fix(windows): tolerate concurrent auth claims

tools/tht/internal/safeio/claim_windows_test.go

@@ -4,8 +4,10 @@ package safeio
 
 import (
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
+	"sync"
 	"testing"
 )
 
@@ -135,3 +137,51 @@ func TestRemoveCanonicalPrivateClaimRejectsMismatchedTwoLinkFiles(t *testing.T)
 		}
 	}
 }
+
+func TestClaimCanonicalPrivateRegularHasOneConcurrentWinner(t *testing.T) {
+	parent := filepath.Join(t.TempDir(), "claims")
+	if err := os.Mkdir(parent, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := ProtectPrivateDirectory(parent); err != nil {
+		t.Fatal(err)
+	}
+	for iteration := range 16 {
+		source := filepath.Join(parent, fmt.Sprintf("state-%02d.json", iteration))
+		claim := filepath.Join(parent, fmt.Sprintf("state-%02d.claim", iteration))
+		createWindowsPrivateTestFile(t, source, []byte("state"))
+
+		type result struct {
+			claimed bool
+			err     error
+		}
+		results := make(chan result, 2)
+		var group sync.WaitGroup
+		for range 2 {
+			group.Add(1)
+			go func() {
+				defer group.Done()
+				claimed, err := ClaimCanonicalPrivateRegular(source, claim)
+				results <- result{claimed: claimed, err: err}
+			}()
+		}
+		group.Wait()
+		close(results)
+
+		winners := 0
+		for got := range results {
+			if got.err != nil {
+				t.Fatalf("iteration %d concurrent claim error = %v", iteration, got.err)
+			}
+			if got.claimed {
+				winners++
+			}
+		}
+		if winners != 1 {
+			t.Fatalf("iteration %d winning claims = %d, want 1", iteration, winners)
+		}
+		if removed, err := RemoveCanonicalPrivateClaim(source, claim); err != nil || !removed {
+			t.Fatalf("iteration %d claim cleanup = removed %v, err %v", iteration, removed, err)
+		}
+	}
+}