fix: harden maintenance operations

internal/oplog/logger_test.go

@@ -11,6 +11,28 @@ import (
 	"proxyctl/internal/oplog"
 )
 
+func TestLoggerRejectsSymlinkedStateAncestor(t *testing.T) {
+	root := t.TempDir()
+	victim := filepath.Join(root, "victim")
+	if err := os.Mkdir(victim, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(victim, filepath.Join(root, "state")); err != nil {
+		t.Fatal(err)
+	}
+	logger := oplog.New(filepath.Join(root, "state", "proxyctl", "operations.log"), 1024, 1)
+	if err := logger.Write(app.LogEntry{Operation: "reset", Result: "failure"}); err == nil {
+		t.Fatal("logger followed a symlinked state ancestor")
+	}
+	entries, err := os.ReadDir(victim)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) != 0 {
+		t.Fatalf("victim changed: %v", entries)
+	}
+}
+
 func TestLoggerRotatesAtBoundAndNeverStoresAuthenticatedURL(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "state", "proxyctl.log")
 	logger := oplog.New(path, 180, 2)