Host: the store's commands (install links, dropped files, the signed Store, the install screen) are served for every app that sets AppConfig::with_store; commands::STORE, testkit::assert_shell_only_group and assert_store_guards

crates/waybetter-host/src/testkit.rs

@@ -125,6 +125,14 @@ impl Capabilities {
         }
     }
 
+    /// Every command of an optional group (e.g. [`commands::STORE`]) is granted, and only to the
+    /// local shell webview.
+    pub fn assert_shell_only_group(&self, group: &[&str]) {
+        for command in group {
+            self.assert_shell_only(command);
+        }
+    }
+
     /// `command` is granted to no capability at all.
     pub fn assert_not_granted(&self, command: &str) {
         let permission = commands::permission(command);
@@ -203,10 +211,23 @@ pub fn assert_host_guards() {
     }
 }
 
+/// The store commands' wrappers check their caller first. Runs against the host's source.
+pub fn assert_store_guards() {
+    let source = include_str!("store_commands.rs");
+    for command in commands::STORE {
+        assert_guarded(source, command, "shell_only(&webview)?");
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn the_store_commands_check_their_caller_first() {
+        assert_store_guards();
+    }
+
     fn caps_with(shell_extra: &str, tab_extra: &str, site_extra: &str) -> Capabilities {
         let host_shell: Vec<String> = commands::SHELL.iter().map(|c| format!("\"{}\"", commands::permission(c))).collect();
         let host_tab: Vec<String> = commands::TAB.iter().map(|c| format!("\"{}\"", commands::permission(c))).collect();