fix: plugin audit blocking files in .config folder e.g. .config/OrcaSlicer

.github/workflows/cli_overrides.yml

@@ -1,145 +0,0 @@
-# CLI override sweep (orca-test-repo test_cli_overrides.py) against the
-# latest successful Linux AppImage build of this repo. Verifies every CLI
-# config option lands in the merged config and the sliced G-code's
-# CONFIG_BLOCK, then re-slices each landed option individually to classify
-# it effective/inert (--effect-full). Headless CLI only - no display stack.
-name: CLI Override Sweep
-
-on:
-  # temporary, for pre-merge branch testing: workflow_dispatch only works once
-  # the workflow exists on the default branch, but push events run the
-  # workflow from the pushed ref. Remove this trigger when merging to main.
-  push:
-    branches: ["hanif/parity-harness"]
-  workflow_dispatch:
-    inputs:
-      test_repo_ref:
-        description: "orca-test-repo ref to run"
-        required: false
-        default: "cli-test-suite"
-      build_branch:
-        description: "branch whose latest successful build_all artifact to test"
-        required: false
-        default: "main"
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  overrides:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        # The effect stage re-slices every landed option one at a time and
-        # cannot batch, so it is the whole cost of this job.
-        # parity/effect_routing.json groups options by the cheapest fixture that
-        # can show their effect and splits them into balanced, disjoint shards
-        # covering every landed option exactly once. Measured at ~12.5 min a
-        # shard; un-sharded the sweep is ~24 min, so this is about feedback time
-        # rather than fitting the timeout.
-        shard: [0, 1]
-    steps:
-      - name: Find the latest successful Linux build
-        id: build
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          gh run list --workflow build_all.yml \
-            --branch "${{ github.event.inputs.build_branch || 'main' }}" \
-            --status success --limit 1 --json databaseId,headSha \
-            --jq '"run_id=\(.[0].databaseId)\nhead_sha=\(.[0].headSha)"' \
-            >> "$GITHUB_OUTPUT"
-          cat "$GITHUB_OUTPUT"
-
-      - name: Check out the test suite
-        uses: actions/checkout@v5
-        with:
-          repository: OrcaSlicer/orca-test-repo
-          # temporary fallback for push-triggered branch testing (inputs are
-          # empty on push): restore to 'cli-test-suite' when merging to main
-          ref: ${{ github.event.inputs.test_repo_ref || 'hanif/parity-harness' }}
-          path: orca-test-repo
-
-      # the AppImage ships only packed .opc preset caches, no profile JSONs,
-      # so resources/ (and the option-surface source) must come from the
-      # source tree at the SAME sha the artifact was built from
-      - name: Check out OrcaSlicer sources at the build's sha
-        uses: actions/checkout@v5
-        with:
-          ref: ${{ steps.build.outputs.head_sha }}
-          path: slicer
-
-      - name: Download and extract the Linux AppImage
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          gh run download "${{ steps.build.outputs.run_id }}" --dir appimage \
-            --pattern "OrcaSlicer_Linux_ubuntu_2404*"
-          appimage=$(find appimage -name "*.AppImage" ! -name "*aarch64*" | head -1)
-          [ -n "$appimage" ] || { echo "no AppImage found"; ls -R appimage; exit 1; }
-          chmod +x "$appimage"
-          "$appimage" --appimage-extract > /dev/null
-          [ -x squashfs-root/AppRun ] || { echo "no AppRun in AppImage"; exit 1; }
-          echo "ORCA_BIN=$PWD/squashfs-root/AppRun" >> "$GITHUB_ENV"
-          echo "ORCA_SOURCE=$PWD/slicer" >> "$GITHUB_ENV"
-
-      - name: Install the AppImage's host runtime dependencies
-        run: |
-          # orca-slicer-env's two preflight gates: OpenGL and WebKitGTK 4.1
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            libopengl0 libglu1-mesa libgl1 libegl1 libwebkit2gtk-4.1-0
-
-      - name: Install suite dependencies
-        run: pip install -r orca-test-repo/requirements.txt
-
-      - name: Run the override sweep (full effect stage)
-        id: run
-        continue-on-error: true
-        working-directory: orca-test-repo
-        run: |
-          # -rA prints the per-stage summaries: pytest captures stdout on
-          # passing tests, so without it every "grep override sweep" below
-          # finds nothing and the job summary says "no stage summaries"
-          python -m pytest test_cli_overrides.py -c pytest.ini -v -rA --effect-full \
-            --effect-shard ${{ matrix.shard }}/2 \
-            --orca-bin "$ORCA_BIN" --orca-source "$ORCA_SOURCE" \
-            2>&1 | tee ../sweep.log
-
-      - name: Publish job summary
-        if: always()
-        run: |
-          {
-            echo "## CLI override sweep - shard ${{ matrix.shard }}/2"
-            grep -E "\[override sweep" sweep.log || echo "no stage summaries (see log)"
-            echo
-            grep -E "^(=+ )?[0-9]+ (passed|failed)" sweep.log | tail -1 || true
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Upload the override report
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: override-report-${{ github.run_id }}-shard${{ matrix.shard }}
-          path: |
-            orca-test-repo/.pytest_cache/override_report.json
-            sweep.log
-          if-no-files-found: warn
-          retention-days: 30
-
-      # The sweep step is continue-on-error so the summary and artifact steps
-      # above still run on a failure - without this the job would then report
-      # success, and a shard that measured nothing would look identical to a
-      # healthy one.
-      - name: Fail the job if the sweep failed
-        if: steps.run.outcome == 'failure'
-        run: |
-          echo "the override sweep failed - see the job summary and the uploaded report" >&2
-          exit 1

