feat: initial plugin auditing workflow (#14989)

# Description

This is an initial draft of the plugin audit workflow.

It focuses on the user experience and developer-facing permission
workflow. It does not yet include the complete implementation of every
operation that should be audited, such as the full filesystem,
networking, and process-spawning event coverage.

## User workflow

When a plugin is loaded:
1. The plugin’s register_capabilities() function is executed.
2. The plugin declares the permissions it requires.
3. OrcaSlicer displays a permission dialog listing the requested
resources.
4. If the user grants access:
  - The permission is persisted in the plugin’s .install_state.json.
  - Capability registration continues.
  - The plugin is materialized and loaded.
5. If the user denies access:
    - Plugin loading fails before capabilities are materialized.
    - on_load() is not called.
- The plugin’s install state is marked with "enabled": false to prevent
repeated automatic load attempts.

At runtime, if a plugin accesses a resource that was not approved during
loading, the audit hook displays another permission dialog. For
filesystem requests, the dialog identifies the requested filepath.
  - Granting access persists the permission and allows the operation.
  - Denying access raises a Python PermissionError.
- The error propagates to the host, which records the failure and
unloads the plugin.

Host-side traceback logging is performed outside the plugin audit
context so that logging does not generate additional permission dialogs.

## Developer-facing API

Plugins can declare filesystem read permissions through the new API:
```python

import orca
AUDIT_PATH = __file__


@orca.plugin
class ExamplePackage(orca.base):
   def register_capabilities(self):
        orca.request_permissions(
            fs_read=[AUDIT_PATH],
        )
        orca.register_capability(ExampleCapability)
```
orca.request_permissions() must be called from register_capabilities()
while the plugin is being loaded.

Currently supported permission:
orca.request_permissions(fs_read=[...])

The paths should be explicit filesystem paths that the plugin intends to
read. The host deduplicates repeated paths, presents the request after
registration completes, and persists granted paths in the plugin
install-state sidecar. This API is still experimental, and is by no
means the final implementation.

Support for additional permission categories, including filesystem write
access, networking, and process spawning, is reserved for subsequent
work.

# Screenshots/Recordings/Graphs

<!--
> Please attach relevant screenshots to showcase the UI changes.
> Please attach images that can help explain the changes.
-->

<img width="869" height="799" alt="image"
src="https://github.com/user-attachments/assets/8a5903cc-0cbb-45a8-b88a-706d6cba790f"
/>


## Tests

<!--
> Please describe the tests that you have conducted to verify the
changes made in this PR.
-->

<!--
> A guide for users on how to download the artifacts from this PR.
-->

[How to Download Pull Requests Artifacts for
Testing](https://www.orcaslicer.com/wiki/how_to_download_pr_artifacts)

tests/slic3rutils/plugin_test_utils.hpp

@@ -34,4 +34,24 @@ struct ScopedDataDir
     ScopedDataDir& operator=(const ScopedDataDir&) = delete;
 };
 
+// Point resources_dir() at a throwaway directory for the lifetime of a test and restore the
+// previous value afterwards, mirroring ScopedDataDir.
+struct ScopedResourcesDir
+{
+    ScopedTemporaryDir      tmp;
+    boost::filesystem::path dir;
+    std::string             previous;
+
+    explicit ScopedResourcesDir(const std::string& tag)
+        : tmp("orca-" + tag), dir(tmp.path()), previous(resources_dir())
+    {
+        set_resources_dir(dir.string());
+    }
+
+    ~ScopedResourcesDir() { set_resources_dir(previous); }
+
+    ScopedResourcesDir(const ScopedResourcesDir&)            = delete;
+    ScopedResourcesDir& operator=(const ScopedResourcesDir&) = delete;
+};
+
 } // namespace Slic3r

tests/slic3rutils/test_plugin_audit.cpp

@@ -27,6 +27,16 @@ void seed_denied_names()
         mgr.add_denied_filename(name);
 }
 
