chore: establish local platform baseline

internal/deviceauth/directory_secret_test.go

@@ -0,0 +1,59 @@
+package deviceauth
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestDirectorySecretResolverReadsPerDeviceSecretAndObservesRotation(t *testing.T) {
+	root := t.TempDir()
+	path := filepath.Join(root, "terminal-001")
+	first := strings.Repeat("a", 40)
+	if err := os.WriteFile(path, []byte(first+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	resolver, err := NewDirectorySecretResolver(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	secret, err := resolver.Resolve(context.Background(), "device-secret://terminal-001")
+	if err != nil || string(secret) != first {
+		t.Fatalf("secret=%q err=%v", secret, err)
+	}
+	second := strings.Repeat("b", 48)
+	if err := os.WriteFile(path, []byte(second), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	secret, err = resolver.Resolve(context.Background(), "device-secret://terminal-001")
+	if err != nil || string(secret) != second {
+		t.Fatalf("rotated secret=%q err=%v", secret, err)
+	}
+}
+
+func TestDirectorySecretResolverRejectsUnsafeOrInvalidReferences(t *testing.T) {
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, "short"), []byte("too-short"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	resolver, err := NewDirectorySecretResolver(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, reference := range []string{
+		"local-dev://terminal-1", "device-secret://../outside", "device-secret://nested/file", "device-secret://short", "device-secret://missing",
+	} {
+		if _, err := resolver.Resolve(context.Background(), reference); !errors.Is(err, ErrCredentialInvalid) {
+			t.Fatalf("Resolve(%q) error=%v", reference, err)
+		}
+	}
+}
+
+func TestDirectorySecretResolverRequiresExistingAbsoluteDirectory(t *testing.T) {
+	if _, err := NewDirectorySecretResolver("relative/secrets"); err == nil {
+		t.Fatal("relative directory must be rejected")
+	}
+}