.github/workflows/parity.yml

@@ -1,144 +0,0 @@
-# GUI-vs-CLI parity check. Runs the parity harness from
-# OrcaSlicer/orca-test-repo (parity/) against the latest successful Linux
-# AppImage build of this repo. Metrics-only: the job never gates - its
-# product is scorecard.json / report.md, with the count of NEW divergences
-# (differences not in the harness's known-differences ledger) as the
-# headline number in the job summary.
-name: GUI-CLI Parity
-
-on:
-  # temporary, for pre-merge branch testing: workflow_dispatch only works once
-  # the workflow exists on the default branch, but push events run the
-  # workflow from the pushed ref. Remove this trigger when merging to main.
-  push:
-    branches: ["hanif/parity-harness"]
-  schedule:
-    - cron: "30 18 * * *"
-  workflow_dispatch:
-    inputs:
-      fixtures:
-        description: "space-separated fixture ids (empty = all)"
-        required: false
-        default: ""
-      test_repo_ref:
-        description: "orca-test-repo ref to run"
-        required: false
-        default: "cli-test-suite"
-      build_branch:
-        description: "branch whose latest successful build_all artifact to slice with"
-        required: false
-        default: "main"
-      cli_presets:
-        description: "lane C preset handling: flat = flatten inherits (clean parity), raw = leaf as-is (measures the CLI's unresolved-inherits behavior, expect large divergence on unfixed builds)"
-        required: false
-        default: "flat"
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  parity:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 180
-    steps:
-      - name: Find the latest successful Linux build
-        id: build
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          gh run list --workflow build_all.yml \
-            --branch "${{ github.event.inputs.build_branch || 'main' }}" \
-            --status success --limit 1 --json databaseId,headSha \
-            --jq '"run_id=\(.[0].databaseId)\nhead_sha=\(.[0].headSha)"' \
-            >> "$GITHUB_OUTPUT"
-          cat "$GITHUB_OUTPUT"
-
-      - name: Check out the parity test suite
-        uses: actions/checkout@v5
-        with:
-          repository: OrcaSlicer/orca-test-repo
-          # temporary fallback for push-triggered branch testing (inputs are
-          # empty on push): restore to 'cli-test-suite' when merging to main
-          ref: ${{ github.event.inputs.test_repo_ref || 'hanif/parity-harness' }}
-          path: orca-test-repo
-
-      # the AppImage ships only packed .opc preset caches, no profile JSONs,
-      # so resources/profiles must come from the source tree at the SAME sha
-      # the artifact was built from
-      - name: Check out OrcaSlicer sources at the build's sha
-        uses: actions/checkout@v5
-        with:
-          ref: ${{ steps.build.outputs.head_sha }}
-          path: slicer
-
-      - name: Download and extract the Linux AppImage