+// Seed the keyword registry with the same list install_hook() uses. Same rationale as
+// seed_denied_names(): a process-singleton registry, seeded from the single shared source so
+// production and tests cannot drift apart.
+void seed_denied_keywords()
+{
+    PluginAuditManager& mgr = PluginAuditManager::instance();
+    for (const auto& keyword : PluginAuditManager::default_denied_path_keywords())
+        mgr.add_denied_path_keyword(keyword);
+}
+
 } // namespace
 
 TEST_CASE("Plugin audit denies app config and token filenames anywhere", "[audit]")
@@ -81,7 +91,7 @@ TEST_CASE("Plugin audit denies app config and token filenames anywhere", "[audit
     }
 }
 
-TEST_CASE("Plugin audit deny beats allowed roots and the Loading read exemption", "[audit]")
+TEST_CASE("Plugin audit deny beats allowed roots", "[audit]")
 {
     ScopedDataDir data_dir_guard("plugin-audit-deny");
     seed_denied_names();
@@ -91,8 +101,8 @@ TEST_CASE("Plugin audit deny beats allowed roots and the Loading read exemption"
     // config and the token would otherwise be reachable simply by living inside it.
     mgr.add_global_allowed_root(data_dir());
 
-    // Enter a plugin context. The deny must hold in Loading mode, which every scope runs in.
-    ScopedPluginAuditContext ctx("test_plugin", "", PluginAuditManager::AuditMode::Loading);
+    // Enter a plugin context. The deny must hold even inside a globally allowed root.
+    ScopedPluginAuditContext ctx("test_plugin", "");
 
     const fs::path conf  = fs::path(data_dir()) / (SLIC3R_APP_KEY ".conf");
     const fs::path token = fs::path(data_dir()) / secret_constants::USER_SECRET_FILENAME;
@@ -103,6 +113,13 @@ TEST_CASE("Plugin audit deny beats allowed roots and the Loading read exemption"
         CHECK(decision.allowed);
     }
 
+    SECTION("a file outside the allowed root is blocked for reads as well as writes")
+    {
+        AuditDecision decision = mgr.check_open((fs::path(data_dir()).parent_path() / "outside.txt").string(), "r");
+        CHECK_FALSE(decision.allowed);
+        CHECK(decision.reason == "outside allowed root");
+    }
+
     SECTION("writing the app config is blocked despite data_dir() being allowed")
     {
         AuditDecision decision = mgr.check_open(conf.string(), "w");
@@ -110,16 +127,14 @@ TEST_CASE("Plugin audit deny beats allowed roots and the Loading read exemption"
         CHECK(decision.reason == "denied filename");
     }
 
-    SECTION("reading the app config is blocked even though Loading exempts reads")
+    SECTION("reading the app config is blocked despite the allowed root")
     {
-        // Without the deny, a read in Loading mode short-circuits to allow. The deny sits above
-        // that exemption, so this must still be blocked.
         AuditDecision decision = mgr.check_open(conf.string(), "r");
         CHECK_FALSE(decision.allowed);
         CHECK(decision.reason == "denied filename");
     }
 
-    SECTION("reading the cloud refresh token is blocked in Loading mode")
+    SECTION("reading the cloud refresh token is blocked")
     {
         AuditDecision decision = mgr.check_open(token.string(), "r");
         CHECK_FALSE(decision.allowed);
@@ -150,7 +165,7 @@ TEST_CASE("Plugin audit deny beats a plugin's own scoped root", "[audit]")
     const fs::path plugin_dir = fs::path(data_dir()) / "plugins" / "test_plugin";
     fs::create_directories(plugin_dir);
 
-    ScopedPluginAuditContext ctx("test_plugin", "", PluginAuditManager::AuditMode::Loading);
+    ScopedPluginAuditContext ctx("test_plugin", "");
     mgr.add_scoped_allowed_root(plugin_dir);
 
