Make ordinary workspaces group shareable

internal/fileops/modes_posix_test.go

@@ -0,0 +1,87 @@
+//go:build !windows
+
+package fileops
+
+import (
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+func TestWorkspaceModesOverrideRestrictiveUmask(t *testing.T) {
+	restoreUmask := syscall.Umask(0o077)
+	t.Cleanup(func() { syscall.Umask(restoreUmask) })
+
+	root := t.TempDir()
+	nested := filepath.Join(root, "campaign", "session", "artifacts")
+	if err := EnsureWorkspaceDirectory(nested); err != nil {
+		t.Fatalf("EnsureWorkspaceDirectory() error = %v", err)
+	}
+	for _, path := range []string{
+		filepath.Join(root, "campaign"),
+		filepath.Join(root, "campaign", "session"),
+		nested,
+	} {
+		assertWorkspaceDirectoryMode(t, path)
+	}
+
+	file := filepath.Join(nested, "result.json")
+	if err := WriteFileAtomic(file, []byte("first"), WorkspaceFileMode); err != nil {
+		t.Fatalf("WriteFileAtomic(first) error = %v", err)
+	}
+	if err := WriteFileAtomic(file, []byte("replacement"), WorkspaceFileMode); err != nil {
+		t.Fatalf("WriteFileAtomic(replacement) error = %v", err)
+	}
+	assertWorkspaceFileMode(t, file)
+}
+
+func TestPromoteDirectoryUsesWorkspaceModesUnderRestrictiveUmask(t *testing.T) {
+	root := t.TempDir()
+	src := filepath.Join(root, "source")
+	if err := os.MkdirAll(filepath.Join(src, "nested"), 0o755); err != nil {
+		t.Fatalf("MkdirAll(source) error = %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(src, "nested", "result.json"), []byte("result"), 0o600); err != nil {
+		t.Fatalf("WriteFile(source) error = %v", err)
+	}
+
+	destinationParent := filepath.Join(root, "workspace", "artifacts", "notarius")
+	if err := EnsureWorkspaceDirectory(destinationParent); err != nil {
+		t.Fatalf("EnsureWorkspaceDirectory(destination parent) error = %v", err)
+	}
+	restoreUmask := syscall.Umask(0o077)
+	t.Cleanup(func() { syscall.Umask(restoreUmask) })
+	destination := filepath.Join(destinationParent, "run-1")
+	if err := PromoteDirectory(src, destination); err != nil {
+		t.Fatalf("PromoteDirectory() error = %v", err)
+	}
+	assertWorkspaceDirectoryMode(t, destination)
+	assertWorkspaceDirectoryMode(t, filepath.Join(destination, "nested"))
+	assertWorkspaceFileMode(t, filepath.Join(destination, "nested", "result.json"))
+}
+
+func assertWorkspaceDirectoryMode(t *testing.T, path string) {
+	t.Helper()
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatalf("Stat(%q) error = %v", path, err)
+	}
+	if got, want := info.Mode().Perm(), WorkspaceDirectoryMode.Perm(); got != want {
+		t.Fatalf("directory mode for %q = %o, want %o", path, got, want)
+	}
+	if info.Mode()&os.ModeSetgid == 0 {
+		t.Fatalf("directory mode for %q does not include setgid: %v", path, info.Mode())
+	}
+}
+
+func assertWorkspaceFileMode(t *testing.T, path string) {
+	t.Helper()
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatalf("Stat(%q) error = %v", path, err)
+	}
+	if got, want := info.Mode().Perm(), WorkspaceFileMode.Perm(); got != want {
+		t.Fatalf("file mode for %q = %o, want %o", path, got, want)
+	}
+}