@theia/workspace 1.68.0-next.48 → 1.68.0-next.79

package/src/browser/workspace-trust-dialog.tsx

@@ -0,0 +1,90 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { nls } from '@theia/core';
+import { codicon } from '@theia/core/lib/browser';
+import { ReactDialog } from '@theia/core/lib/browser/dialogs/react-dialog';
+import * as React from '@theia/core/shared/react';
+import URI from '@theia/core/lib/common/uri';
+
+export class WorkspaceTrustDialog extends ReactDialog<boolean> {
+    protected confirmed = true;
+
+    constructor(protected readonly folderUris: URI[]) {
+        super({
+            title: '',
+            maxWidth: 500
+        });
+
+        this.node.classList.add('workspace-trust-dialog');
+
+        this.appendCloseButton(nls.localizeByDefault("No, I don't trust the authors"));
+        this.appendAcceptButton(nls.localizeByDefault('Yes, I trust the authors'));
+        this.controlPanel.removeChild(this.errorMessageNode);
+    }
+
+    get value(): boolean {
+        return this.confirmed;
+    }
+
+    protected override handleEscape(): boolean | void {
+        this.confirmed = false;
+        this.accept();
+    }
+
+    override close(): void {
+        this.confirmed = false;
+        this.accept();
+    }
+
+    protected render(): React.ReactNode {
+        return (
+            <div className="workspace-trust-content">
+                <div className="workspace-trust-header">
+                    <i className={codicon('shield')}></i>
+                    <div className="workspace-trust-title">
+                        {nls.localizeByDefault('Do you trust the authors of the files in this folder?')}
+                    </div>
+                </div>
+                <div className="workspace-trust-description">
+                    {nls.localize(
+                        'theia/workspace/trustDialogMessage',
+                        `If you trust the authors, code in this folder may be executed.
+
+                        If not, some features will be disabled.
+                        
+                        The workspace trust feature is currently under development in Theia; not all features are integrated with workspace trust yet.
+                        Check the 'Restricted Mode' indicator in the status bar for details.`
+                    )}
+                </div>
+                {this.folderUris.length > 0 && (
+                    <div className="workspace-trust-folder">
+                        <ul className="workspace-trust-folder-list">
+                            {this.folderUris.map(uri => {
+                                const stringified = uri.path.fsPath();
+                                return (
+                                    <li key={stringified}>
+                                        {stringified}
+                                    </li>
+                                );
+                            })}
+                        </ul>
+                    </div>
+                )}
+            </div>
+        );
+    }
+}

package/src/browser/workspace-trust-service.spec.ts

@@ -18,7 +18,14 @@ import { expect } from 'chai';
 import * as sinon from 'sinon';
 import { PreferenceChange, PreferenceScope } from '@theia/core/lib/common/preferences';
 import { WorkspaceTrustService } from './workspace-trust-service';
-import { WORKSPACE_TRUST_EMPTY_WINDOW, WORKSPACE_TRUST_TRUSTED_FOLDERS } from '../common/workspace-trust-preferences';
+import {
+    WORKSPACE_TRUST_EMPTY_WINDOW,
+    WORKSPACE_TRUST_ENABLED,
+    WORKSPACE_TRUST_STARTUP_PROMPT,
+    WORKSPACE_TRUST_TRUSTED_FOLDERS,
+    WorkspaceTrustPrompt
+} from '../common/workspace-trust-preferences';
+import URI from '@theia/core/lib/common/uri';
 
 class TestableWorkspaceTrustService extends WorkspaceTrustService {
     public async testHandlePreferenceChange(change: PreferenceChange): Promise<void> {
@@ -29,7 +36,7 @@ class TestableWorkspaceTrustService extends WorkspaceTrustService {
         return this.handleWorkspaceChanged();
     }
 
-    public setCurrentTrust(trust: boolean): void {
+    public setCurrentTrust(trust: boolean | undefined): void {
         this.currentTrust = trust;
     }
 
@@ -40,6 +47,10 @@ class TestableWorkspaceTrustService extends WorkspaceTrustService {
     public override isWorkspaceTrustResolved(): boolean {
         return super.isWorkspaceTrustResolved();
     }
+
+    public async testCalculateWorkspaceTrust(): Promise<boolean | undefined> {
+        return this.calculateWorkspaceTrust();
+    }
 }
 
 describe('WorkspaceTrustService', () => {
@@ -49,6 +60,199 @@ describe('WorkspaceTrustService', () => {
         service = new TestableWorkspaceTrustService();
     });
 
