refactor: rework parameter validation in vim.secure.trust() (#21223)

2 files changed, 14 insertions, 6 deletions

diff --git a/runtime/lua/vim/secure.lua b/runtime/lua/vim/secure.lua
index 0b4d7d53a2..08b1ff871c 100644
--- a/runtime/lua/vim/secure.lua
+++ b/runtime/lua/vim/secure.lua
@@ -148,19 +148,23 @@ function M.trust(opts)
   local bufnr = opts.bufnr
   local action = opts.action
 
-  if path and bufnr then
-    error('path and bufnr are mutually exclusive', 2)
+  assert(not path or not bufnr, '"path" and "bufnr" are mutually exclusive')
+
+  if action == 'allow' then
+    assert(not path, '"path" is not valid when action is "allow"')
   end
 
   local fullpath
   if path then
     fullpath = vim.loop.fs_realpath(vim.fs.normalize(path))
-  else
+  elseif bufnr then
     local bufname = vim.api.nvim_buf_get_name(bufnr)
     if bufname == '' then
       return false, 'buffer is not associated with a file'
     end
     fullpath = vim.loop.fs_realpath(vim.fs.normalize(bufname))
+  else
+    error('one of "path" or "bufnr" is required')
   end
 
   if not fullpath then
@@ -170,8 +174,6 @@ function M.trust(opts)
   local trust = read_trust()
 
   if action == 'allow' then
-    assert(bufnr, 'bufnr is required when action is "allow"')
-
     local newline = vim.bo[bufnr].fileformat == 'unix' and '\n' or '\r\n'
     local contents = table.concat(vim.api.nvim_buf_get_lines(bufnr, 0, -1, false), newline)
     if vim.bo[bufnr].endofline then
diff --git a/test/functional/lua/secure_spec.lua b/test/functional/lua/secure_spec.lua
index 46ca2bba8f..6885253998 100644
--- a/test/functional/lua/secure_spec.lua
+++ b/test/functional/lua/secure_spec.lua
@@ -12,6 +12,7 @@ local feed_command = helpers.feed_command
 local feed = helpers.feed
 local funcs = helpers.funcs
 local pcall_err = helpers.pcall_err
+local matches = helpers.matches
 
 describe('vim.secure', function()
   describe('read()', function()
@@ -189,10 +190,15 @@ describe('vim.secure', function()
     end)
 
     it('returns error when passing both path and bufnr', function()
-      eq('path and bufnr are mutually exclusive',
+      matches('"path" and "bufnr" are mutually exclusive',
         pcall_err(exec_lua, [[vim.secure.trust({action='deny', bufnr=0, path='test_file'})]]))
     end)
 
+    it('returns error when passing neither path or bufnr', function()
+      matches('one of "path" or "bufnr" is required',
+        pcall_err(exec_lua, [[vim.secure.trust({action='deny'})]]))
+    end)
+
     it('trust then deny then remove a file using bufnr', function()
       local cwd = funcs.getcwd()
       local hash = funcs.sha256(helpers.read_file('test_file'))