test(auth): gate local and OIDC authentication release

tools/tht/internal/backup/preflight_test.go

@@ -7,6 +7,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -356,6 +357,79 @@ func TestPreflightRevalidationRefusesAnArchivePathThatWasReplaced(t *testing.T)
 	}
 }
 
+func TestPreflightStagesArchiveIntoImmutablePrivateBytes(t *testing.T) {
+	installation := preflightTestInstallation(t)
+	archive := filepath.Join(t.TempDir(), "checked.zip")
+	writePreflightArchive(t, archive, preflightArchiveSpec{
+		entries: []preflightArchiveEntry{{path: "configuration/operator.env", body: []byte("before")}},
+	})
+
+	result, err := Preflight(context.Background(), installation, PreflightRequest{Archive: archive, Confirm: true}, permissivePreflightDependencies())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer result.CloseArchive()
+	staged, err := result.StageArchive(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer staged.Close()
+
+	writePreflightArchive(t, archive, preflightArchiveSpec{
+		entries: []preflightArchiveEntry{{path: "configuration/operator.env", body: []byte("after!")}},
+	})
+	reader, err := zip.NewReader(staged.file, result.ArchiveSize)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(reader.File) < 2 {
+		t.Fatalf("staged archive members = %d, want manifest and payload", len(reader.File))
+	}
+	var payload *zip.File
+	for _, member := range reader.File {
+		if member.Name == "configuration/operator.env" {
+			payload = member
+			break
+		}
+	}
+	if payload == nil {
+		t.Fatal("staged archive is missing the configured payload")
+	}
+	stream, err := payload.Open()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer stream.Close()
+	body, err := io.ReadAll(stream)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(body) != "before" {
+		t.Fatalf("staged payload = %q, want preflighted bytes", body)
+	}
+}
+
+func TestPreflightStagingRejectsInPlaceArchiveHashMutation(t *testing.T) {
+	installation := preflightTestInstallation(t)
+	archive := filepath.Join(t.TempDir(), "checked.zip")
+	writePreflightArchive(t, archive, preflightArchiveSpec{
+		entries: []preflightArchiveEntry{{path: "configuration/operator.env", body: []byte("before")}},
+	})
+
+	result, err := Preflight(context.Background(), installation, PreflightRequest{Archive: archive, Confirm: true}, permissivePreflightDependencies())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer result.CloseArchive()
+	writePreflightArchive(t, archive, preflightArchiveSpec{
+		entries: []preflightArchiveEntry{{path: "configuration/operator.env", body: []byte("after!")}},
+	})
+
+	if _, err := result.StageArchive(context.Background()); err == nil || !strings.Contains(err.Error(), "changed") {
+		t.Fatalf("StageArchive() error = %v, want changed archive refusal", err)
+	}
+}
+
 func TestPreflightRejectsArchiveEntryWithModeDifferentFromManifest(t *testing.T) {
 	installation := preflightTestInstallation(t)
 	archive := filepath.Join(t.TempDir(), "mode-mismatch.zip")