{"record":{"id":"3de767ea0eee28e2","repo":"astrid-runtime/astrid","slug":"private-host-file-validation-is-unavailable-on-thi","errorCode":null,"errorMessage":"private host-file validation is unavailable on this target","messagePattern":"private host-file validation is unavailable on this target","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"crates/astrid-core/src/platform_fs.rs","lineNumber":291,"sourceCode":"/// # Errors\n///\n/// Returns an error on Windows for an unexpected owner, permissive or inherited\n/// ACL, reparse point, or non-regular file.\npub fn validate_private_file(path: &Path) -> io::Result<()> {\n    #[cfg(windows)]\n    {\n        windows::validate_private_file(path)\n    }\n\n    #[cfg(unix)]\n    {\n        validate_private_file_unix(path)\n    }\n\n    #[cfg(not(any(unix, windows)))]\n    {\n        let _ = path;\n        Err(io::Error::new(\n            io::ErrorKind::Unsupported,\n            \"private host-file validation is unavailable on this target\",\n        ))\n    }\n}\n\n/// Reject a native path carrying an extended access-control list.\n///\n/// macOS ACL entries can grant access beyond owner-only POSIX mode bits, so\n/// security-sensitive paths must satisfy both checks. Platforms without this\n/// additional ACL surface accept the path unchanged.\n///\n/// # Errors\n///\n/// Returns an error when the ACL cannot be inspected or contains any entry.\npub fn validate_no_extended_acl(path: &Path) -> io::Result<()> {\n    #[cfg(target_os = \"macos\")]\n    {","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/platform_fs.rs#L273-L309","documentation":"validate_private_file() checks that an existing file satisfies the private-file policy (correct owner and no group/other access, e.g. no external hard links or permissive modes). On targets that are neither Unix nor Windows this check cannot be performed, so it fails with io::ErrorKind::Unsupported.","triggerScenarios":"Calling validate_private_file(path) on a non-unix/non-windows target, directly or indirectly through read_private_file_to_string, atomic_write_private_file_unix, and related private-file helpers.","commonSituations":"Running the library on an unsupported OS build (wasm/embedded) and reading a private file; a test suite executing on an exotic target.","solutions":["Skip private-file validation on targets without platform support, or restrict that code path to unix/windows.","Guard with cfg!(any(unix, windows)) at the call site and choose an explicit fallback behavior.","Add a platform backend in platform_fs.rs if validation is required on the new target."],"exampleFix":"// before\nvalidate_private_file(&secret_path)?;\n// after\n#[cfg(any(unix, windows))]\nvalidate_private_file(&secret_path)?;\n#[cfg(not(any(unix, windows)))]\nlog::warn!(\"private-file validation unavailable on this target\");","handlingStrategy":"fallback","validationCode":"let supported = cfg!(any(unix, windows));\nif supported { validate_private_file(&path)?; }","typeGuard":"fn supports_private_validation() -> bool { cfg!(any(unix, windows)) }","tryCatchPattern":"match validate_private_file(&path) {\n    Err(e) if e.kind() == io::ErrorKind::Unsupported => { /* explicit unvalidated fallback */ }\n    other => other?,\n}","preventionTips":["Restrict secret-storage code paths to supported platforms","Do not compile private-file flows for wasm/embedded targets expecting validation","Document that validation returns Unsupported on other targets"],"tags":["io","filesystem","validation","platform-specific"],"backgroundTag":"unsupported-platform","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}