jk validate and transform can't look at files outside the working directory

[squaremo]

jk validate accepts path directly as arguments on the command line; however, it uses std.read to load them for validation, and that can only read things in the "input directory". The input directory is deliberately not a flag for jk validate, since it's intended the files are supplied via e.g., find.

This gives us a bit of a conundrum! We could turn the directory limiting off for read, but that lets a validation function (or any other code) also read from anywhere.

[dlespiau]

I was thinking of a (new :scream:) flag to lift read limits:

--read-root top level directory read are constrained to

This would allow to restrict reads to the subtree defined by that root directory. For instance the root of a git checkout even if the script is in a subdirectory.

[dlespiau]

That said, I also feel the current way of handling input directories and limits is quite confusing. Not sure how to make it better, introducing a new flag isn't likely to be a good way to simplify things.

[squaremo]

Yes, I have still not internalised how input directories work, and have to think it through every time ..

[squaremo]

Implementation notes:

• now jk uses VFS for its access to the filesystem, one possibility is to provide a filesystem as the read root that can access all the files -- i.e., one rooted at / -- but only those files. The hurdle here is that there's an explicit check that disallows absolute and parent file paths.
  • removing that would mean we couldn't distinguish between paths that are not allowed, and paths that don't correspond to a file -- and, worse, an absolute path would be resolved from the top of the virtual filesystem, so is almost never going to correspond to the correct file if any
  • moving that check is tricky too -- we absolutely (!) do want it in most circumstances. Moving it into the virtual file systems themselves might be OK -- but at present, paths are joined to a base to make an absolute path within the vfs, and that would break.