refactor(harness): route workflow persistence through repositories

harness/tests/test_session_repository.py

@@ -1,10 +1,13 @@
 import uuid
 
+import pytest
+
 from tht.config import DatabaseConfig, load_config
 from tht.decisions import DecisionInput
 from tht.session.filesystem_repository import FilesystemSessionRepository
 from tht.session.models import PrincipalContext, SessionManifest
-from tht.session.repository import build_session_repository
+from tht.session.repository import build_session_repository, resolve_principal
+from tht.session.store import SessionError
 from tht.session.store import create_session
 
 
@@ -100,3 +103,52 @@ def test_filesystem_repository_keeps_preferences_per_principal(tmp_path):
 
     assert alice.get_preferences() == {"model": "glm"}
     assert bob.get_preferences() == {}
+
+
+@pytest.mark.parametrize("session_id", ["2026-01-01-000000-test", "2026-01-01-000000-x", "s1"])
+def test_filesystem_repository_reads_safe_legacy_session_ids(tmp_path, session_id):
+    repository = FilesystemSessionRepository(
+        tmp_path / "home", "demo", PrincipalContext(issuer="local", subject="alice")
+    )
+    directory = repository.root / session_id
+    directory.mkdir(parents=True)
+    _manifest(session_id).to_yaml(directory / "session_manifest.yaml")
+
+    assert repository.get(session_id).manifest.id == session_id
+
+
+@pytest.mark.parametrize("session_id", ["..", "a/b", "/absolute", "space id"])
+def test_filesystem_repository_rejects_unsafe_legacy_session_ids(tmp_path, session_id):
+    repository = FilesystemSessionRepository(
+        tmp_path / "home", "demo", PrincipalContext(issuer="local", subject="alice")
+    )
+
+    with pytest.raises(SessionError):
+        repository.get(session_id)
+
+
+def test_postgres_session_storage_requires_trusted_principal_environment(tmp_path, monkeypatch):
+    config = _config(tmp_path).model_copy(update={"session_storage": {
+        "type": "postgres_direct",
+        "connection": _db().model_dump(by_alias=True),
+    }})
+    monkeypatch.delenv("THT_PRINCIPAL_ISSUER", raising=False)
+    monkeypatch.delenv("THT_PRINCIPAL_SUBJECT", raising=False)
+
+    with pytest.raises(SessionError, match="THT_PRINCIPAL_ISSUER"):
+        resolve_principal(config)
+
+
+def test_postgres_session_storage_uses_only_explicit_trusted_principal(tmp_path, monkeypatch):
+    config = _config(tmp_path).model_copy(update={"session_storage": {
+        "type": "postgres_direct",
+        "connection": _db().model_dump(by_alias=True),
+    }})
+    monkeypatch.setenv("THT_PRINCIPAL_ISSUER", "portal")
+    monkeypatch.setenv("THT_PRINCIPAL_SUBJECT", "alice")
+    monkeypatch.setenv("THT_PRINCIPAL_DISPLAY_NAME", "Alice")
+    monkeypatch.setenv("THT_PRINCIPAL_IS_ADMIN", "TRUE")
+
+    assert resolve_principal(config) == PrincipalContext(
+        issuer="portal", subject="alice", display_name="Alice", is_admin=True
+    )