{"record":{"id":"83a25556bc17004c","repo":"astrid-runtime/astrid","slug":"invalidinput-83a255","errorCode":"InvalidInput","errorMessage":"private Windows directory is outside its retained authority boundary: {}","messagePattern":"private Windows directory is outside its retained authority boundary: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/platform_fs/windows/path.rs","lineNumber":316,"sourceCode":"            ),\n        }\n    }\n\n    pub(super) fn authority_boundary(&self) -> &Path {\n        &self.authority_boundary\n    }\n\n    pub(super) fn authority_handle(&self) -> HANDLE {\n        self.components\n            .last()\n            .expect(\"captured Windows path has an authority component\")\n            .handle\n            .0\n    }\n\n    pub(super) fn create_private_descendants(&self, target: &Path) -> io::Result<()> {\n        let relative = target.strip_prefix(&self.authority_boundary).map_err(|_| {\n            io::Error::new(\n                io::ErrorKind::InvalidInput,\n                format!(\n                    \"private Windows directory is outside its retained authority boundary: {}\",\n                    target.display()\n                ),\n            )\n        })?;\n        let names = relative\n            .components()\n            .map(|component| match component {\n                Component::Normal(name) => Ok(name.to_os_string()),\n                _ => Err(io::Error::new(\n                    io::ErrorKind::InvalidInput,\n                    format!(\n                        \"private Windows directory contains a non-normal component: {}\",\n                        target.display()\n                    ),\n                )),","sourceCodeStart":298,"sourceCodeEnd":334,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/platform_fs/windows/path.rs#L298-L334","documentation":"This error is thrown by `create_private_descendants` when a target path does not live under the directory handle's retained authority boundary. On Windows, private directories are created relative to an already-open trusted parent handle so no path component can be swapped; if the caller-supplied target escapes that boundary via `strip_prefix` failing, the operation is rejected with InvalidInput.","triggerScenarios":"Calling an API that resolves to `create_private_descendants` with a `target` path that is not a descendant of the handle's `authority_boundary` — e.g. an absolute path from a different tree, a sibling path, or a path containing `..` that escapes the boundary.","commonSituations":"Configuration points at a data directory outside the configured private root; a user-supplied path is joined without canonicalization; a path was constructed with `..` components; tests pass a temp dir unrelated to the boundary root.","solutions":["Ensure `target` is constructed by joining components onto the same root used to create the authority-boundary handle","Canonicalize the target and verify it starts with the boundary path before calling","Remove `..`, UNC prefixes, or verbatim (`\\\\?\\`) prefixes so the path literally shares the boundary prefix","If the target genuinely lives elsewhere, open a new trusted parent handle whose boundary contains it"],"exampleFix":"// before\nlet target = Path::new(\"C:\\\\other\\\\data\\\\dir\");\nfs.create_private_descendants(target)?;\n// after\nlet target = boundary_root.join(\"data\").join(\"dir\");\nlet target = target.canonicalize()?;\nassert!(target.starts_with(&boundary_root));\nfs.create_private_descendants(&target)?;","handlingStrategy":"validation","validationCode":"fn ensure_within_boundary(boundary: &Path, target: &Path) -> io::Result<()> {\n    let t = target.canonicalize()?;\n    let b = boundary.canonicalize()?;\n    if !t.starts_with(&b) {\n        return Err(io::Error::new(io::ErrorKind::InvalidInput, format!(\"target {} outside boundary {}\", t.display(), b.display())));\n    }\n    Ok(())\n}","typeGuard":"fn is_within(boundary: &Path, target: &Path) -> bool {\n    target.canonicalize().map(|t| t.starts_with(boundary)).unwrap_or(false)\n}","tryCatchPattern":"match create_private_descendants(&target) {\n    Err(e) if e.kind() == io::ErrorKind::InvalidInput => eprintln!(\"target escapes authority boundary: {e}\"),\n    Err(e) => return Err(e),\n    Ok(()) => {}\n}","preventionTips":["Always build targets by joining onto the boundary root","Canonicalize before comparing paths","Reject `..` components in user input","Keep verbatim/UNC prefixes consistent between boundary and target"],"tags":["windows","path-validation","filesystem","invalid-input"],"backgroundTag":"invalid-argument-value","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}