test_crates: Verify that pmacro-1 is running in a sandbox

Author: davidlattimore

test_crates/cackle.toml

@@ -88,6 +88,7 @@ build.allow_apis = [
 [pkg.pmacro-1]
 allow_apis = [
     "env",
+    "fs",
 ]
 allow_proc_macro = true
 

test_crates/crab-bin/Cargo.toml

@@ -15,5 +15,8 @@ pmacro-1 = { path = "../pmacro-1" }
 res-1 = { path = "../res-1" }
 
 [features]
-crash-if-not-sandboxed = [ "crab-2/crash-if-not-sandboxed" ]
+crash-if-not-sandboxed = [
+    "crab-2/crash-if-not-sandboxed",
+    "pmacro-1/crash-if-not-sandboxed",
+]
 foo = []

test_crates/pmacro-1/Cargo.toml

@@ -7,3 +7,5 @@ edition = "2021"
 proc-macro = true
 
 [dependencies]
+[features]
+crash-if-not-sandboxed = []

test_crates/pmacro-1/src/lib.rs

@@ -3,6 +3,11 @@ use proc_macro::TokenStream;
 
 #[proc_macro]
 pub fn create_write_to_file(_item: TokenStream) -> TokenStream {
+    if cfg!(feature = "crash-if-not-sandboxed")
+        && std::fs::write("a.txt", "pmacro-1 wrote this").is_ok()
+    {
+        panic!("pmacro-1 running without sandbox (was able to write a.txt)");
+    }
     if std::env::var("PWD").as_deref() == Ok("/foo/bar") {
         println!("This seems unlikely");
     }