Harden report output publication

internal/fileutil/fileutil_test.go

@@ -1,6 +1,8 @@
 package fileutil
 
 import (
+	"context"
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
@@ -21,6 +23,10 @@ func TestWriteFileAtomicCreatesParentDirectory(t *testing.T) {
 	if string(data) != "artifact" {
 		t.Fatalf("data = %q, want artifact", data)
 	}
+	info, err := os.Stat(path)
+	if err != nil || info.Mode().Perm() != 0o600 {
+		t.Fatalf("output mode/error = %o/%v", info.Mode().Perm(), err)
+	}
 }
 
 func TestWriteFileAtomicOverwritesTarget(t *testing.T) {
@@ -67,26 +73,81 @@ func TestWriteFileAtomicSupportsLongestFileName(t *testing.T) {
 	}
 }
 
-func TestWriteFileAtomicCleansTemporaryFileAfterRenameError(t *testing.T) {
+func TestWriteFileAtomicRejectsUnsafeFinalDestinations(t *testing.T) {
 	dir := t.TempDir()
-	target := filepath.Join(dir, "target")
-	if err := os.Mkdir(target, 0o755); err != nil {
-		t.Fatalf("Mkdir() error = %v", err)
+	backing := filepath.Join(dir, "backing.md")
+	if err := os.WriteFile(backing, []byte("old"), 0o600); err != nil {
+		t.Fatal(err)
 	}
+	for _, tt := range []struct {
+		name  string
+		setup func(t *testing.T, path string)
+	}{
+		{
+			name: "directory",
+			setup: func(t *testing.T, path string) {
+				t.Helper()
+				if err := os.Mkdir(path, 0o755); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			name: "symbolic link",
+			setup: func(t *testing.T, path string) {
+				t.Helper()
+				if err := os.Symlink(backing, path); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			target := filepath.Join(dir, tt.name)
+			tt.setup(t, target)
+			before, err := os.Lstat(target)
+			if err != nil {
+				t.Fatal(err)
+			}
 
-	err := WriteFileAtomic(target, []byte("data"))
-	if err == nil {
-		t.Fatal("WriteFileAtomic() error = nil, want rename error")
+			if err := WriteFileAtomic(target, []byte("new")); err == nil {
+				t.Fatal("WriteFileAtomic() error = nil")
+			}
+			after, err := os.Lstat(target)
+			if err != nil || after.Mode() != before.Mode() {
+				t.Fatalf("target mode/error = %v/%v, want %v", after.Mode(), err, before.Mode())
+			}
+			matches, err := filepath.Glob(filepath.Join(dir, ".weatherreporter-*.tmp"))
+			if err != nil || len(matches) != 0 {
+				t.Fatalf("temporary files/error = %v/%v", matches, err)
+			}
+		})
 	}
-	if !strings.Contains(err.Error(), "save") {
-		t.Fatalf("error = %q, want save context", err.Error())
+	data, err := os.ReadFile(backing)
+	if err != nil || string(data) != "old" {
+		t.Fatalf("symbolic link target/error = %q/%v", data, err)
 	}
-	matches, err := filepath.Glob(filepath.Join(dir, ".weatherreporter-*.tmp"))
-	if err != nil {
-		t.Fatalf("Glob() error = %v", err)
+}
+
+func TestWriteFileAtomicContextPreservesDestinationWhenCanceledAtPublication(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "artifact.txt")
+	if err := os.WriteFile(path, []byte("old"), 0o600); err != nil {
+		t.Fatal(err)
 	}
-	if len(matches) != 0 {
-		t.Fatalf("temporary files = %v, want none", matches)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	err := WriteFileAtomicContext(ctx, path, []byte("new"))
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("WriteFileAtomicContext() error = %v, want context cancellation", err)
+	}
+	data, readErr := os.ReadFile(path)
+	if readErr != nil || string(data) != "old" {
+		t.Fatalf("output/error = %q/%v", data, readErr)
+	}
+	matches, globErr := filepath.Glob(filepath.Join(filepath.Dir(path), ".weatherreporter-*.tmp"))
+	if globErr != nil || len(matches) != 0 {
+		t.Fatalf("temporary files/error = %v/%v", matches, globErr)
 	}
 }