feat: establish NekoNest Cloud control and relay

relay/internal/tenantfs/paths_test.go

@@ -0,0 +1,58 @@
+package tenantfs
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestResolveUsesOpaqueTenantDirectoryAndRejectsTraversal(t *testing.T) {
+	tenantID := "tenant_0123456789abcdef0123456789abcdef"
+	paths, err := Resolve(t.TempDir(), tenantID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(paths.Root, tenantID) || filepath.Base(paths.Root) == tenantID {
+		t.Fatalf("tenant id leaked into path: %s", paths.Root)
+	}
+	if filepath.Dir(paths.Attachments) != paths.Root || filepath.Dir(paths.Database) != paths.Root {
+		t.Fatalf("paths escaped tenant root: %#v", paths)
+	}
+	if _, err := Resolve(t.TempDir(), "tenant_../../escape"); err == nil {
+		t.Fatal("traversal tenant id was accepted")
+	}
+}
+
+func TestDeriveDoesNotCreateTenantDirectory(t *testing.T) {
+	root := t.TempDir()
+	paths, err := Derive(root, "tenant_0123456789abcdef0123456789abcdef")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(paths.Root); !os.IsNotExist(err) {
+		t.Fatalf("Derive created tenant root: %v", err)
+	}
+}
+
+func TestResolveRejectsSymlinkedTenantRoot(t *testing.T) {
+	root := t.TempDir()
+	tenantID := "tenant_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	paths, err := Resolve(root, tenantID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Remove(paths.Attachments); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Remove(paths.Root); err != nil {
+		t.Fatal(err)
+	}
+	target := t.TempDir()
+	if err := os.Symlink(target, paths.Root); err != nil {
+		t.Skipf("symlink unavailable: %v", err)
+	}
+	if _, err := Resolve(root, tenantID); err == nil {
+		t.Fatal("symlinked tenant root was accepted")
+	}
+}