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          gh run download "${{ steps.build.outputs.run_id }}" --dir appimage \
-            --pattern "OrcaSlicer_Linux_ubuntu_2404*"
-          # prefer the x86_64 artifact (amd64 is historically unsuffixed)
-          appimage=$(find appimage -name "*.AppImage" ! -name "*aarch64*" | head -1)
-          [ -n "$appimage" ] || { echo "no AppImage found"; ls -R appimage; exit 1; }
-          chmod +x "$appimage"
-          "$appimage" --appimage-extract > /dev/null
-          # the bare binary misses bundled libs (libavcodec etc.) - use AppRun,
-          # which sets up the AppImage's library paths and forwards arguments
-          [ -x squashfs-root/AppRun ] || { echo "no AppRun in AppImage"; exit 1; }
-          echo "ORCA_BIN=$PWD/squashfs-root/AppRun" >> "$GITHUB_ENV"
-          echo "ORCA_SLICER_ROOT=$PWD/slicer" >> "$GITHUB_ENV"
-
-      - name: Install display tooling for the GUI lanes
-        run: |
-          sudo apt-get update
-          # the AppImage's orca-slicer-env preflight requires host OpenGL and
-          # WebKitGTK 4.1 runtimes; everything else ships in the AppImage
-          sudo apt-get install -y --no-install-recommends \
-            xvfb xdotool imagemagick openbox mesa-utils \
-            libopengl0 libglu1-mesa libgl1 libegl1 libwebkit2gtk-4.1-0
-
-      - name: Run the parity harness
-        id: run
-        continue-on-error: true
-        run: |
-          set -euo pipefail
-          fixtures=""
-          for f in ${{ github.event.inputs.fixtures || '' }}; do
-            fixtures="$fixtures --fixture $f"
-          done
-          # 2 concurrent GUI displays: measured ~1.5 cores peak / ~1.9 GB on
-          # this 4-vCPU / 16 GB runner (3+ would contend); each fixture is
-          # fully isolated so this is correctness-neutral
-          python3 orca-test-repo/parity/run_parity.py \
-            --slicer-root "$ORCA_SLICER_ROOT" --bin "$ORCA_BIN" \
-            --cli-presets "${{ github.event.inputs.cli_presets || 'flat' }}" \
-            --gui-workers 2 \
-            --out "$PWD/parity-out" $fixtures
-
-      - name: Publish job summary
-        if: always()
-        run: |
-          if [ -f parity-out/report.md ]; then
-            cat parity-out/report.md >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "harness produced no report (see logs)" >> "$GITHUB_STEP_SUMMARY"
-          fi
-
-      - name: Prune bulky per-lane state before upload
-        if: always()
-        run: |
-          rm -rf parity-out/*/seed parity-out/*/datadir-* || true
-
-      - name: Upload scorecard and evidence
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: parity-scorecard-${{ github.run_id }}
-          path: parity-out/
-          if-no-files-found: warn
-          retention-days: 30

src/slic3r/plugin/PluginAuditManager.cpp

@@ -367,6 +367,65 @@ bool PluginAuditManager::is_denied_path_keyword(const boost::filesystem::path& c
     return false;
 }
 
