// Package pathutil contains lexical path-policy helpers. It does not replace
// descriptor-anchored filesystem access for security-sensitive operations.
package pathutil

import (
	"path/filepath"
	"strings"
)

// Within reports whether path is parent itself or a lexical descendant.
func Within(path, parent string) bool {
	relative, err := filepath.Rel(parent, path)
	return err == nil && relative != ".." && !strings.HasPrefix(relative, ".."+string(filepath.Separator))
}