fix(auth): recover interrupted projection retention

tools/tht/internal/authprojection/projection_linux.go

@@ -93,7 +93,16 @@ func Begin(spec Spec, before *Snapshot, requireReadyMatch bool) (*Transaction, e
 			_ = transaction.Close()
 			return nil, ErrIntegrity
 		}
-		status, inspectErr := inspectCapturedSelector(root, spec, selector)
+		status, inspectErr := inspectSelectedGeneration(root, spec, selector)
+		if inspectErr != nil {
+			_ = transaction.Close()
+			return nil, ErrIntegrity
+		}
+		if validateReadyGenerationHistory(root, spec, selector) != nil || retain(root, spec, selector) != nil {
+			_ = transaction.Close()
+			return nil, ErrIntegrity
+		}
+		status, inspectErr = inspectCapturedSelector(root, spec, selector)
 		if inspectErr != nil {
 			_ = transaction.Close()
 			return nil, ErrIntegrity
@@ -372,6 +381,9 @@ func inspectSelectedGeneration(root int, spec Spec, selector Selector) (Status,
 }
 
 func validateReadyGenerationNamespace(root int, spec Spec, selector Selector) error {
+	if validateReadyGenerationHistory(root, spec, selector) != nil {
+		return ErrIntegrity
+	}
 	generations, err := openDirectoryAt(root, "generations", spec)
 	if err != nil {
 		return ErrIntegrity
@@ -392,7 +404,16 @@ func validateReadyGenerationNamespace(root int, spec Spec, selector Selector) er
 		if !validHex(name, 64) || !keep[name] {
 			return ErrIntegrity
 		}
-		if _, err := readGeneration(root, spec, name); err != nil {
+	}
+	return nil
+}
+
+func validateReadyGenerationHistory(root int, spec Spec, selector Selector) error {
+	if selector.State != "ready" {
+		return ErrIntegrity
+	}
+	for _, generation := range append([]string{selector.Generation}, selector.PreviousGenerations...) {
+		if _, err := readGeneration(root, spec, generation); err != nil {
 			return ErrIntegrity
 		}
 	}
@@ -652,6 +673,9 @@ func retain(root int, spec Spec, selector Selector) error {
 			}
 			continue
 		}
+		if _, err := readGeneration(root, spec, name); err != nil {
+			return ErrIntegrity
+		}
 		if removeConfinedDirectory(generations, name, spec, false) != nil {
 			return ErrIntegrity
 		}