.NET File Access Control & TDD

A skill for building a .NET Standard 2.0 application that determines user principal permissions for file and directory operations (create, read, update, delete) on Windows 10/11 machines, following strict test-driven development practices.

What This Skill Does

This skill guides the development of a security-focused file system access control application using:

Instructions

Development Philosophy

1. **First Principles Approach**

- Break down all tasks into atomic units

- Complete tasks procedurally in order

- Confirm completion before proceeding to next task

- Never skip steps or assume functionality

2. **Test-Driven Development (TDD)**

- Write failing unit tests first (red light)

- Implement minimum code to pass tests (green light)

- Refactor while keeping tests green

- No feature is complete without passing unit tests

3. **Requirements Tracking**

- Maintain requirements.md with task statuses: `[Pending]`, `[In Process]`, `[Completed]`

- Update status before and after each task

- All stakeholders must confirm completion before marking `[Completed]`

Core Requirements

#### 1. User Permission Validation

**Priority 1: Directory Access Rights**

**Priority 2: File-Level Access Rights**

**Priority 3: Event Logging**

- Timestamp

- User principal name

- Attempted operation (Create/Read/Update/Delete)

- Target path (file or directory)

- Denial reason

**Priority 4: Safe Operation Execution**

#### 2. Enhancement Features

**User Principal Lookup**

Implementation Guidelines

1. **Project Structure**

```

/src

/Core # Permission checking logic

/FileOps # CRUD operations

/Logging # Event logging

/tests

/Core.Tests

/FileOps.Tests

/Logging.Tests

requirements.md

```

2. **Key .NET APIs to Use**

- `System.Security.AccessControl.FileSecurity`

- `System.Security.AccessControl.DirectorySecurity`

- `System.Security.Principal.WindowsIdentity`

- `System.Security.Principal.WindowsPrincipal`

- `FileSystemAccessRule` and `FileSystemRights`

3. **TDD Workflow for Each Feature**

- Write unit test that fails (expected behavior)

- Run test, confirm failure (red light)

- Write minimum code to pass test

- Run test, confirm pass (green light)

- Refactor if needed, keep tests green

- Commit with descriptive message

4. **Commit Strategy**

- Commit before starting each modification (document intent)

- Commit after user confirms completion (document outcome)

- Use clear commit messages: "Add failing test for directory read permission check" or "Implement directory read permission validation"

5. **Testing Requirements**

- Unit tests for all permission check methods

- Unit tests for all CRUD operations

- Unit tests for logging functionality

- Mock file system and security APIs where appropriate

- Aim for >80% code coverage

Development Process

**For Each Task:**

1. Mark task as `[In Process]` in requirements.md

2. Write failing unit test(s) for the feature

3. Commit: "Add failing test for [feature]"

4. Implement minimum code to pass test

5. Run tests until green

6. Commit: "Implement [feature] with passing tests"

7. Request user confirmation of completion

8. Update requirements.md to `[Completed]`

9. Proceed to next task

Security Considerations

Error Handling

- `UnauthorizedAccessException`

- `SecurityException`

- `IOException`

- `ArgumentException` (invalid paths/principals)

Example Usage

Checking Directory Permissions

```csharp

// Test first

[Test]

public void CheckDirectoryAccess_CurrentUser_HasReadPermission_ReturnsTrue()

{

// Arrange

var checker = new PermissionChecker();

var testPath = @"C:\TestDirectory";

// Act

var hasAccess = checker.HasDirectoryAccess(testPath, FileSystemRights.Read);

// Assert

Assert.IsTrue(hasAccess);

}

// Then implement

public class PermissionChecker

{

public bool HasDirectoryAccess(string path, FileSystemRights rights)

{

// Implementation after test fails

}

}

```

Logging Access Denial

```csharp

[Test]

public void LogAccessDenial_ValidParameters_CreatesLogEntry()

{

// Arrange

var logger = new AccessLogger();

var testPath = @"C:\SecureFile.txt";

// Act

logger.LogDenial(testPath, FileOperation.Read, "Insufficient permissions");

// Assert

var lastEntry = logger.GetLastEntry();

Assert.AreEqual(testPath, lastEntry.Path);

Assert.AreEqual(FileOperation.Read, lastEntry.Operation);

}

```

Constraints

Notes