feat(auth): add local and OIDC management to tht

tools/tht/internal/setup/files_test.go

@@ -11,6 +11,7 @@ import (
 	"testing"
 
 	"github.com/aritmolab/thothii/tools/tht/internal/config"
+	"github.com/aritmolab/thothii/tools/tht/internal/safeio"
 	"github.com/aritmolab/thothii/tools/tht/internal/testsupport"
 )
 
@@ -48,6 +49,13 @@ func TestEnsureFilesCreatesDiscoverableConfigurationInProjectWithSpaces(t *testi
 			t.Errorf("generated file %s has permissions %o, want owner-only", path, info.Mode().Perm())
 		}
 	}
+	installation, err := config.Load(result.DescriptorPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := safeio.ValidatePrivateDirectory(installation.AuthenticationDirectory()); err != nil {
+		t.Fatalf("authentication directory is not private: %v", err)
+	}
 
 	descriptor, err := os.ReadFile(result.DescriptorPath)
 	if err != nil {