InvalidInput

InvalidInput

Error message

private Windows directory is outside its retained authority boundary: {}

What it means

This error is thrown by `create_private_descendants` when a target path does not live under the directory handle's retained authority boundary. On Windows, private directories are created relative to an already-open trusted parent handle so no path component can be swapped; if the caller-supplied target escapes that boundary via `strip_prefix` failing, the operation is rejected with InvalidInput.

Solutions

Ensure `target` is constructed by joining components onto the same root used to create the authority-boundary handle
Canonicalize the target and verify it starts with the boundary path before calling
Remove `..`, UNC prefixes, or verbatim (`\\?\`) prefixes so the path literally shares the boundary prefix
If the target genuinely lives elsewhere, open a new trusted parent handle whose boundary contains it

Example fix

// before
let target = Path::new("C:\\other\\data\\dir");
fs.create_private_descendants(target)?;
// after
let target = boundary_root.join("data").join("dir");
let target = target.canonicalize()?;
assert!(target.starts_with(&boundary_root));
fs.create_private_descendants(&target)?;

Defensive patterns

Strategy: validation

Validate before calling

fn ensure_within_boundary(boundary: &Path, target: &Path) -> io::Result<()> {
    let t = target.canonicalize()?;
    let b = boundary.canonicalize()?;
    if !t.starts_with(&b) {
        return Err(io::Error::new(io::ErrorKind::InvalidInput, format!("target {} outside boundary {}", t.display(), b.display())));
    }
    Ok(())
}

Type guard

fn is_within(boundary: &Path, target: &Path) -> bool {
    target.canonicalize().map(|t| t.starts_with(boundary)).unwrap_or(false)
}

Try / catch

match create_private_descendants(&target) {
    Err(e) if e.kind() == io::ErrorKind::InvalidInput => eprintln!("target escapes authority boundary: {e}"),
    Err(e) => return Err(e),
    Ok(()) => {}
}

Prevention

Always build targets by joining onto the boundary root
Canonicalize before comparing paths
Reject `..` components in user input
Keep verbatim/UNC prefixes consistent between boundary and target

When it happens

Trigger: Calling an API that resolves to `create_private_descendants` with a `target` path that is not a descendant of the handle's `authority_boundary` — e.g. an absolute path from a different tree, a sibling path, or a path containing `..` that escapes the boundary.

Common situations: Configuration points at a data directory outside the configured private root; a user-supplied path is joined without canonicalization; a path was constructed with `..` components; tests pass a temp dir unrelated to the boundary root.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/83a25556bc17004c. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-core/src/platform_fs/windows/path.rs:316

            ),
        }
    }

    pub(super) fn authority_boundary(&self) -> &Path {
        &self.authority_boundary
    }

    pub(super) fn authority_handle(&self) -> HANDLE {
        self.components
            .last()
            .expect("captured Windows path has an authority component")
            .handle
            .0
    }

    pub(super) fn create_private_descendants(&self, target: &Path) -> io::Result<()> {
        let relative = target.strip_prefix(&self.authority_boundary).map_err(|_| {
            io::Error::new(
                io::ErrorKind::InvalidInput,
                format!(
                    "private Windows directory is outside its retained authority boundary: {}",
                    target.display()
                ),
            )
        })?;
        let names = relative
            .components()
            .map(|component| match component {
                Component::Normal(name) => Ok(name.to_os_string()),
                _ => Err(io::Error::new(
                    io::ErrorKind::InvalidInput,
                    format!(
                        "private Windows directory contains a non-normal component: {}",
                        target.display()
                    ),
                )),

View on GitHub (pinned to affd8760f4)