test(cua-driver): verify live Windows executable grants

Author: f-trycua

libs/cua-driver/rust/crates/platform-windows/src/browser_platform.rs

@@ -1966,6 +1966,43 @@ mod tests {
         assert_eq!(executable.as_deref(), Some(expected.as_str()));
     }
 
+    #[tokio::test]
+    async fn live_executable_grant_matches_without_installed_app_identity() {
+        use cua_driver_core::session_manifest::load_manifest;
+        use std::io::Write;
+
+        let pid = i64::from(std::process::id());
+        let fingerprint = WindowsBrowserPlatform::default()
+            .process_fingerprint(pid)
+            .await
+            .expect("live Windows process identity");
+        let directory = tempfile::tempdir().unwrap();
+        for (executable, allowed) in [
+            (std::env::current_exe().unwrap(), true),
+            (directory.path().join("ungranted-application.exe"), false),
+        ] {
+            let mut file = tempfile::NamedTempFile::new().unwrap();
+            write!(file, "version: 3\nallow:\n  tools: [get_window_state, click]\nresources:\n  apps:\n    - executable: {}\n      windows: all\n",
+                serde_json::to_string(&executable).unwrap()).unwrap();
+            let manifest = load_manifest(file.path()).unwrap();
+            for (adapter, kind) in [
+                ("private_observation", "window"),
+                ("desktop_input", "window_input"),
+            ] {
+                let resource = serde_json::json!({
+                    "kind": kind,
+                    "pid": pid,
+                    "window_id": 7,
+                    "fingerprint": fingerprint,
+                    "bundle_id": null,
+                    "launch_path": null,
+                });
+                assert_eq!(manifest.authorize_protected_resource(adapter, &resource).is_ok(), allowed,
+                    "{adapter} must use the live executable fingerprint even without an installed-app match");
+            }
+        }
+    }
+
     #[test]
     fn isolated_browser_candidates_are_vendor_attested_protected_installs() {
         let candidates = isolated_browser_candidates_from_roots(