fix(auth): add Windows session storage bridge

tools/tht/internal/safeio/private_windows.go

@@ -96,6 +96,14 @@ func ProtectPrivateRegular(path string) error {
 // createCanonicalNewPrivateFile installs the owner-only protected DACL in the CreateFile call, so
 // another mutation can never observe a newly-created lock with an inherited/default DACL.
 func createCanonicalNewPrivateFile(path string, mode os.FileMode) (*os.File, error) {
+	parents, target, err := openCanonicalWindowsParent(path)
+	if err != nil || len(parents.handles) == 0 || validateOwnerOnlyDACL(parents.handles[len(parents.handles)-1]) != nil {
+		if parents != nil {
+			parents.Close()
+		}
+		return nil, ErrUnsafeFile
+	}
+	defer parents.Close()
 	security, err := newOwnerOnlySecurityDescriptor()
 	if err != nil {
 		return nil, ErrUnsafeFile
@@ -106,7 +114,7 @@ func createCanonicalNewPrivateFile(path string, mode os.FileMode) (*os.File, err
 		SecurityDescriptor: security.descriptor,
 	}
 	handle, err := windows.CreateFile(
-		windows.StringToUTF16Ptr(path),
+		windows.StringToUTF16Ptr(filepath.Join(parents.directory, target)),
 		windows.GENERIC_WRITE,
 		windowsRetainedHandleShareMode,
 		attributes,