+    afterEach(() => {
+        sinon.restore();
+    });
+
+    describe('calculateWorkspaceTrust', () => {
+        let workspaceTrustPrefStub: { [key: string]: unknown };
+        let workspaceServiceStub: {
+            tryGetRoots: () => Array<{ resource: URI }>;
+            workspace: { resource: URI } | undefined;
+            saved: boolean;
+        };
+        let untitledWorkspaceServiceStub: {
+            isUntitledWorkspace: (uri?: URI, configDirUri?: URI) => boolean;
+        };
+        let envVariablesServerStub: {
+            getConfigDirUri: () => Promise<string>;
+        };
+
+        beforeEach(() => {
+            workspaceTrustPrefStub = {
+                [WORKSPACE_TRUST_ENABLED]: true,
+                [WORKSPACE_TRUST_EMPTY_WINDOW]: false,
+                [WORKSPACE_TRUST_STARTUP_PROMPT]: WorkspaceTrustPrompt.NEVER,
+                [WORKSPACE_TRUST_TRUSTED_FOLDERS]: []
+            };
+            workspaceServiceStub = {
+                tryGetRoots: () => [],
+                workspace: undefined,
+                saved: false
+            };
+            untitledWorkspaceServiceStub = {
+                isUntitledWorkspace: () => false
+            };
+            envVariablesServerStub = {
+                getConfigDirUri: async () => 'file:///home/user/.theia'
+            };
+
+            (service as unknown as { workspaceTrustPref: typeof workspaceTrustPrefStub }).workspaceTrustPref = workspaceTrustPrefStub;
+            (service as unknown as { workspaceService: typeof workspaceServiceStub }).workspaceService = workspaceServiceStub;
+            (service as unknown as { untitledWorkspaceService: typeof untitledWorkspaceServiceStub }).untitledWorkspaceService = untitledWorkspaceServiceStub;
+            (service as unknown as { envVariablesServer: typeof envVariablesServerStub }).envVariablesServer = envVariablesServerStub;
+        });
+
+        it('should return true when trust is disabled', async () => {
+            workspaceTrustPrefStub[WORKSPACE_TRUST_ENABLED] = false;
+
+            expect(await service.testCalculateWorkspaceTrust()).to.be.true;
+        });
+
+        describe('empty workspace', () => {
+            it('should return emptyWindow setting when no workspace is open', async () => {
+                workspaceServiceStub.workspace = undefined;
+                workspaceTrustPrefStub[WORKSPACE_TRUST_EMPTY_WINDOW] = true;
+
+                expect(await service.testCalculateWorkspaceTrust()).to.be.true;
+            });
+
+            it('should return false when emptyWindow is false and no workspace', async () => {
+                workspaceServiceStub.workspace = undefined;
+                workspaceTrustPrefStub[WORKSPACE_TRUST_EMPTY_WINDOW] = false;
+
+                expect(await service.testCalculateWorkspaceTrust()).to.be.false;
+            });
+
+            it('should return emptyWindow setting for untitled workspace with no folders', async () => {
+                workspaceServiceStub.workspace = { resource: new URI('file:///home/user/.theia/workspaces/Untitled-123.theia-workspace') };
+                workspaceServiceStub.tryGetRoots = () => [];
+                untitledWorkspaceServiceStub.isUntitledWorkspace = () => true;
+                workspaceTrustPrefStub[WORKSPACE_TRUST_EMPTY_WINDOW] = true;
+
+                expect(await service.testCalculateWorkspaceTrust()).to.be.true;
+            });
+
+            it('should not treat saved workspace with no folders as empty', async () => {
+                workspaceServiceStub.workspace = { resource: new URI('file:///home/user/my.theia-workspace') };
+                workspaceServiceStub.tryGetRoots = () => [];
+                workspaceServiceStub.saved = true;
+                untitledWorkspaceServiceStub.isUntitledWorkspace = () => false;
+                workspaceTrustPrefStub[WORKSPACE_TRUST_EMPTY_WINDOW] = true;
+
+                // Should return false because saved workspace with 0 folders is not "empty"
+                // and the workspace file is not trusted
+                expect(await service.testCalculateWorkspaceTrust()).to.be.false;
+            });
+        });
+
+        describe('single-root workspace', () => {
+            it('should return true when folder is in trusted folders', async () => {
+                workspaceTrustPrefStub[WORKSPACE_TRUST_TRUSTED_FOLDERS] = ['file:///home/user/project'];
+                workspaceServiceStub.workspace = { resource: new URI('file:///home/user/project') };
+                workspaceServiceStub.tryGetRoots = () => [
+                    { resource: new URI('file:///home/user/project') }
+                ];
+
+                expect(await service.testCalculateWorkspaceTrust()).to.be.true;
+            });
+
+            it('should return true when parent folder is trusted', async () => {
+                workspaceTrustPrefStub[WORKSPACE_TRUST_TRUSTED_FOLDERS] = ['file:///home/user'];
+                workspaceServiceStub.workspace = { resource: new URI('file:///home/user/project') };
