test(windows): respect retained no-delete handles

tools/tht/internal/backup/preflight_windows_test.go

@@ -32,9 +32,13 @@ func TestStageArchiveProtectsWindowsStagingArtifactsWithOwnerOnlyACLs(t *testing
 		t.Fatal(err)
 	}
 	defer staged.Close()
-	if err := safeio.ValidatePrivateDirectory(result.stagingRoot); err != nil {
+	if err := staged.parent.Validate(); err != nil {
-		t.Fatalf("staging root ACL = %v, want owner-only", err)
+		t.Fatalf("retained staging root ACL = %v, want owner-only", err)
 	}
+	if err := staged.file.Close(); err != nil {
+		t.Fatal(err)
+	}
+	staged.file = nil
 	if err := safeio.ValidatePrivateRegular(staged.path); err != nil {
 		t.Fatalf("staged archive ACL = %v, want owner-only", err)
 	}

tools/tht/internal/safeio/files_test.go

@@ -103,11 +103,12 @@ func TestCreateCanonicalNewPrivateFileProvidesPrivateStreamingWriter(t *testing.
 	if err != nil {
 		t.Fatal(err)
 	}
-	directory, err := os.MkdirTemp(temporaryRoot, "tht-safeio-private-stream-")
+	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-private-stream-")
 	if err != nil {
 		t.Fatal(err)
 	}
-	t.Cleanup(func() { _ = os.RemoveAll(directory) })
+	t.Cleanup(func() { _ = os.RemoveAll(root) })
+	directory := filepath.Join(root, "private")
 	if err := EnsurePrivateDirectory(directory); err != nil {
 		t.Fatal(err)
 	}

tools/tht/internal/safeio/private_windows_test.go

@@ -113,26 +113,14 @@ func TestOwnerOnlyDACLCanProtectInheritedRegularFile(t *testing.T) {
 	if err := os.WriteFile(path, []byte("private"), 0o600); err != nil {
 		t.Fatal(err)
 	}
-	parents, target, err := openCanonicalWindowsParent(path)
+	if err := ProtectPrivateDirectory(directory); err != nil {
-	if err != nil {
+		t.Fatalf("ProtectPrivateDirectory() after inherited file error = %T %v", err, err)
-		t.Fatalf("openCanonicalWindowsParent() error = %T %v", err, err)
 	}
-	defer parents.Close()
+	if err := ProtectPrivateRegular(path); err != nil {
-	handle, err := openWindowsRelativeComponent(
+		t.Fatalf("ProtectPrivateRegular() inherited file error = %T %v", err, err)
-		parents.handles[len(parents.handles)-1],
-		target,
-		false,
-		windows.GENERIC_READ|windows.WRITE_DAC|windows.WRITE_OWNER,
-	)
-	if err != nil {
-		t.Fatalf("openWindowsRelativeComponent() error = %T %v", err, err)
 	}
-	defer windows.CloseHandle(handle)
+	if err := ValidatePrivateRegular(path); err != nil {
-	if err := setOwnerOnlyDACL(handle); err != nil {
+		t.Fatalf("ValidatePrivateRegular() inherited file error = %T %v", err, err)
-		t.Fatalf("setOwnerOnlyDACL() inherited file error = %T %v", err, err)
-	}
-	if err := validateOwnerOnlyDACL(handle); err != nil {
-		t.Fatalf("validateOwnerOnlyDACL() inherited file error = %T %v", err, err)
 	}
 }
 
@@ -340,30 +328,11 @@ func TestCreateCanonicalNewPrivateFileInstallsOwnerOnlyDACLAtCreation(t *testing
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer file.Close()
+	if err := file.Close(); err != nil {
+		t.Fatal(err)
+	}
 	if err := ValidatePrivateRegular(path); err != nil {
-		parents, target, parentErr := openCanonicalWindowsParent(path)
+		t.Fatalf("new lock DACL error = %v", err)
-		if parentErr != nil {
-			t.Fatalf("new lock DACL error = %T %v; raw parent open = %T %v", err, err, parentErr, parentErr)
-		}
-		defer parents.Close()
-		handle, openErr := openWindowsRelativeObject(
-			parents.handles[len(parents.handles)-1],
-			target,
-			windows.GENERIC_READ,
-			windows.FILE_OPEN,
-			windows.FILE_NON_DIRECTORY_FILE|windows.FILE_SYNCHRONOUS_IO_NONALERT|windows.FILE_OPEN_REPARSE_POINT,
-			nil,
-		)
-		if openErr != nil {
-			t.Fatalf("new lock DACL error = %T %v; raw regular open = %T %v", err, err, openErr, openErr)
-		}
-		defer windows.CloseHandle(handle)
-		var info windows.ByHandleFileInformation
-		infoErr := windows.GetFileInformationByHandle(handle, &info)
-		daclErr := validateOwnerOnlyDACL(handle)
-		t.Fatalf("new lock DACL error = %T %v; raw info = %T %v attributes=%#x links=%d; raw dacl = %T %v",
-			err, err, infoErr, infoErr, info.FileAttributes, info.NumberOfLinks, daclErr, daclErr)
 	}
 }