feat(server): activate projected authentication safely

2026-08-22 01:01:36 +02:00
parent 903c0b4de5
commit 3d9a9f0675
32 changed files with 1837 additions and 38 deletions
@@ -225,6 +225,24 @@ func TestEnsureFilesIncludesServerStorageLocations(t *testing.T) {
 	}
 }

+func TestEnsureFilesProjectedServerRefusesBeforeAnyWriteWhenNotRoot(t *testing.T) {
+	root := newProject(t, "projected server non-root")
+	setNonInteractiveAnswers(t, newExternalSecrets(t, root))
+	previous := effectiveUID
+	effectiveUID = func() int { return 1000 }
+	t.Cleanup(func() { effectiveUID = previous })
+
+	_, err := EnsureFiles(Request{
+		ProjectRoot: root, InstallationID: "server", Profile: "server", NonInteractive: true,
+	}, strings.NewReader(""), ioDiscard{})
+	if err == nil || !strings.Contains(err.Error(), "root") {
+		t.Fatalf("EnsureFiles() error = %v, want root refusal", err)
+	}
+	if _, statErr := os.Lstat(filepath.Join(root, "deploy", "server")); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("projected server path was created before root refusal: %v", statErr)
+	}
+}
+
 func TestEnsureFilesRejectsUnsafeServiceEndpointsBeforeWritingConfiguration(t *testing.T) {
 	for _, test := range []struct {
 		name, environment, value string