fix(auth): paginate session maintenance safely

tools/tht/internal/safeio/files_test.go

@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/aritmolab/thothii/tools/tht/internal/testsupport"
 )
@@ -125,3 +127,69 @@ func TestListCanonicalPrivateDirectoryBoundsAndSortsValidatedEntries(t *testing.
 		t.Fatalf("257-entry listing error = %v, want ErrUnsafeFile", err)
 	}
 }
+
+func TestListCanonicalPrivateDirectoryPageContinuesPastOneBoundedPage(t *testing.T) {
+	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-page-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(root) })
+	if err := ProtectPrivateDirectory(root); err != nil {
+		t.Fatal(err)
+	}
+	validName := func(name string) bool {
+		return len(name) == len(fmt.Sprintf("%064x.json", 0)) && strings.HasSuffix(name, ".json")
+	}
+	for index := 0; index < 513; index++ {
+		path := filepath.Join(root, fmt.Sprintf("%064x.json", index))
+		if err := WriteCanonicalNewFile(path, []byte("record"), 0o600); err != nil {
+			t.Fatalf("WriteCanonicalNewFile(%d) error = %v", index, err)
+		}
+	}
+
+	first, err := ListCanonicalPrivateDirectoryPage(root, 512, "", validName)
+	if err != nil || len(first.Entries) != 512 || !first.More || first.Entries[0].Name != fmt.Sprintf("%064x.json", 0) || first.Entries[511].Name != fmt.Sprintf("%064x.json", 511) {
+		t.Fatalf("first page = %#v error = %v", first, err)
+	}
+	second, err := ListCanonicalPrivateDirectoryPage(root, 512, first.Entries[511].Name, validName)
+	if err != nil || len(second.Entries) != 1 || second.More || second.Entries[0].Name != fmt.Sprintf("%064x.json", 512) {
+		t.Fatalf("second page = %#v error = %v", second, err)
+	}
+}
+
+func TestListCanonicalPrivateDirectoryPageRejectsInPlaceDirectoryMutation(t *testing.T) {
+	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-page-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(root) })
+	if err := ProtectPrivateDirectory(root); err != nil {
+		t.Fatal(err)
+	}
+	filename := fmt.Sprintf("%064x.json", 0)
+	if err := WriteCanonicalNewFile(filepath.Join(root, filename), []byte("record"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	changed := false
+	_, err = ListCanonicalPrivateDirectoryPage(root, 1, "", func(name string) bool {
+		if !changed {
+			changed = true
+			at := time.Unix(1_893_456_245, 0)
+			if changeErr := os.Chtimes(root, at, at); changeErr != nil {
+				t.Fatalf("Chtimes() error = %v", changeErr)
+			}
+		}
+		return name == filename
+	})
+	if !errors.Is(err, ErrUnsafeFile) {
+		t.Fatalf("unstable page error = %v, want ErrUnsafeFile", err)
+	}
+}