fix(auth): harden Windows storage bridge

tools/tht/internal/workspaceops/operations_windows_test.go

@@ -0,0 +1,44 @@
+//go:build windows
+
+package workspaceops
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/aritmolab/thothii/tools/tht/internal/compose"
+)
+
+func TestExecuteSuggestFksWritesOutputInInheritedOperatorDirectory(t *testing.T) {
+	installation := testInstallation(t)
+	operatorDirectory := filepath.Join(filepath.Dir(installation.Path), "operator-output")
+	if err := os.Mkdir(operatorDirectory, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	output := filepath.Join(operatorDirectory, "candidates.yaml")
+	runner := &fakeRunner{run: func(args []string, _ string) (compose.Result, error) {
+		switch {
+		case contains(args, "config", "--format", "json"):
+			return compose.Result{Stdout: `{"services":{"core":{"image":"thothii-core:local"}}}`}, nil
+		case reflect.DeepEqual(args, []string{"image", "inspect", "--format", "{{.Id}}", "thothii-core:local"}):
+			return compose.Result{Stdout: "sha256:" + strings.Repeat("d", 64)}, nil
+		case contains(args, "workspace-maintenance", "schema-suggest-fks"):
+			return compose.Result{Stdout: `{"schemaVersion":1,"status":"blocked","code":"manual_review_required","workspaceId":"abc","workspaceRevision":"1234567890abcdef1234567890abcdef12345678","descriptorBlob":"sha256:` + strings.Repeat("e", 64) + `","operation":"schema-suggest-fks","completedStages":[],"suggestedFksYaml":"reviewed: []\n"}`}, nil
+		default:
+			t.Fatalf("unexpected Docker invocation: %#v", args)
+			return compose.Result{}, nil
+		}
+	}}
+
+	if _, err := Execute(context.Background(), installation, runner, SuggestFksRequest{baseRequest: baseRequest{Workspace: "abc"}, Output: output}); err != nil {
+		t.Fatalf("workspace schema suggest-fks --output error = %v", err)
+	}
+	contents, err := os.ReadFile(output)
+	if err != nil || string(contents) != "reviewed: []\n" {
+		t.Fatalf("workspace schema suggest-fks output = %q error = %v", contents, err)
+	}
+}