[FEATURE]: more intelligent use of "edit" permission patterns. #22336

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

A "edit" permission can currently be specified as follows:

  "edit": {
    "*": "allow"
  }

The pattern (* in this case) is matched against path that is relative to the worktree, but since * matches everything (including ../) that doesn't matter here: a * just matches every file on the whole hard disk.

Lets say we have the following files:

1. /root/external1/worktree/bar/foo,
2. /root/external1/foo,
3. /root/external2/foo,
4. /root/foo

Trying to edit any of these files use the following strings to match against any of the given patterns:

1. "bar/foo"
2. "../foo"
3. "../../external2/foo"
4. "../../../foo"

all of which match a *.

Note that as a result it is not possible to use an absolute path as pattern,
using - for example -

  "edit": {
    "/root/external2/*": "allow"
  }

doesn't match any of those string, because none will start with a '/' - failing the match already at the first character.

I have the following proposal:

• Each "edit" pattern belong to one of three categories:
  A. absolute patterns (path.isAbsolute(pattern) will work)
  B. patterns that start with "../".
  C. all other patterns.
• If a file needs to be checked we match its absolute path (eg /root/external1/foo) against all patterns of category A, while matching its relative path (eg ../foo) against category B and C.
• If a file matches category C but the full path is outside the worktree - it is rejected anyway (as if it didn't match), and if a file matches category B but the full path is inside the worktree - it is rejected as well.

Example patterns and which files they would match (1,2,3 and/or 4):

"*" : (cat. C) matches 1 only [current: matches 1,2,3,4]
"*/foo: (cat. C) matches 1 only [current: matches 1,2,3,4]
"/root/external1/*": (cat. A) matches 1 and 2 [current: matches nothing]
"/root/external*": (cat. A) matches 1, 2 and 3 [current: matches nothing]
"/root/external2/*": (cat. A) matches 3 only [current: matches nothing]
"../*": (cat. B) matches 2 only [current: 2,3,4]