e, errs := Load(main)
+	if len(errs) > 0 {
+		t.Fatal(errs)
+	}
+	r, err := e.Match(context.Background(), e.Dirs[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, fm := range r.Matched {
+		switch fm.File.Rel {
+		case "big.txt":
+			if !strings.HasSuffix(fm.Excluded, "(content unreadable)") || len(fm.Rules) != 0 {
+				t.Errorf("big.txt: Excluded %q, rules %d; want set aside as unreadable", fm.Excluded, len(fm.Rules))
+			}
+		case "small.txt":
+			if fm.Excluded != "" || len(fm.Rules) != 1 {
+				t.Errorf("small.txt: Excluded %q, rules %d; want the rule", fm.Excluded, len(fm.Rules))
+			}
+		}
+	}
+	x, err := e.Explain(context.Background(), filepath.Join(dl, "big.txt"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.HasSuffix(x.Excluded, "(content unreadable)") {
+		t.Errorf("explain: Excluded %q", x.Excluded)
+	}
+}
+
+// TestLoadChecksMainExcludesWithoutDirectories: a mistake in krino.conf's
+// (exclude ...) is reported even before any directory is included (review
+// cli F10).
+func TestLoadChecksMainExcludesWithoutDirectories(t *testing.T) {
+	h := sandbox(t)
+	main := writeConfig(t, h, "(include)\n(exclude (bogus 1))\n", nil)
+	if _, errs := Load(main); len(errs) == 0 {
+		t.Error("a broken krino.conf exclude was not reported")
+	}
+}
-- 
cgit v1.3