+                workspaceServiceStub.tryGetRoots = () => [
+                    { resource: new URI('file:///home/user/project') }
+                ];
+
+                expect(await service.testCalculateWorkspaceTrust()).to.be.true;
+            });
+
+            it('should return false when folder is not trusted', async () => {
+                workspaceTrustPrefStub[WORKSPACE_TRUST_TRUSTED_FOLDERS] = ['file:///home/other'];
+                workspaceServiceStub.workspace = { resource: new URI('file:///home/user/project') };
+                workspaceServiceStub.tryGetRoots = () => [
+                    { resource: new URI('file:///home/user/project') }
+                ];
+
+                expect(await service.testCalculateWorkspaceTrust()).to.be.false;
+            });
+        });
+
+        describe('multi-root workspace', () => {
+            it('should return true when all folders are trusted', async () => {
+                workspaceTrustPrefStub[WORKSPACE_TRUST_TRUSTED_FOLDERS] = [
+                    'file:///home/user/project1',
+                    'file:///home/user/project2'
+                ];
+                workspaceServiceStub.workspace = { resource: new URI('file:///home/user/my.theia-workspace') };
+                workspaceServiceStub.tryGetRoots = () => [
+                    { resource: new URI('file:///home/user/project1') },
+                    { resource: new URI('file:///home/user/project2') }
+                ];
+
+                expect(await service.testCalculateWorkspaceTrust()).to.be.true;
+            });
+
+            it('should return false when one folder is not trusted', async () => {
+                workspaceTrustPrefStub[WORKSPACE_TRUST_TRUSTED_FOLDERS] = ['file:///home/user/project1'];
+                workspaceServiceStub.workspace = { resource: new URI('file:///home/user/my.theia-workspace') };
+                workspaceServiceStub.tryGetRoots = () => [
+                    { resource: new URI('file:///home/user/project1') },
+                    { resource: new URI('file:///home/user/project2') }
+                ];
+
+                expect(await service.testCalculateWorkspaceTrust()).to.be.false;
+            });
+
+            it('should return true when parent folder covers all roots', async () => {
+                workspaceTrustPrefStub[WORKSPACE_TRUST_TRUSTED_FOLDERS] = ['file:///home/user'];
+                workspaceServiceStub.workspace = { resource: new URI('file:///home/user/my.theia-workspace') };
+                workspaceServiceStub.tryGetRoots = () => [
+                    { resource: new URI('file:///home/user/project1') },
+                    { resource: new URI('file:///home/user/project2') }
+                ];
+
+                expect(await service.testCalculateWorkspaceTrust()).to.be.true;
+            });
+        });
+
+        describe('saved workspace file trust', () => {
+            it('should require workspace file to be trusted for saved workspaces', async () => {
+                // Folder is trusted but workspace file location is not
+                workspaceTrustPrefStub[WORKSPACE_TRUST_TRUSTED_FOLDERS] = ['file:///home/user/project'];
+                workspaceServiceStub.workspace = { resource: new URI('file:///other/location/my.theia-workspace') };
+                workspaceServiceStub.saved = true;
+                workspaceServiceStub.tryGetRoots = () => [
+                    { resource: new URI('file:///home/user/project') }
+                ];
+
+                expect(await service.testCalculateWorkspaceTrust()).to.be.false;
+            });
+
+            it('should return true when both folder and workspace file are trusted', async () => {
+                workspaceTrustPrefStub[WORKSPACE_TRUST_TRUSTED_FOLDERS] = ['file:///home/user'];
+                workspaceServiceStub.workspace = { resource: new URI('file:///home/user/my.theia-workspace') };
+                workspaceServiceStub.saved = true;
+                workspaceServiceStub.tryGetRoots = () => [
+                    { resource: new URI('file:///home/user/project') }
+                ];
+
+                expect(await service.testCalculateWorkspaceTrust()).to.be.true;
+            });
+
+            it('should not require workspace file trust for unsaved workspaces', async () => {
+                workspaceTrustPrefStub[WORKSPACE_TRUST_TRUSTED_FOLDERS] = ['file:///home/user/project'];
+                workspaceServiceStub.workspace = { resource: new URI('file:///tmp/untitled.theia-workspace') };
+                workspaceServiceStub.saved = false;
+                workspaceServiceStub.tryGetRoots = () => [
+                    { resource: new URI('file:///home/user/project') }
+                ];
+
+                expect(await service.testCalculateWorkspaceTrust()).to.be.true;
+            });
+        });
+    });
+
     describe('handleWorkspaceChanged', () => {
         let resolveWorkspaceTrustStub: sinon.SinonStub;
         let getWorkspaceTrustStub: sinon.SinonStub;
@@ -63,10 +267,6 @@ describe('WorkspaceTrustService', () => {
             );
         });
 
