fix(auth): close CURRENT publication race

backend/src/auth/runtime-projection.ts

@@ -210,15 +210,22 @@ function entries(path: string, uid: number, expected: readonly string[]): void {
 function replaced(before: Identity, after: Identity): boolean {
   return before.dev !== after.dev || before.ino !== after.ino;
 }
-function rootIdentityAtPathAndDescriptor(
+interface RootObservation {
+  descriptor: Identity;
+  path: Identity;
+}
+function sameObject(left: Identity, right: Identity): boolean {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+function observeRootAtPathAndDescriptor(
   root: string,
   openedRoot: { fd: number; identity: Identity },
   uid: number,
-): Identity {
+): RootObservation {
   const openedAfter = directory(fstatSync(openedRoot.fd) as Stats, uid);
   const pathAfter = directory(lstatSync(root) as Stats, uid);
-  if (!same(openedAfter, pathAfter)) throw invalid();
-  return openedAfter;
+  if (!sameObject(openedAfter, pathAfter)) throw invalid();
+  return { descriptor: openedAfter, path: pathAfter };
 }
 function validateRootAndCurrentAfterLoad(
   root: string,
@@ -227,7 +234,7 @@ function validateRootAndCurrentAfterLoad(
   selectedCurrent: Identity,
   uid: number,
 ): void {
-  const rootBeforeCurrent = rootIdentityAtPathAndDescriptor(
+  const rootBeforeCurrent = observeRootAtPathAndDescriptor(
     root,
     openedRoot,
     uid,
@@ -237,14 +244,16 @@ function validateRootAndCurrentAfterLoad(
     uid,
     MAX_SELECTOR_BYTES,
   );
-  const rootAfterCurrent = rootIdentityAtPathAndDescriptor(
+  const rootAfterCurrent = observeRootAtPathAndDescriptor(
     root,
     openedRoot,
     uid,
   );
   if (
-    !same(openedRoot.identity, rootBeforeCurrent) ||
-    !same(rootBeforeCurrent, rootAfterCurrent)
+    !same(openedRoot.identity, rootBeforeCurrent.descriptor) ||
+    !same(rootBeforeCurrent.descriptor, rootBeforeCurrent.path) ||
+    !same(rootBeforeCurrent.path, rootAfterCurrent.descriptor) ||
+    !same(rootAfterCurrent.descriptor, rootAfterCurrent.path)
   ) {
     const latestCurrent = regular(
       lstatSync(currentPath) as Stats,