+bool PluginAuditManager::is_denied_path_keyword_below_root(const boost::filesystem::path& candidate,
+                                                            const boost::filesystem::path& allowed_root) const
+{
+    namespace fs = boost::filesystem;
+
+    boost::system::error_code ec;
+    fs::path canon_candidate = fs::weakly_canonical(candidate, ec);
+    if (ec) {
+        canon_candidate = fs::absolute(candidate, ec).lexically_normal();
+        if (ec)
+            canon_candidate = candidate;
+    }
+
+    fs::path canon_root = fs::weakly_canonical(allowed_root, ec);
+    if (ec) {
+        canon_root = fs::absolute(allowed_root, ec).lexically_normal();
+        if (ec)
+            canon_root = allowed_root;
+    }
+
+    auto cand_it  = canon_candidate.begin();
+    const auto cand_end = canon_candidate.end();
+    auto root_it  = canon_root.begin();
+    const auto root_end = canon_root.end();
+    const auto same_component = [](const fs::path& lhs, const fs::path& rhs) {
+#ifdef _WIN32
+        return boost::algorithm::iequals(lhs.native(), rhs.native());
+#else
+        return lhs == rhs;
+#endif
+    };
+
+    while (root_it != root_end && cand_it != cand_end && same_component(*root_it, *cand_it)) {
+        ++root_it;
+        ++cand_it;
+    }
+
+    // This is normally guaranteed by the caller. Falling back to the complete path keeps this
+    // helper safe if a future caller passes a root that does not contain the candidate.
+    if (root_it != root_end)
+        cand_it = canon_candidate.begin();
+
+    std::lock_guard<std::mutex> lock(m_mutex);
+    if (m_denied_path_keywords.empty())
+        return false;
+
+    for (auto component = cand_it; component != cand_end; ++component) {
+        std::string name = component->string();
+        if (name.empty())
+            continue;
+        std::transform(name.begin(), name.end(), name.begin(), [](unsigned char c) { return std::tolower(c); });
+        for (const auto& keyword : m_denied_path_keywords) {
+            if (name.find(keyword) != std::string::npos)
+                return true;
+        }
+    }
+    return false;
+}
+
 bool PluginAuditManager::is_denied_path(const boost::filesystem::path& candidate) const
 {
     return is_denied_filename(candidate) || is_denied_path_keyword(candidate);
@@ -385,21 +444,6 @@ AuditDecision PluginAuditManager::check_path_access(const boost::filesystem::pat
     if (plugin_key.empty())
         return {true, ""}; // not running inside a plugin context
 
-    // Denied filenames/keywords are checked before the allowed roots.  The app config and the
-    // cloud refresh token live directly inside data_dir(), which is a global allowed root, and
-    // the bundled TLS client cert lives inside resources_dir(), a read-only global allowed
-    // root, so a deny placed any lower would be unreachable.
-    if (is_denied_filename(path)) {
-        BOOST_LOG_TRIVIAL(warning) << "[AUDIT] block path=" << path.string() << " is_write=" << is_write
-                                   << " plugin=" << plugin_key << " reason=denied filename";
-        return {false, "denied filename"};
-    }
-    if (is_denied_path_keyword(path)) {
-        BOOST_LOG_TRIVIAL(warning) << "[AUDIT] block path=" << path.string() << " is_write=" << is_write
-                                   << " plugin=" << plugin_key << " reason=denied path keyword";
-        return {false, "denied path keyword"};
-    }
-
     namespace fs = boost::filesystem;
     fs::path candidate = path;
 
@@ -411,24 +455,60 @@ AuditDecision PluginAuditManager::check_path_access(const boost::filesystem::pat
             candidate = absolute_candidate;
     }
 
-    // A root that doesn't allow writes only matches a read-shaped request; a write/create/
-    // delete-shaped one falls through to "outside allowed root" for that root even though the
-    // path is physically inside it.
-    for (const auto& root : m_scoped_allowed_roots) {
-        if ((!is_write || root.allow_write) && is_inside_allowed_root(candidate, root.path)) {
-            return {true, ""};
+    // A plugin's storage is its private application data. It may use any filenames and
+    // directory names there, including names that match the broad secret/config/certificate
+    // keyword rules. The storage container is below data_dir(), but is checked explicitly so
+    // this exemption also bypasses the exact host-filename deny list.
+    const fs::path plugin_storage_root = fs::path(get_orca_plugins_dir()) / "plugin_data";
+    if (is_inside_allowed_root(candidate, plugin_storage_root))
+        return {true, ""};
+
+    // Host-owned protected files remain denied even though data_dir() is a global allowed root.
+    if (is_denied_filename(candidate)) {
+        BOOST_LOG_TRIVIAL(warning) << "[AUDIT] block path=" << path.string() << " is_write=" << is_write
+                                   << " plugin=" << plugin_key << " reason=denied filename";
+        return {false, "denied filename"};
+    }
+
+    // Find the most-specific matching root. A root that doesn't allow writes only matches a
+    // read-shaped request; a write/create/delete-shaped one falls through for that root even
+    // though the path is physically inside it.
+    bool     has_allowed_root = false;
+    fs::path matched_root;
+    const auto consider_root = [&](const AllowedRoot& root) {
+        if ((!is_write || root.allow_write) && is_inside_allowed_root(candidate, root.path) &&
+            (!has_allowed_root || is_inside_allowed_root(root.path, matched_root))) {
+            has_allowed_root = true;
+            matched_root     = root.path;
         }
+    };
+
+    for (const auto& root : m_scoped_allowed_roots) {
+        consider_root(root);
     }
 