-        afterEach(() => {
-            sinon.restore();
-        });
-
         it('should reset trust state when workspace changes', async () => {
             service.setCurrentTrust(true);
 
@@ -103,36 +303,30 @@ describe('WorkspaceTrustService', () => {
     });
 
     describe('handlePreferenceChange', () => {
-        let isWorkspaceInTrustedFoldersStub: sinon.SinonStub;
+        let areAllWorkspaceUrisTrustedStub: sinon.SinonStub;
         let setWorkspaceTrustStub: sinon.SinonStub;
+        let isEmptyWorkspaceStub: sinon.SinonStub;
         let workspaceTrustPrefStub: { [key: string]: unknown };
-        let workspaceServiceStub: { workspace: unknown };
 
         beforeEach(() => {
-            isWorkspaceInTrustedFoldersStub = sinon.stub(service as unknown as { isWorkspaceInTrustedFolders: () => boolean }, 'isWorkspaceInTrustedFolders');
+            areAllWorkspaceUrisTrustedStub = sinon.stub(service as unknown as { areAllWorkspaceUrisTrusted: () => Promise<boolean> }, 'areAllWorkspaceUrisTrusted');
             setWorkspaceTrustStub = sinon.stub(service, 'setWorkspaceTrust');
+            isEmptyWorkspaceStub = sinon.stub(service as unknown as { isEmptyWorkspace: () => Promise<boolean> }, 'isEmptyWorkspace');
             // Mock workspaceTrustPref - default emptyWindow to false so trusted folders logic runs
             workspaceTrustPrefStub = { [WORKSPACE_TRUST_EMPTY_WINDOW]: false };
             (service as unknown as { workspaceTrustPref: { [key: string]: unknown } }).workspaceTrustPref = workspaceTrustPrefStub;
-            // Mock workspaceService with a workspace (non-empty)
-            workspaceServiceStub = { workspace: { resource: { toString: () => 'file:///some/workspace' } } };
-            (service as unknown as { workspaceService: { workspace: unknown } }).workspaceService = workspaceServiceStub;
-        });
-
-        afterEach(() => {
-            sinon.restore();
+            // Default to non-empty workspace
+            isEmptyWorkspaceStub.resolves(false);
         });
 
-        it('should update trust to true when folder is added to trustedFolders', async () => {
+        it('should update trust to true when all workspace URIs become trusted', async () => {
             service.setCurrentTrust(false);
-            isWorkspaceInTrustedFoldersStub.returns(true);
+            areAllWorkspaceUrisTrustedStub.resolves(true);
 
             const change: PreferenceChange = {
                 preferenceName: WORKSPACE_TRUST_TRUSTED_FOLDERS,
                 scope: PreferenceScope.User,
                 domain: [],
-                newValue: ['/some/path'],
-                oldValue: [],
                 affects: () => true
             };
 
@@ -141,16 +335,14 @@ describe('WorkspaceTrustService', () => {
             expect(setWorkspaceTrustStub.calledOnceWith(true)).to.be.true;
         });
 
-        it('should update trust to false when folder is removed from trustedFolders', async () => {
+        it('should update trust to false when not all workspace URIs are trusted', async () => {
             service.setCurrentTrust(true);
-            isWorkspaceInTrustedFoldersStub.returns(false);
+            areAllWorkspaceUrisTrustedStub.resolves(false);
 
             const change: PreferenceChange = {
                 preferenceName: WORKSPACE_TRUST_TRUSTED_FOLDERS,
                 scope: PreferenceScope.User,
                 domain: [],
-                newValue: [],
-                oldValue: ['/some/path'],
                 affects: () => true
             };
 
