Workspace trust - calculate trust before extension host starts

src/vs/platform/workspace/common/workspaceTrust.ts

@@ -40,6 +40,7 @@ export interface IWorkspaceTrustManagementService {
 	onDidChangeTrust: Event<boolean>;
 	onDidChangeTrustedFolders: Event<void>;
 
+	readonly workspaceResolved: Promise<void>;
 	readonly workspaceTrustInitialized: Promise<void>;
 
 	acceptsOutOfWorkspaceFiles: boolean;

src/vs/workbench/contrib/extensions/browser/extensionEnablementWorkspaceTrustTransitionParticipant.ts

@@ -21,6 +21,10 @@ export class ExtensionEnablementWorkspaceTrustTransitionParticipant extends Disp
 		super();
 
 		if (isWorkspaceTrustEnabled(configurationService)) {
+			// The extension enablement participant will be registered only after the
+			// workspace trust state has been initialized. There is no need to execute
+			// the participant as part of the initialization process, as the workspace
+			// trust state is initialized before starting the extension host.
 			workspaceTrustManagementService.workspaceTrustInitialized.then(() => {
 				const workspaceTrustTransitionParticipant = new class implements IWorkspaceTrustTransitionParticipant {
 					async participate(trusted: boolean): Promise<void> {
@@ -36,12 +40,6 @@ export class ExtensionEnablementWorkspaceTrustTransitionParticipant extends Disp
 					}
 				};
 
-				// If the workspace has already transitioned to a trusted state, we will manually run the
-				// workspace trust transition participants as they did not run when the transition happened.
-				if (workspaceTrustManagementService.isWorkpaceTrusted()) {
-					workspaceTrustTransitionParticipant.participate(true);
-				}
-
 				// Execute BEFORE the workspace trust transition completes
 				this._register(workspaceTrustManagementService.addWorkspaceTrustTransitionParticipant(workspaceTrustTransitionParticipant));
 			});

src/vs/workbench/contrib/workspace/browser/workspace.contribution.ts

@@ -45,8 +45,6 @@ import { IHostService } from 'vs/workbench/services/host/browser/host';
 import { IBannerItem, IBannerService } from 'vs/workbench/services/banner/browser/bannerService';
 import { isVirtualWorkspace } from 'vs/platform/remote/common/remoteHosts';
 import { EditorInput } from 'vs/workbench/common/editor/editorInput';
-import { IRemoteAuthorityResolverService } from 'vs/platform/remote/common/remoteAuthorityResolver';
-import { IWorkbenchEnvironmentService } from 'vs/workbench/services/environment/common/environmentService';
 
 const BANNER_RESTRICTED_MODE = 'workbench.banner.restrictedMode';
 const BANNER_VIRTUAL_WORKSPACE = 'workbench.banner.virtualWorkspace';
@@ -79,8 +77,6 @@ export class WorkspaceTrustRequestHandler extends Disposable implements IWorkben
 		@IStatusbarService private readonly statusbarService: IStatusbarService,
 		@IStorageService private readonly storageService: IStorageService,
 		@IWorkspaceTrustRequestService private readonly workspaceTrustRequestService: IWorkspaceTrustRequestService,
-		@IWorkbenchEnvironmentService private readonly workbenchEnvironmentService: IWorkbenchEnvironmentService,
-		@IRemoteAuthorityResolverService private readonly remoteAuthorityResolverService: IRemoteAuthorityResolverService,
 		@IBannerService private readonly bannerService: IBannerService,
 		@IHostService private readonly hostService: IHostService,
 	) {
@@ -92,11 +88,6 @@ export class WorkspaceTrustRequestHandler extends Disposable implements IWorkben
 
 			await this.workspaceTrustManagementService.workspaceTrustInitialized;
 
-			// Workaround until isTrusted from resolver is available pre-resolution
-			if (this.workbenchEnvironmentService.remoteAuthority) {
-				await this.remoteAuthorityResolverService.resolveAuthority(this.workbenchEnvironmentService.remoteAuthority);
-			}
-
 			if (isWorkspaceTrustEnabled(configurationService)) {
 				this.registerListeners();
 				this.createStatusbarEntry();

src/vs/workbench/services/extensions/electron-browser/extensionService.ts

@@ -353,9 +353,10 @@ export class ExtensionService extends AbstractExtensionService implements IExten
 				return localProcessExtensionHost.getCanonicalURI(remoteAuthority, uri);
 			});
 
