feat(auth): integrate authentication with installation lifecycle

tools/tht/internal/backup/restore_test.go

@@ -59,6 +59,58 @@ func TestRestoreStoppedInstallationRunsCheckpointRestoreAndVerification(t *testi
 	}
 }
 
+func TestRestoreResetsAuthenticationStateBeforeRestart(t *testing.T) {
+	installation := preflightTestInstallation(t)
+	archive := restoreArchive(t)
+	runner := newBackupRunner(installation, true)
+	deps := restoreTestDependencies(t, runner)
+	var events []string
+	deps.restoreFile = func(_ context.Context, _ config.Installation, entry ArchiveEntryMetadata, _ io.Reader) error {
+		events = append(events, "file:"+entry.Path)
+		return nil
+	}
+	deps.resetAuthenticationState = func(context.Context, config.Installation, archiveRunner) error {
+		events = append(events, "reset-auth-state")
+		return nil
+	}
+	for _, name := range []string{"health", "doctor", "pi", "workspace"} {
+		name := name
+		deps.verify[name] = func(context.Context, config.Installation, archiveRunner) error {
+			events = append(events, name)
+			return nil
+		}
+	}
+
+	result, err := restoreWithDependencies(context.Background(), installation, RestoreRequest{Archive: archive, Confirm: true}, deps)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !result.Restarted || !result.Verified {
+		t.Fatalf("restore result = %#v", result)
+	}
+	if got, want := events, []string{"file:configuration/operator.env", "reset-auth-state", "health", "doctor", "pi", "workspace"}; !equalStrings(got, want) {
+		t.Fatalf("restore events = %v, want %v", got, want)
+	}
+}
+
+func TestResetAuthenticationStateCreatesOnlyPrivateEmptyStateDirectories(t *testing.T) {
+	installation := preflightTestInstallation(t)
+	runner := &authenticationStateResetRunner{}
+
+	if err := resetAuthenticationState(context.Background(), installation, runner); err != nil {
+		t.Fatal(err)
+	}
+	joined := strings.Join(runner.args, "\x00")
+	for _, required := range []string{
+		"run", "--rm", "--no-deps", "--no-TTY", "--entrypoint", "sh", "core", "-ceu",
+		"rm -rf /data/auth && install -d -m 0700 /data/auth /data/auth/sessions /data/auth/oidc",
+	} {
+		if !strings.Contains(joined, required) {
+			t.Fatalf("authentication state reset command omits %q: %#v", required, runner.args)
+		}
+	}
+}
+
 func TestRestorePreflightFailureDoesNotMutateTarget(t *testing.T) {
 	installation := preflightTestInstallation(t)
 	runner := newBackupRunner(installation, true)
@@ -213,6 +265,19 @@ type fakeRestoreLock struct {
 	release func()
 }
 
+type authenticationStateResetRunner struct{ args []string }
+
+func (runner *authenticationStateResetRunner) Run(_ context.Context, args []string, _ io.Reader) (compose.Result, error) {
+	runner.args = append([]string(nil), args...)
+	return compose.Result{}, nil
+}
+
+func (runner *authenticationStateResetRunner) Stream(context.Context, []string, io.Reader, io.Writer) (compose.Result, error) {
+	return compose.Result{}, errors.New("authentication state reset must not stream a volume archive")
+}
+
+func (*authenticationStateResetRunner) SessionInventoryScope() string { return "mine" }
+
 func (lock fakeRestoreLock) Release() error {
 	if lock.release != nil {
 		lock.release()
@@ -248,6 +313,9 @@ func restoreTestDependencies(t *testing.T, runner archiveRunner) restoreDependen
 		restoreVolume: func(context.Context, config.Installation, VolumeMetadata, io.Reader) error {
 			return nil
 		},
+		resetAuthenticationState: func(context.Context, config.Installation, archiveRunner) error {
+			return nil
+		},
 		verify: map[string]restoreVerify{
 			"health":    func(context.Context, config.Installation, archiveRunner) error { return nil },
 			"doctor":    func(context.Context, config.Installation, archiveRunner) error { return nil },