Add a blaze option for jspb_proto_library forwarding proto_library's exports

RELNOTES: N/A
PiperOrigin-RevId: 214849353
diff --git a/src/main/java/com/google/devtools/build/lib/rules/proto/ProtoCompileActionBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/proto/ProtoCompileActionBuilder.java
index 9f2217c..9c9a8c9 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/proto/ProtoCompileActionBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/proto/ProtoCompileActionBuilder.java
@@ -79,6 +79,7 @@
   private boolean hasServices;
   private Iterable<String> additionalCommandLineArguments;
   private Iterable<FilesToRunProvider> additionalTools;
+  private boolean checkStrictImportPublic;
 
   public ProtoCompileActionBuilder allowServices(boolean hasServices) {
     this.hasServices = hasServices;
@@ -123,6 +124,11 @@
     return this;
   }
 
+  public ProtoCompileActionBuilder checkStrictImportPublic(boolean checkStrictImportPublic) {
+    this.checkStrictImportPublic = checkStrictImportPublic;
+    return this;
+  }
+
   public ProtoCompileActionBuilder(
       RuleContext ruleContext,
       SupportData supportData,
@@ -315,6 +321,19 @@
     if (!hasServices) {
       result.add("--disallow_services");
     }
+    if (checkStrictImportPublic) {
+      NestedSet<Artifact> protosInExports = supportData.getProtosInExports();
+      if (protosInExports.isEmpty()) {
+        // This line is necessary to trigger the check.
+        result.add("--allowed_public_imports=");
+      } else {
+        result.addAll(
+            "--allowed_public_imports",
+            VectorArg.join(":")
+                .each(protosInExports)
+                .mapped(new ExpandToPathFn(supportData.getTransitiveProtoPathFlags())));
+      }
+    }
 
     if (additionalCommandLineArguments != null) {
       result.addAll(ImmutableList.copyOf(additionalCommandLineArguments));