fix(auth): close diagnostic filesystem races

tools/tht/internal/safeio/files_unix_test.go

@@ -107,3 +107,55 @@ func TestReplaceCanonicalRegularRejectsSymlinkedPathComponents(t *testing.T) {
 		t.Fatalf("final symlink replacement error = %v, want ErrUnsafeFile", err)
 	}
 }
+
+func TestPrivateDirectoryCreationUsesThePinnedParentAfterAncestorSwap(t *testing.T) {
+	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-mkdirat-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(root) })
+	for _, target := range []string{"root", "sessions", "oidc"} {
+		t.Run(target, func(t *testing.T) {
+			caseRoot := filepath.Join(root, target)
+			parent := filepath.Join(caseRoot, "parent")
+			if err := os.MkdirAll(parent, 0o700); err != nil {
+				t.Fatal(err)
+			}
+			path := filepath.Join(parent, "auth")
+			swappedAncestor := parent
+			if target != "root" {
+				if err := os.Mkdir(path, 0o700); err != nil {
+					t.Fatal(err)
+				}
+				swappedAncestor = path
+				path = filepath.Join(path, target)
+			}
+			outside := filepath.Join(caseRoot, "outside")
+			if err := os.Mkdir(outside, 0o700); err != nil {
+				t.Fatal(err)
+			}
+			movedAncestor := swappedAncestor + "-original"
+
+			if err := createPrivateDirectoryAfterParentOpen(path, func() {
+				if err := os.Rename(swappedAncestor, movedAncestor); err != nil {
+					t.Fatal(err)
+				}
+				if err := os.Symlink(outside, swappedAncestor); err != nil {
+					t.Fatal(err)
+				}
+			}); err != nil {
+				t.Fatal(err)
+			}
+			if err := ValidatePrivateDirectory(filepath.Join(movedAncestor, filepath.Base(path))); err != nil {
+				t.Fatalf("pinned-parent creation failed: %v", err)
+			}
+			if _, err := os.Lstat(filepath.Join(outside, filepath.Base(path))); !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("outside target was mutated: %v", err)
+			}
+		})
+	}
+}