-			// Now that the canonical URI provider has been registered, we
-			// need to wait for the trust state to be initialized
-			await this._workspaceTrustManagementService.workspaceTrustInitialized;
+			// Now that the canonical URI provider has been registered, we need to wait for the trust state to be
+			// calculated. The trust state will be used while resolving the authority, however the resolver can
+			// override the trust state through the resolver result.
+			await this._workspaceTrustManagementService.workspaceResolved;
 			let resolverResult: ResolverResult;
 
 			try {
@@ -396,7 +397,6 @@ export class ExtensionService extends AbstractExtensionService implements IExten
 				this._remoteAgentService.getEnvironment(),
 				this._remoteAgentService.scanExtensions()
 			]);
-			remoteExtensions = this._checkEnabledAndProposedAPI(remoteExtensions, false);
 
 			if (!remoteEnv) {
 				this._notificationService.notify({ severity: Severity.Error, message: nls.localize('getEnvironmentFailure', "Could not fetch remote environment") });
@@ -416,6 +416,11 @@ export class ExtensionService extends AbstractExtensionService implements IExten
 	}
 
 	private async _startLocalExtensionHost(remoteAuthority: string | undefined = undefined, remoteEnv: IRemoteAgentEnvironment | null = null, remoteExtensions: IExtensionDescription[] = []): Promise<void> {
+		// Ensure that the workspace trust state has been fully initialized so
+		// that the extension host can start with the correct set of extensions.
+		await this._workspaceTrustManagementService.workspaceTrustInitialized;
+
+		remoteExtensions = this._checkEnabledAndProposedAPI(remoteExtensions, false);
 		const localExtensions = this._checkEnabledAndProposedAPI(await this._scanAllLocalExtensions(), false);
 		this._runningLocation = this._runningLocationClassifier.determineRunningLocation(localExtensions, remoteExtensions);
 

src/vs/workbench/services/workspaces/common/workspaceTrust.ts

@@ -84,6 +84,8 @@ export class WorkspaceTrustManagementService extends Disposable implements IWork
 	private readonly storageKey = WORKSPACE_TRUST_STORAGE_KEY;
 
 	private _initialized: boolean;
+	private _workspaceResolvedPromise: Promise<void>;
+	private _workspaceResolvedPromiseResolve!: () => void;
 	private _workspaceTrustInitializedPromise: Promise<void>;
 	private _workspaceTrustInitializedPromiseResolve!: () => void;
 	private _remoteAuthority: ResolverResult | undefined;
@@ -113,6 +115,9 @@ export class WorkspaceTrustManagementService extends Disposable implements IWork
 
 		this._canonicalWorkspace = this.workspaceService.getWorkspace();
 		this._initialized = false;
+		this._workspaceResolvedPromise = new Promise((resolve) => {
+			this._workspaceResolvedPromiseResolve = resolve;
+		});
 		this._workspaceTrustInitializedPromise = new Promise((resolve) => {
 			this._workspaceTrustInitializedPromiseResolve = resolve;
 		});
@@ -134,7 +139,11 @@ export class WorkspaceTrustManagementService extends Disposable implements IWork
 		this.resolveCanonicalWorkspaceUris().then(async () => {
 			this._initialized = true;
 			await this.updateWorkspaceTrust();
-			this._workspaceTrustInitializedPromiseResolve();
+
+			this._workspaceResolvedPromiseResolve();
+			if (!this.environmentService.remoteAuthority) {
+				this._workspaceTrustInitializedPromiseResolve();
+			}
 		});
 
 		// Remote - resolve remote authority
@@ -143,6 +152,8 @@ export class WorkspaceTrustManagementService extends Disposable implements IWork
 				.then(async result => {
 					this._remoteAuthority = result;
 					await this.updateWorkspaceTrust();
+
+					this._workspaceTrustInitializedPromiseResolve();
 				});
 		}
 
@@ -335,6 +346,10 @@ export class WorkspaceTrustManagementService extends Disposable implements IWork
 
 	//#region public interface
 
+	get workspaceResolved(): Promise<void> {
+		return this._workspaceResolvedPromise;
+	}
+
 	get workspaceTrustInitialized(): Promise<void> {
 		return this._workspaceTrustInitializedPromise;
 	}

src/vs/workbench/services/workspaces/test/common/testWorkspaceTrustService.ts

@@ -71,6 +71,10 @@ export class TestWorkspaceTrustManagementService implements IWorkspaceTrustManag
 		return this.trusted;
 	}
 
+	get workspaceResolved(): Promise<void> {
+		return Promise.resolve();
+	}
+
 	get workspaceTrustInitialized(): Promise<void> {
 		return Promise.resolve();
 	}