     SECTION("the plugin's own non-denied file opens for read and write")
@@ -185,3 +200,139 @@ TEST_CASE("Plugin audit does not constrain non-plugin code", "[audit]")
     CHECK(mgr.check_open(conf.string(), "w").allowed);
     CHECK(mgr.check_open(conf.string(), "r").allowed);
 }
+
+TEST_CASE("Plugin audit denies secret/certificate/config-like paths by keyword", "[audit]")
+{
+    seed_denied_keywords();
+    const PluginAuditManager& mgr = PluginAuditManager::instance();
+
+    SECTION("a 'secrets' directory component is denied")
+    {
+        CHECK(mgr.is_denied_path_keyword(fs::path("/plugin/secrets/api_key.json")));
+        CHECK(mgr.is_denied_path_keyword(fs::path("/plugin/secret/token.txt")));
+    }
+
+    SECTION("a 'certificate(s)' directory component is denied")
+    {
+        CHECK(mgr.is_denied_path_keyword(fs::path("/resources/cert/slicer_base64.cer")));
+        CHECK(mgr.is_denied_path_keyword(fs::path("/resources/certificates/ca.pem")));
+    }
+
+    SECTION("a 'conf'/'config' directory or file component is denied")
+    {
+        CHECK(mgr.is_denied_path_keyword(fs::path("/plugin/conf/settings.json")));
+        CHECK(mgr.is_denied_path_keyword(fs::path("/plugin/config/settings.json")));
+        CHECK(mgr.is_denied_path_keyword(fs::path("/plugin/plugin.conf")));
+    }
+
+    SECTION("matching is case-insensitive")
+    {
+        CHECK(mgr.is_denied_path_keyword(fs::path("/plugin/SECRETS/token.txt")));
+        CHECK(mgr.is_denied_path_keyword(fs::path("/resources/CertBundle/ca.pem")));
+        CHECK(mgr.is_denied_path_keyword(fs::path("/plugin/CONFIG.JSON")));
+    }
+
+    SECTION("matching is not limited to the base name -- any ancestor component counts")
+    {
+        CHECK(mgr.is_denied_path_keyword(fs::path("/data/secrets/nested/deep/file.txt")));
+    }
+
+    SECTION("an unrelated path is not denied")
+    {
+        CHECK_FALSE(mgr.is_denied_path_keyword(fs::path("/plugin/output/model.gcode")));
+        CHECK_FALSE(mgr.is_denied_path_keyword(fs::path("/plugin/storage/state.json")));
+    }
+
+    SECTION("an empty path is not denied")
+    {
+        CHECK_FALSE(mgr.is_denied_path_keyword(fs::path()));
+    }
+}
+
+TEST_CASE("Plugin audit is_denied_path combines the filename and keyword registries", "[audit]")
+{
+    seed_denied_names();
+    seed_denied_keywords();
+    const PluginAuditManager& mgr = PluginAuditManager::instance();
+
+    SECTION("a filename-registry match is denied")
+    {
+        CHECK(mgr.is_denied_path(fs::path(SLIC3R_APP_KEY ".conf")));
+    }
+
+    SECTION("a keyword-registry match is denied")
+    {
+        CHECK(mgr.is_denied_path(fs::path("/plugin/secrets/token.txt")));
+    }
+
+    SECTION("a path matching neither registry is not denied")
+    {
+        CHECK_FALSE(mgr.is_denied_path(fs::path("/plugin/output/model.gcode")));
+    }
+}
+
+TEST_CASE("Plugin audit a read-only allowed root blocks writes but not reads", "[audit]")
+{
+    ScopedDataDir      data_dir_guard("plugin-audit-readonly");
+    ScopedResourcesDir resources_dir_guard("plugin-audit-readonly-resources");
+    seed_denied_names();
+    seed_denied_keywords();
+
+    PluginAuditManager& mgr = PluginAuditManager::instance();
+    mgr.add_global_allowed_root(resources_dir(), /*allow_write=*/false);
+
+    ScopedPluginAuditContext ctx("test_plugin", "");
+
+    const fs::path readonly_file = fs::path(resources_dir()) / "profiles" / "vendor.json";
+
+    SECTION("a read inside the read-only root is allowed")
+    {
+        CHECK(mgr.check_open(readonly_file.string(), "r").allowed);
+    }
+
+    SECTION("a write inside the read-only root is blocked")
+    {
+        AuditDecision decision = mgr.check_open(readonly_file.string(), "w");
+        CHECK_FALSE(decision.allowed);
+        CHECK(decision.reason == "outside allowed root");
+    }
+
+    SECTION("a create inside the read-only root is blocked")
+    {
+        AuditDecision decision = mgr.check_path_access(readonly_file, /*is_write=*/true);
+        CHECK_FALSE(decision.allowed);
+    }
+
+    SECTION("the bundled cert underneath the read-only root is denied even for reads")
+    {
+        const fs::path cert = fs::path(resources_dir()) / "cert" / "slicer_base64.cer";
+        AuditDecision  decision = mgr.check_open(cert.string(), "r");
+        CHECK_FALSE(decision.allowed);
+        CHECK(decision.reason == "denied path keyword");
+    }
+}
+
+TEST_CASE("Plugin audit a scoped root can also be registered read-only", "[audit]")
+{
+    ScopedDataDir data_dir_guard("plugin-audit-scoped-readonly");
+    seed_denied_names();
+    seed_denied_keywords();
+
+    PluginAuditManager& mgr = PluginAuditManager::instance();
+
+    const fs::path readonly_dir = fs::path(data_dir()) / "readonly_scope";
+    fs::create_directories(readonly_dir);
+
+    ScopedPluginAuditContext ctx("test_plugin", "");
+    mgr.add_scoped_allowed_root(readonly_dir, /*allow_write=*/false);
+
+    SECTION("a read inside the scoped read-only root is allowed")
+    {
+        CHECK(mgr.check_open((readonly_dir / "vendor.json").string(), "r").allowed);
+    }
+
+    SECTION("a write inside the scoped read-only root is blocked")
+    {
+        CHECK_FALSE(mgr.check_open((readonly_dir / "vendor.json").string(), "w").allowed);
+    }
+}

