feat!: allow assuming trust during upward discovery

upward discovery options should allow callers
to override the trust level during discovery. When a trust level is provided,
discovery should not compute trust from path ownership and should instead assume
the provided level.

This intentionally changes the public Options::trust (formerly `required_trust`)
field from gix_sec::Trust to gix_discover::upwards::Trust so the field can
represent either a required computed trust threshold or an assumed trust level.
Existing callers that set required_trust directly need to wrap their threshold
in Trust::Required(_).

The fix keeps the default as the existing reduced-trust requirement, while
Trust::Assume(level) skips Trust::from_path_ownership() and returns the provided
trust level.

Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>

Author: codex

gix-discover/src/upwards/mod.rs

@@ -1,5 +1,5 @@
 mod types;
-pub use types::{Error, Options};
+pub use types::{Error, Options, TrustPolicy};
 
 mod util;
 
@@ -8,7 +8,7 @@ pub(crate) mod function {
 
     use gix_sec::Trust;
 
-    use super::{Error, Options};
+    use super::{Error, Options, TrustPolicy};
     #[cfg(unix)]
     use crate::upwards::util::device_id;
     use crate::{
@@ -27,14 +27,14 @@ pub(crate) mod function {
     pub fn discover_opts(
         directory: &Path,
         Options {
-            required_trust,
+            trust,
             ceiling_dirs,
             match_ceiling_dir_or_error,
             cross_fs,
             current_dir,
             dot_git_only,
         }: Options<'_>,
-    ) -> Result<(crate::repository::Path, Trust), Error> {
+    ) -> Result<(crate::repository::Path, gix_sec::Trust), Error> {
         // Normalize the path so that `Path::parent()` _actually_ gives
         // us the parent directory. (`Path::parent` just strips off the last
         // path component, which means it will not do what you expect when
@@ -67,9 +67,15 @@ pub(crate) mod function {
                 .or_else(|_| dir.as_ref().strip_prefix(cwd.as_ref()))
                 .is_ok();
 
-        let filter_by_trust = |x: &Path| -> Result<Option<Trust>, Error> {
-            let trust = Trust::from_path_ownership(x).map_err(|err| Error::CheckTrust { path: x.into(), err })?;
-            Ok((trust >= required_trust).then_some(trust))
+        let filter_by_trust = |x: &Path| -> Result<Result<Trust, Trust>, Error> {
+            match trust {
+                TrustPolicy::Required(required) => {
+                    let trust =
+                        Trust::from_path_ownership(x).map_err(|err| Error::CheckTrust { path: x.into(), err })?;
+                    Ok(if trust >= required { Ok(trust) } else { Err(required) })
+                }
+                TrustPolicy::Assume(trust) => Ok(Ok(trust)),
+            }
         };
 
         let max_height = if !ceiling_dirs.is_empty() {
@@ -134,7 +140,7 @@ pub(crate) mod function {
                     None => is_git(&cursor),
                 } {
                     match filter_by_trust(&cursor)? {
-                        Some(trust) => {
+                        Ok(trust) => {
                             // TODO: test this more, it definitely doesn't always find the shortest path to a directory
                             let path = if dir_made_absolute {
                                 shorten_path_with_cwd(cursor, cwd.as_ref())
@@ -150,11 +156,11 @@ pub(crate) mod function {
                                 trust,
                             ));
                         }
-                        None => {
+                        Err(required) => {
                             break 'outer Err(Error::NoTrustedGitRepository {
                                 path: dir.into_owned(),
                                 candidate: cursor,
-                                required: required_trust,
+                                required,
                             });
                         }
                     }
@@ -198,7 +204,7 @@ pub(crate) mod function {
     /// the trust level derived from Path ownership.
     ///
     /// Fail if no valid-looking git repository could be found.
-    pub fn discover(directory: &Path) -> Result<(crate::repository::Path, Trust), Error> {
+    pub fn discover(directory: &Path) -> Result<(crate::repository::Path, gix_sec::Trust), Error> {
         discover_opts(directory, Default::default())
     }
 }

gix-discover/src/upwards/types.rs

@@ -32,14 +32,30 @@ pub enum Error {
     },
 }
 
+/// How to obtain the trust level for a discovered repository.
+#[derive(Copy, Clone, Debug, Eq, PartialEq, Ord, PartialOrd, Hash)]
+pub enum TrustPolicy {
+    /// Determine trust from repository ownership and require it to be at least the given level.
+    Required(gix_sec::Trust),
+    /// Trust computation is skipped and the given trust level is assumed.
+    Assume(gix_sec::Trust),
+}
+
+impl Default for TrustPolicy {
+    fn default() -> Self {
+        TrustPolicy::Required(gix_sec::Trust::Reduced)
+    }
+}
+
 /// Options to help guide the [discovery][crate::upwards()] of repositories, along with their options
 /// when instantiated.
 pub struct Options<'a> {
-    /// When discovering a repository, assure it has at least this trust level or ignore it otherwise.
+    /// When discovering a repository, determine how trust should be obtained.
     ///
-    /// This defaults to [`Reduced`][gix_sec::Trust::Reduced] as our default settings are geared towards avoiding abuse.
-    /// Set it to `Full` to only see repositories that [are owned by the current user][gix_sec::Trust::from_path_ownership()].
-    pub required_trust: gix_sec::Trust,
+    /// This defaults to [`Required(Reduced)`][TrustPolicy::Required] as our default settings are geared towards avoiding abuse.
+    /// Set it to `Required(Full)` to only see repositories that [are owned by the current user][gix_sec::Trust::from_path_ownership()],
+    /// or [`TrustPolicy::Assume`] to skip trust computation and return the given trust level.
+    pub trust: TrustPolicy,
     /// When discovering a repository, ignore any repositories that are located in these directories or any of their parents.
     ///
     /// Note that we ignore ceiling directories if the search directory is directly on top of one, which by default is an error
@@ -73,7 +89,7 @@ pub struct Options<'a> {
 impl Default for Options<'_> {
     fn default() -> Self {
         Options {
-            required_trust: gix_sec::Trust::Reduced,
+            trust: TrustPolicy::default(),
             ceiling_dirs: vec![],
             match_ceiling_dir_or_error: true,
             cross_fs: false,

gix-discover/tests/discover/upwards/mod.rs

@@ -12,6 +12,34 @@ fn expected_trust() -> gix_sec::Trust {
 
 mod ceiling_dirs;
 
+#[test]
+fn can_override_computed_trust() -> crate::Result {
+    let dir = repo_path()?.join("some/very/deeply/nested/subdir");
+    let overridden_trust = match expected_trust() {
+        gix_sec::Trust::Full => gix_sec::Trust::Reduced,
+        gix_sec::Trust::Reduced => gix_sec::Trust::Full,
+    };
+
+    let (path, trust) = gix_discover::upwards_opts(
+        &dir,
+        gix_discover::upwards::Options {
+            trust: gix_discover::upwards::TrustPolicy::Assume(overridden_trust),
+            ..Default::default()
+        },
+    )?;
+
+    assert_eq!(
+        path.kind(),
+        Kind::WorkTree { linked_git_dir: None },
+        "discovery still finds the worktree"
+    );
+    assert_eq!(
+        trust, overridden_trust,
+        "the caller-provided trust is returned instead of the computed ownership trust"
+    );
+    Ok(())
+}
+
 #[test]
 fn from_bare_git_dir() -> crate::Result {
     let dir = repo_path()?.join("bare.git");