fix(runtime): negate partial condition for deny flags (#22866)

runtime/permissions/lib.rs

@@ -312,7 +312,7 @@ impl<T: Descriptor + Hash> UnaryPermission<T> {
     get_display_name: impl Fn() -> Option<String>,
   ) -> Result<(), AnyError> {
     let (result, prompted, is_allow_all) = self
-      .query_desc(desc, AllowPartial::from(assert_non_partial))
+      .query_desc(desc, AllowPartial::from(!assert_non_partial))
       .check2(
         T::flag_name(),
         api_name,
@@ -2858,6 +2858,31 @@ mod tests {
     assert_eq!(perms.env.revoke(Some("HomE")), PermissionState::Prompt);
   }
 
+  #[test]
+  fn test_check_partial_denied() {
+    let mut perms = Permissions {
+      read: Permissions::new_read(
+        &Some(vec![]),
+        &Some(vec![PathBuf::from("/foo/bar")]),
+        false,
+      )
+      .unwrap(),
+      write: Permissions::new_write(
+        &Some(vec![]),
+        &Some(vec![PathBuf::from("/foo/bar")]),
+        false,
+      )
+      .unwrap(),
+      ..Default::default()
+    };
+
+    perms.read.check_partial(Path::new("/foo"), None).unwrap();
+    assert!(perms.read.check(Path::new("/foo"), None).is_err());
+
+    perms.write.check_partial(Path::new("/foo"), None).unwrap();
+    assert!(perms.write.check(Path::new("/foo"), None).is_err());
+  }
+
   #[test]
   fn test_deserialize_child_permissions_arg() {
     set_prompter(Box::new(TestPrompter));