vaultik/internal/snapshot/permission_error_test.go

//nolint:testpackage // needs access to unexported wrapPermissionError
package snapshot

import (
	"errors"
	"fmt"
	"os"
	"runtime"
	"strings"
	"testing"
)

// errDiskOnFire is a non-permission sentinel used to verify pass-through.
var errDiskOnFire = errors.New("disk on fire")

func TestWrapPermissionError(t *testing.T) {
	t.Parallel()

	// Non-permission errors pass through unchanged.
	got := wrapPermissionError("/some/path", errDiskOnFire)
	if !errors.Is(got, errDiskOnFire) {
		t.Errorf("non-permission error should pass through, got %v", got)
	}

	// Permission errors get remediation instructions.
	permErr := fmt.Errorf("open /x: %w", os.ErrPermission)
	wrapped := wrapPermissionError("/Users/u/Library/Calendars", permErr)

	if !errors.Is(wrapped, os.ErrPermission) {
		t.Error("wrapped error should still match os.ErrPermission")
	}

	if !strings.Contains(wrapped.Error(), "/Users/u/Library/Calendars") {
		t.Error("wrapped error should name the offending path")
	}

	if runtime.GOOS == "darwin" {
		if !strings.Contains(wrapped.Error(), "Full Disk Access") {
			t.Errorf("macOS permission error should mention Full Disk Access:\n%s",
				wrapped.Error())
		}

		if !strings.Contains(wrapped.Error(), "System Settings") {
			t.Errorf("macOS permission error should point at System Settings:\n%s",
				wrapped.Error())
		}
	} else if !strings.Contains(wrapped.Error(), "--skip-errors") {
		t.Errorf("non-macOS permission error should mention --skip-errors:\n%s",
			wrapped.Error())
	}
}