feat(auth): add local and OIDC management to tht

tools/tht/internal/safeio/private_windows.go

@@ -3,6 +3,7 @@
 package safeio
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -12,6 +13,32 @@ import (
 	"golang.org/x/sys/windows"
 )
 
+func createPrivateDirectory(path string) error {
+	parents, target, err := openCanonicalWindowsParent(path)
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	defer parents.Close()
+	security, err := newOwnerOnlySecurityDescriptor()
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	defer security.Close()
+	attributes := &windows.SecurityAttributes{
+		Length:             uint32(unsafe.Sizeof(windows.SecurityAttributes{})),
+		SecurityDescriptor: security.descriptor,
+	}
+	err = windows.CreateDirectory(windows.StringToUTF16Ptr(filepath.Join(parents.directory, target)), attributes)
+	runtime.KeepAlive(security)
+	if errors.Is(err, windows.ERROR_ALREADY_EXISTS) {
+		return os.ErrExist
+	}
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	return ValidatePrivateDirectory(path)
+}
+
 // ProtectPrivateDirectory sets a protected DACL containing only the current owner.
 func ProtectPrivateDirectory(path string) error {
 	parents, target, err := openCanonicalWindowsParent(path)