tests/slic3rutils/test_plugin_install.cpp

@@ -112,6 +112,22 @@ TEST_CASE("install-state sidecar is the source of truth for a cloud plugin's ins
     REQUIRE(read_install_state(plugin_dir, state));
     CHECK(state.installed_version == "1.2.0");
 
+    state.permissions.fs_read       = {"/path/to/read"};
+    state.permissions.fs_readwrite  = {"/path/to/readwrite"};
+    state.permissions.network_http  = {"https://api.example.com"};
+    state.permissions.network_socket = {"192.168.45.6:443"};
+    state.permissions.process        = {"/usr/bin/curl"};
+    REQUIRE(write_install_state(plugin_dir, state));
+
+    // Permission data is persisted in the same sidecar as the installation metadata.
+    PluginInstallState persisted;
+    REQUIRE(read_install_state(plugin_dir, persisted));
+    CHECK(persisted.permissions.fs_read == state.permissions.fs_read);
+    CHECK(persisted.permissions.fs_readwrite == state.permissions.fs_readwrite);
+    CHECK(persisted.permissions.network_http == state.permissions.network_http);
+    CHECK(persisted.permissions.network_socket == state.permissions.network_socket);
+    CHECK(persisted.permissions.process == state.permissions.process);
+
     // Reading the sidecar back onto a freshly-scanned descriptor (whose header version is still
     // 1.0.0) must surface the cloud-installed 1.2.0. This is what lets update_cloud_metadata compare
     // the cloud's latest version against the installed version instead of the stale header, so an
@@ -120,4 +136,4 @@ TEST_CASE("install-state sidecar is the source of truth for a cloud plugin's ins
     scanned.version = "1.0.0"; // as parsed from the unchanged PEP723 header
     read_install_state(plugin_dir, scanned);
     CHECK(scanned.installed_version == "1.2.0");
-}
+}