     {
         std::lock_guard<std::mutex> lock(m_mutex);
         for (const auto& root : m_global_allowed_roots) {
-            if ((!is_write || root.allow_write) && is_inside_allowed_root(candidate, root.path)) {
-                return {true, ""};
-            }
+            consider_root(root);
         }
     }
 
+    if (has_allowed_root) {
+        if (is_denied_path_keyword_below_root(candidate, matched_root)) {
+            BOOST_LOG_TRIVIAL(warning) << "[AUDIT] block path=" << path.string() << " is_write=" << is_write
+                                       << " plugin=" << plugin_key << " reason=denied path keyword";
+            return {false, "denied path keyword"};
+        }
+        return {true, ""};
+    }
+
+    if (is_denied_path_keyword(candidate)) {
+        BOOST_LOG_TRIVIAL(warning) << "[AUDIT] block path=" << path.string() << " is_write=" << is_write
+                                   << " plugin=" << plugin_key << " reason=denied path keyword";
+        return {false, "denied path keyword"};
+    }
+
     BOOST_LOG_TRIVIAL(warning) << "[AUDIT] block path=" << candidate.string() << " is_write=" << is_write
                                << " plugin=" << plugin_key;
     return {false, "outside allowed root"};
@@ -896,15 +976,17 @@ int PluginAuditManager::audit_hook(const char* event, PyObject* args, void* user
     const bool                      fs_category = is_fs_category(event_type);
     const std::vector<std::string>  targets      = PluginAuditDetail::audit_targets(event_name, event_type, args);
 
-    // A denied path (secrets, certificates, config files -- see is_denied_path) is an
-    // unconditional block: checked before the ancestor-cascade check below, so a cascade
-    // approval recorded for an unrelated action can never launder access to one, and before
-    // the allowed-root shortcut further down, so an allowed root (e.g. the read-only resources
-    // folder) cannot make a denied path underneath it reachable.
+    // Host-owned protected filenames and keyword matches below an allowed root are unconditional
+    // blocks: checked before the ancestor-cascade check below, so a cascade approval recorded
+    // for an unrelated action can never launder access to one. Plugin storage is exempted by
+    // check_path_access because it is the plugin's own application-data tree.
     if (fs_category) {
+        const bool is_write = event_type != AuditEventCategory::FsRead;
         for (const auto& target : targets) {
-            if (mgr->is_denied_path(boost::filesystem::path(target)))
-                return PluginAuditDetail::report_denied(*mgr, event_name, {false, "denied path"});
+            const AuditDecision decision = mgr->check_path_access(boost::filesystem::path(target), is_write);
+            if (!decision.allowed &&
+                (decision.reason == "denied filename" || decision.reason == "denied path keyword"))
+                return PluginAuditDetail::report_denied(*mgr, event_name, decision);
         }
     }
 
@@ -975,10 +1057,10 @@ void PluginAuditManager::install_hook()
     for (const auto& name : default_denied_filenames())
         add_denied_filename(name);
 