@@ -159,16 +351,14 @@ describe('WorkspaceTrustService', () => {
             expect(setWorkspaceTrustStub.calledOnceWith(false)).to.be.true;
         });
 
-        it('should not update trust when trustedFolders change does not affect current workspace', async () => {
+        it('should not update trust when trustedFolders change does not affect trust status', async () => {
             service.setCurrentTrust(false);
-            isWorkspaceInTrustedFoldersStub.returns(false);
+            areAllWorkspaceUrisTrustedStub.resolves(false);
 
             const change: PreferenceChange = {
                 preferenceName: WORKSPACE_TRUST_TRUSTED_FOLDERS,
                 scope: PreferenceScope.User,
                 domain: [],
-                newValue: ['/other/path'],
-                oldValue: [],
                 affects: () => true
             };
 
@@ -179,20 +369,18 @@ describe('WorkspaceTrustService', () => {
 
         describe('emptyWindow setting changes', () => {
             beforeEach(() => {
-                // Reset workspace to undefined for empty window tests
-                workspaceServiceStub.workspace = undefined;
+                // Reset to empty workspace for empty window tests
+                isEmptyWorkspaceStub.resolves(true);
             });
 
             it('should update trust to true when emptyWindow setting changes to true for empty window', async () => {
                 service.setCurrentTrust(false);
-                workspaceServiceStub.workspace = undefined;
+                workspaceTrustPrefStub[WORKSPACE_TRUST_EMPTY_WINDOW] = true;
 
                 const change: PreferenceChange = {
                     preferenceName: WORKSPACE_TRUST_EMPTY_WINDOW,
                     scope: PreferenceScope.User,
                     domain: [],
-                    newValue: true,
-                    oldValue: false,
                     affects: () => true
                 };
 
@@ -203,14 +391,11 @@ describe('WorkspaceTrustService', () => {
 
             it('should update trust to false when emptyWindow setting changes to false for empty window', async () => {
                 service.setCurrentTrust(true);
-                workspaceServiceStub.workspace = undefined;
 
                 const change: PreferenceChange = {
                     preferenceName: WORKSPACE_TRUST_EMPTY_WINDOW,
                     scope: PreferenceScope.User,
                     domain: [],
-                    newValue: false,
-                    oldValue: true,
                     affects: () => true
                 };
 
@@ -219,16 +404,14 @@ describe('WorkspaceTrustService', () => {
                 expect(setWorkspaceTrustStub.calledOnceWith(false)).to.be.true;
             });
 
-            it('should not update trust when emptyWindow setting changes but workspace is open', async () => {
+            it('should not update trust when emptyWindow setting changes but workspace has roots', async () => {
                 service.setCurrentTrust(false);
-                workspaceServiceStub.workspace = { resource: { toString: () => 'file:///some/path' } };
+                isEmptyWorkspaceStub.resolves(false);
 
                 const change: PreferenceChange = {
                     preferenceName: WORKSPACE_TRUST_EMPTY_WINDOW,
                     scope: PreferenceScope.User,
                     domain: [],
-                    newValue: true,
-                    oldValue: false,
                     affects: () => true
                 };
 
@@ -239,14 +422,34 @@ describe('WorkspaceTrustService', () => {
 
             it('should not update trust when emptyWindow setting changes but trust already matches', async () => {
                 service.setCurrentTrust(true);
-                workspaceServiceStub.workspace = undefined;
+                workspaceTrustPrefStub[WORKSPACE_TRUST_EMPTY_WINDOW] = true;
 
                 const change: PreferenceChange = {
                     preferenceName: WORKSPACE_TRUST_EMPTY_WINDOW,
                     scope: PreferenceScope.User,
                     domain: [],
-                    newValue: true,
-                    oldValue: false,
+                    affects: () => true
+                };
+
+                await service.testHandlePreferenceChange(change);
+
+                expect(setWorkspaceTrustStub.called).to.be.false;
+            });
+        });
+
+        describe('trustedFolders change for empty window with emptyWindow enabled', () => {
+            beforeEach(() => {
+                isEmptyWorkspaceStub.resolves(true);
+                workspaceTrustPrefStub[WORKSPACE_TRUST_EMPTY_WINDOW] = true;
+            });
+
+            it('should not change trust when trustedFolders change for empty window with emptyWindow enabled', async () => {
+                service.setCurrentTrust(true);
+
+                const change: PreferenceChange = {
+                    preferenceName: WORKSPACE_TRUST_TRUSTED_FOLDERS,
+                    scope: PreferenceScope.User,
+                    domain: [],
                     affects: () => true
                 };