Define cleanup authorization and targets

internal/config/storage_publish_test.go

@@ -307,6 +307,46 @@ func TestSpoolAndPublishDefaults(t *testing.T) {
 	}
 }
 
+func TestCleanupPoliciesRequireEnabledRunPublication(t *testing.T) {
+	tests := []struct {
+		name             string
+		spoolCleanup     bool
+		workspaceCleanup bool
+		publishEnabled   bool
+		uploadRun        bool
+		wantError        bool
+	}{
+		{name: "spool cleanup rejects disabled publish", spoolCleanup: true, uploadRun: true, wantError: true},
+		{name: "workspace cleanup rejects disabled publish", workspaceCleanup: true, uploadRun: true, wantError: true},
+		{name: "spool cleanup rejects disabled run upload", spoolCleanup: true, publishEnabled: true, wantError: true},
+		{name: "workspace cleanup rejects disabled run upload", workspaceCleanup: true, publishEnabled: true, wantError: true},
+		{name: "spool cleanup accepts enabled run publication", spoolCleanup: true, publishEnabled: true, uploadRun: true},
+		{name: "workspace cleanup accepts enabled run publication", workspaceCleanup: true, publishEnabled: true, uploadRun: true},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			pipelinePath, sessionPath := writeConfigFiles(t, testPipelineBaseYAML, testSessionBaseYAML)
+			cfg, err := Load(pipelinePath, sessionPath)
+			if err != nil {
+				t.Fatalf("Load() error = %v", err)
+			}
+			cfg.Pipeline.Spool.DeleteAudioAfterPublish = test.spoolCleanup
+			cfg.Pipeline.Workspace.CleanupAfterPublish = test.workspaceCleanup
+			cfg.Pipeline.Publish.Enabled = &test.publishEnabled
+			cfg.Pipeline.Publish.UploadRun = &test.uploadRun
+
+			err = Validate(cfg)
+			if test.wantError && err == nil {
+				t.Fatal("Validate() error = nil")
+			}
+			if !test.wantError && err != nil {
+				t.Fatalf("Validate() error = %v", err)
+			}
+		})
+	}
+}
+
 func TestPublishOutputValidation(t *testing.T) {
 	tests := []struct {
 		name    string