fix(auth): add Windows session storage bridge

tools/tht/internal/safeio/private_read_windows.go

@@ -0,0 +1,44 @@
+//go:build windows
+
+package safeio
+
+import (
+	"io"
+	"os"
+
+	"golang.org/x/sys/windows"
+)
+
+func readCanonicalPrivateRegular(path string, maximum int64) ([]byte, error) {
+	if maximum < 0 || maximum == int64(^uint64(0)>>1) {
+		return nil, ErrUnsafeFile
+	}
+	value, err := openWindowsPrivateRegular(path, 1)
+	if err != nil {
+		return nil, ErrUnsafeFile
+	}
+	defer value.Close()
+	file := os.NewFile(uintptr(value.handle), "tht-safeio-private-read")
+	if file == nil {
+		return nil, ErrUnsafeFile
+	}
+	before := value.info
+	contents, readErr := io.ReadAll(io.LimitReader(file, maximum+1))
+	var after = value.info
+	identityErr := windows.GetFileInformationByHandle(value.handle, &after)
+	daclErr := validateOwnerOnlyDACL(value.handle)
+	closeErr := file.Close()
+	value.handle = 0
+	if readErr != nil || identityErr != nil || daclErr != nil || !sameWindowsPrivateFile(before, after) || after.NumberOfLinks != 1 || closeErr != nil || int64(len(contents)) > maximum {
+		return nil, ErrUnsafeFile
+	}
+	current, err := openWindowsPrivateRegular(path, 1)
+	if err != nil {
+		return nil, ErrUnsafeFile
+	}
+	current.Close()
+	if !sameWindowsPrivateFile(before, current.info) {
+		return nil, ErrUnsafeFile
+	}
+	return contents, nil
+}