-    // Categorical denies on top of the exact-name list above: no path a plugin can reach may
-    // contain a "secret", "cert"(ificate), or "conf"(ig) path component, regardless of which
-    // allowed root it happens to sit inside. default_denied_path_keywords() is the single
-    // source of this list; the tests seed from it too.
+    // Categorical denies on top of the exact-name list above: host-owned paths below an allowed
+    // root may not contain a "secret", "cert"(ificate), or "conf"(ig) path component. Parent
+    // components of the allowed root are trusted, and plugin storage is fully exempt.
+    // default_denied_path_keywords() is the single source of this list; the tests seed from it too.
     for (const auto& keyword : default_denied_path_keywords())
         add_denied_path_keyword(keyword);
 

src/slic3r/plugin/PluginAuditManager.hpp

@@ -125,9 +125,9 @@ public:
     bool is_denied_path(const boost::filesystem::path& candidate) const;
 
     // --- policy checks ---
-    // Shared core for every audited filesystem event.  The deny checks are consulted above the
-    // allowed roots, so a denied path is blocked even when it sits inside an allowed root (e.g.
-    // data_dir(), which is a global allowed root).
+    // Shared core for every audited filesystem event. A plugin's own storage tree is fully
+    // trusted; host-owned protected files remain denied, and broad keyword denies are evaluated
+    // below the most-specific allowed root so Linux's .config parent does not block that root.
     AuditDecision check_path_access(const boost::filesystem::path& candidate, bool is_write);
     AuditDecision check_open(const std::string& path, const std::string& mode);
 
@@ -163,6 +163,12 @@ private:
 
     static int audit_hook(const char* event, PyObject* args, void* user_data);
 
+    // Check keyword denies while ignoring the components that make up an already-approved root.
+    // This keeps a root such as ~/.config/OrcaSlicer usable while still denying config/secret/
+    // certificate-like paths below that root.
+    bool is_denied_path_keyword_below_root(const boost::filesystem::path& candidate,
+                                           const boost::filesystem::path& allowed_root) const;
+
     static thread_local std::string                   m_current_plugin_key;
     static thread_local std::string                   m_current_capability_name;
     static thread_local std::vector<AllowedRoot>       m_scoped_allowed_roots;

tests/slic3rutils/test_plugin_audit.cpp

@@ -184,6 +184,43 @@ TEST_CASE("Plugin audit deny beats a plugin's own scoped root", "[audit]")
     }
 }
 
+TEST_CASE("Plugin audit allows an allowed root below a configuration directory", "[audit][Regression]")
+{
+    ScopedDataDir data_dir_guard("plugin-audit-config-parent");
+    seed_denied_names();
+    seed_denied_keywords();
+
+    // This mirrors Linux's default ~/.config/OrcaSlicer layout without depending on the host's
+    // actual home directory or XDG_CONFIG_HOME setting.
+    const fs::path linux_data_dir = data_dir_guard.dir / ".config" / "OrcaSlicer";
+    const fs::path plugin_storage = linux_data_dir / "orca_plugins" / "plugin_data" / "test_plugin";
+    fs::create_directories(plugin_storage);
+    set_data_dir(linux_data_dir.string());
+
+    PluginAuditManager& mgr = PluginAuditManager::instance();
+    mgr.add_global_allowed_root(data_dir());
+    ScopedPluginAuditContext ctx("test_plugin", "");
+
+    SECTION("plugin storage remains accessible")
+    {
+        CHECK(mgr.check_open((plugin_storage / "state.json").string(), "w").allowed);
+    }
+
+    SECTION("all plugin storage names remain accessible")
+    {
+        CHECK(mgr.check_open((plugin_storage / "config" / "settings.json").string(), "r").allowed);
+        CHECK(mgr.check_open((plugin_storage / "secret" / "token.txt").string(), "w").allowed);
+        CHECK(mgr.check_open((plugin_storage / (SLIC3R_APP_KEY ".conf")).string(), "r").allowed);
+    }
+
+    SECTION("host-owned protected files remain denied")
+    {
+        const AuditDecision decision = mgr.check_open((linux_data_dir / (SLIC3R_APP_KEY ".conf")).string(), "r");
+        CHECK_FALSE(decision.allowed);
+        CHECK(decision.reason == "denied filename");
+    }
+}
+
 TEST_CASE("Plugin audit does not constrain non-plugin code", "[audit]")
 {
     ScopedDataDir data_dir_guard("plugin-audit-noplugin");