From e51a6a22535de934c9245068994a3eaf3e855f96 Mon Sep 17 00:00:00 2001
From: mptyl <mp@tylconsulting.it>
Date: Wed, 26 Aug 2026 00:12:25 +0200
Subject: [PATCH] fix(deploy): prepare server auth projection root

---
 scripts/test-task13-runtime-fixtures.sh | 10 ++++++++--
 scripts/unified-deployment-smoke.sh     | 13 +++++++++----
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/scripts/test-task13-runtime-fixtures.sh b/scripts/test-task13-runtime-fixtures.sh
index 80db3d4f..ff5b66e1 100755
--- a/scripts/test-task13-runtime-fixtures.sh
+++ b/scripts/test-task13-runtime-fixtures.sh
@@ -83,15 +83,21 @@ else
   original_task13_run_logged="$(declare -f task13_run_logged)"
   ownership_calls="$fixture/server-auth-ownership.calls"
   task13_run_logged() {
-    printf '%s\n' "$*" >"$ownership_calls"
+    printf '%s\n' "$*" >>"$ownership_calls"
   }
-  task13_prepare_server_auth_canonical_root
+  task13_prepare_server_auth_roots
   grep -Fxq -- \
     "prepare server authentication canonical root sudo -n -- install -d -o 0 -g 0 -m 0700 -- $TASK13_AUTH_ROOT" \
     "$ownership_calls" || {
       echo "server auth fixture does not prepare a root-owned private canonical directory" >&2
       exit 1
     }
+  grep -Fxq -- \
+    "prepare server authentication runtime root sudo -n -- install -d -o 10001 -g 10001 -m 0700 -- $TASK13_AUTH_RUNTIME_ROOT" \
+    "$ownership_calls" || {
+      echo "server auth fixture does not prepare the private runtime projection directory" >&2
+      exit 1
+    }
   unset -f task13_run_logged
   eval "$original_task13_run_logged"
   compose_files=(
diff --git a/scripts/unified-deployment-smoke.sh b/scripts/unified-deployment-smoke.sh
index f7ebb1ea..c2c58d5e 100755
--- a/scripts/unified-deployment-smoke.sh
+++ b/scripts/unified-deployment-smoke.sh
@@ -944,14 +944,19 @@ task13_configure_server_oidc_authentication() {
     --authentik-base-url "https://task13-fake-oidc:9443" --user-group task13-users --admin-group task13-admins
 }
 
-task13_prepare_server_auth_canonical_root() {
+task13_prepare_server_auth_roots() {
   [[ "${TASK13_PROFILE:-}" == server \
     && "$TASK13_AUTH_ROOT" == "$TASK13_TMP/auth" \
     && ! -L "$TASK13_AUTH_ROOT" \
-    && ( ! -e "$TASK13_AUTH_ROOT" || -d "$TASK13_AUTH_ROOT" ) ]] \
-    || task13_fail "refusing to prepare an unexpected server authentication root"
+    && ( ! -e "$TASK13_AUTH_ROOT" || -d "$TASK13_AUTH_ROOT" ) \
+    && "$TASK13_AUTH_RUNTIME_ROOT" == "$TASK13_TMP/auth-runtime" \
+    && ! -L "$TASK13_AUTH_RUNTIME_ROOT" \
+    && ( ! -e "$TASK13_AUTH_RUNTIME_ROOT" || -d "$TASK13_AUTH_RUNTIME_ROOT" ) ]] \
+    || task13_fail "refusing to prepare unexpected server authentication roots"
   task13_run_logged "prepare server authentication canonical root" sudo -n -- \
     install -d -o 0 -g 0 -m 0700 -- "$TASK13_AUTH_ROOT"
+  task13_run_logged "prepare server authentication runtime root" sudo -n -- \
+    install -d -o 10001 -g 10001 -m 0700 -- "$TASK13_AUTH_RUNTIME_ROOT"
 }
 
 task13_prepare_local_auth_runtime() {
@@ -2854,7 +2859,7 @@ task13_server_smoke_main() {
   task13_write_server_fixture_files
   task13_seed_registry
   task13_build_tht
-  task13_prepare_server_auth_canonical_root
+  task13_prepare_server_auth_roots
   task13_configure_server_oidc_authentication
   task13_start_server_stack
   task13_record_project_image_evidence