refactor: simplify path policy and TUI reducers

internal/securefs/securefs.go

@@ -14,6 +14,8 @@ import (
 	"strings"
 
 	"golang.org/x/sys/unix"
+
+	"proxyctl/internal/pathutil"
 )
 
 type Owner struct{ UID, GID int }
@@ -341,7 +343,4 @@ func regular(file *os.File) error {
 	return nil
 }
 
-func within(path, root string) bool {
-	relative, err := filepath.Rel(root, path)
-	return err == nil && relative != ".." && !strings.HasPrefix(relative, ".."+string(filepath.Separator))
-}
+func within(path, root string) bool { return pathutil.Within(path, root) }

internal/securefs/securefs_test.go

@@ -0,0 +1,68 @@
+package securefs_test
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"proxyctl/internal/securefs"
+)
+
+func TestAtomicWriteCreatesAndReplacesRegularFile(t *testing.T) {
+	root := t.TempDir()
+	path := filepath.Join(root, "state", "config.json")
+	store := securefs.Store{TrustedRoot: root}
+	if err := store.AtomicWrite(path, []byte("first\n"), 0o640); err != nil {
+		t.Fatal(err)
+	}
+	if err := store.AtomicWrite(path, []byte("second\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(data) != "second\n" || info.Mode().Perm() != 0o600 {
+		t.Fatalf("content=%q mode=%o", data, info.Mode().Perm())
+	}
+}
+
+func TestAtomicWriteRejectsSymlinkWithoutChangingVictim(t *testing.T) {
+	root := t.TempDir()
+	victim := filepath.Join(root, "victim")
+	if err := os.WriteFile(victim, []byte("unchanged"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(root, "managed")
+	if err := os.Symlink(victim, path); err != nil {
+		t.Fatal(err)
+	}
+	store := securefs.Store{TrustedRoot: root}
+	if err := store.AtomicWrite(path, []byte("replaced"), 0o600); err == nil {
+		t.Fatal("AtomicWrite followed a final symlink")
+	}
+	data, err := os.ReadFile(victim)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(data) != "unchanged" {
+		t.Fatalf("victim changed: %q", data)
+	}
+}
+
+func TestStoreRejectsPathsOutsideTrustedRoot(t *testing.T) {
+	root := t.TempDir()
+	outside := filepath.Join(t.TempDir(), "outside")
+	store := securefs.Store{TrustedRoot: root}
+	if err := store.AtomicWrite(outside, []byte("data"), 0o600); err == nil {
+		t.Fatal("AtomicWrite escaped TrustedRoot")
+	}
+	if _, err := os.Stat(outside); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("outside path changed: %v", err)
+	}
+}