feat(auth): add safe Argon2id local user registry

tools/tht/internal/safeio/files_unix_test.go

@@ -30,3 +30,80 @@ func TestReadCanonicalRegularRejectsNamedPipeWithoutBlocking(t *testing.T) {
 		t.Fatalf("named pipe error = %v, want ErrUnsafeFile", err)
 	}
 }
+
+func TestReplaceCanonicalRegularReplacesOnlySafeRegularTargets(t *testing.T) {
+	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-replace-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(root) })
+	path := filepath.Join(root, "users.yaml")
+	if err := os.WriteFile(path, []byte("old"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := ReplaceCanonicalRegular(path, []byte("new"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	contents, err := ReadCanonicalRegular(path, 1024)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(contents) != "new" {
+		t.Fatalf("replacement content = %q, want new", contents)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode().Perm() != 0o600 {
+		t.Fatalf("replacement mode = %o, want 600", info.Mode().Perm())
+	}
+
+	linked := filepath.Join(root, "linked.yaml")
+	if err := os.Link(path, linked); err != nil {
+		t.Fatal(err)
+	}
+	if err := ReplaceCanonicalRegular(path, []byte("unsafe"), 0o600); !errors.Is(err, ErrUnsafeFile) {
+		t.Fatalf("hard-linked replacement error = %v, want ErrUnsafeFile", err)
+	}
+}
+
+func TestReplaceCanonicalRegularRejectsSymlinkedPathComponents(t *testing.T) {
+	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-replace-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(root) })
+	realDirectory := filepath.Join(root, "real")
+	if err := os.Mkdir(realDirectory, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	target := filepath.Join(realDirectory, "users.yaml")
+	if err := os.WriteFile(target, []byte("old"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	linkedDirectory := filepath.Join(root, "linked")
+	if err := os.Symlink(realDirectory, linkedDirectory); err != nil {
+		t.Fatal(err)
+	}
+	if err := ReplaceCanonicalRegular(filepath.Join(linkedDirectory, "users.yaml"), []byte("new"), 0o600); !errors.Is(err, ErrUnsafeFile) {
+		t.Fatalf("parent symlink replacement error = %v, want ErrUnsafeFile", err)
+	}
+
+	linkedFile := filepath.Join(root, "linked-file.yaml")
+	if err := os.Symlink(target, linkedFile); err != nil {
+		t.Fatal(err)
+	}
+	if err := ReplaceCanonicalRegular(linkedFile, []byte("new"), 0o600); !errors.Is(err, ErrUnsafeFile) {
+		t.Fatalf("final symlink replacement error = %v, want ErrUnsafeFile", err)
+	}
+}