feat(auth): coordinate canonical projection publication

tools/tht/internal/authprojection/projection_linux_test.go

@@ -3,6 +3,7 @@
 package authprojection
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -11,10 +12,50 @@ import (
 	"sync"
 	"syscall"
 	"testing"
+	"time"
 
 	"golang.org/x/sys/unix"
 )
 
+func TestBeginContextReturnsWhenRuntimeFlockIsHeld(t *testing.T) {
+	spec := testSpec(t)
+	first, err := Begin(spec, nil, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = first.Close() })
+	contended := make(chan error, 1)
+	restore := setTestHooksForTest(testHooks{beforeFlock: func(fd int) {
+		if err := unix.Flock(fd, unix.LOCK_EX|unix.LOCK_NB); !errors.Is(err, unix.EWOULDBLOCK) {
+			contended <- fmt.Errorf("runtime lock contention = %v", err)
+			return
+		}
+		contended <- nil
+	}})
+	t.Cleanup(restore)
+	ctx, cancel := context.WithCancel(context.Background())
+	result := make(chan error, 1)
+	go func() {
+		transaction, err := BeginContext(ctx, spec, nil, false)
+		if err == nil {
+			err = transaction.Close()
+		}
+		result <- err
+	}()
+	if err := <-contended; err != nil {
+		t.Fatal(err)
+	}
+	cancel()
+	select {
+	case err := <-result:
+		if !errors.Is(err, context.Canceled) {
+			t.Fatalf("BeginContext() error = %v, want context cancellation", err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("BeginContext() did not return after cancellation")
+	}
+}
+
 func testSpec(t *testing.T) Spec {
 	t.Helper()
 	root := t.TempDir()