Add Microsoft.Filesystem/ACL resource

[Steve Lee (SteveL-MSFT)]

Adds native Windows ACL management so DSC configurations can declaratively manage discretionary access control lists on files and folders without introducing another executable.

The existing file content resource is renamed and consolidated under file_dsc. Its original content commands remain compatible, while a new acl get|set|test command surface powers Microsoft.Filesystem/ACL. The resource accepts a keyed path and required DACL-only SDDL, uses Windows security descriptor APIs, and explicitly rejects owner, group, and SACL components it does not manage.

The build and packaging metadata now publishes file_dsc cross-platform and includes the ACL manifest only on Windows. Pester coverage verifies Allow and Deny ACE behavior on both files and folders, desired-state testing, unsupported SDDL validation, and the renamed project path.

Validation:

• ./build.ps1 -Project file_dsc -Clippy
• File resource Pester suite
• Build helper Pester tests

[Copilot]

🟡 Changes recommended

DACL protection flags are not applied, canonical schema requirements are unmet, and stale filecontent test invocations remain.

3 open findings

• Apply DACL protection state from SDDL control flags · New
• Reference the canonical _inDesiredState schema · New
• Add negative and DACL protection comparison tests · New

What changed in this PR

Adds native Windows DACL management while consolidating file resources under file_dsc.

Changes:

• Adds Microsoft.Filesystem/ACL.
• Renames and packages the file-content executable as file_dsc.
• Adds ACL and file-content Pester coverage.

File	Description
tests/​helpers.build.pester.tests.ps1	Updates renamed project paths.
resources/​file_dsc/​tests/​filesystem_acl.tests.ps1	Adds ACL integration tests.
resources/​file_dsc/​tests/​filecontent_test.tests.ps1	Adds content test coverage.
resources/​file_dsc/​tests/​filecontent_set.tests.ps1	Adds set-operation coverage.
resources/​file_dsc/​tests/​filecontent_get.tests.ps1	Uses the renamed executable.
resources/​file_dsc/​tests/​filecontent_export.tests.ps1	Adds export coverage.
resources/​file_dsc/​src/​types.rs	Defines ACL state input/output.
resources/​file_dsc/​src/​main.rs	Routes ACL subcommands.
resources/​file_dsc/​src/​file.rs	Implements file-content operations.
resources/​file_dsc/​src/​acl.rs	Implements Windows DACL operations.
resources/​file_dsc/​locales/​en-us.toml	Adds localized ACL messages.
resources/​file_dsc/​filesystem_acl.dsc.resource.json	Defines the ACL resource.
resources/​file_dsc/​filecontent.dsc.resource.json	References file_dsc.
resources/​file_dsc/​Cargo.toml	Renames the crate and adds Windows APIs.
resources/​file_dsc/​.project.data.json	Updates project packaging metadata.
data.build.json	Updates platform package contents.
Cargo.toml	Updates workspace membership.
Cargo.lock	Records renamed package dependencies.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

ACL error handling misclassifies inaccessible paths and validates unknown operations only after input parsing.

0 open findings

3 resolved since last review

• Apply DACL protection state from SDDL control flags
• Add negative and DACL protection comparison tests
• Reference the canonical _inDesiredState schema

Previously missed (2)

In code that hasn't changed since last review

Validate ACL operation before parsing input

resources/​file_dsc/​src/​main.rs:65

The ACL operation is validated only after input parsing and deserialization, so file_dsc acl typo reports “Missing --input argument” (and malformed input reports a JSON error) instead of the added “Unknown ACL operation” diagnostic. Reject unsupported operations before processing their input, matching the top-level command behavior.

Preserve access errors when checking ACL path existence

resources/​file_dsc/​src/​acl.rs:78

Path::exists() returns false when metadata lookup fails as well as when the path is absent, so an access-denied path is incorrectly reported as nonexistent. That is especially misleading for an ACL resource; preserve the OS error with try_exists() so callers can distinguish permissions failures from a missing target.

🧠 Review effort: Balanced