feat(loadtest): sync add real 500-session capacity harness

internal/loadharness/storage_test.go

@@ -0,0 +1,88 @@
+package loadharness
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+)
+
+func TestEncryptedFileStorageRoundTripAndNonceRotation(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "session.bin")
+	var key [32]byte
+	for i := range key {
+		key[i] = byte(i + 1)
+	}
+	storage := &EncryptedFileStorage{Path: path, Key: key}
+	plain := []byte(`{"auth_key":"plaintext-secret-marker"}`)
+	if err := storage.StoreSession(context.Background(), plain); err != nil {
+		t.Fatal(err)
+	}
+	first, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Contains(first, []byte("plaintext-secret-marker")) {
+		t.Fatal("encrypted session retained plaintext auth material")
+	}
+	if got, err := storage.LoadSession(context.Background()); err != nil || !bytes.Equal(got, plain) {
+		t.Fatalf("round trip = %q, %v", got, err)
+	}
+	if err := storage.StoreSession(context.Background(), plain); err != nil {
+		t.Fatal(err)
+	}
+	second, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Equal(first, second) {
+		t.Fatal("successive session writes reused ciphertext/nonce")
+	}
+	wrong := key
+	wrong[0] ^= 0xff
+	if _, err := (&EncryptedFileStorage{Path: path, Key: wrong}).LoadSession(context.Background()); err == nil {
+		t.Fatal("wrong session key unexpectedly authenticated")
+	}
+	if runtime.GOOS != "windows" {
+		info, err := os.Stat(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got := info.Mode().Perm(); got != 0o600 {
+			t.Fatalf("session mode = %o, want 600", got)
+		}
+	}
+}
+
+func TestSessionKeyGenerationRefusesOverwrite(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "session.key")
+	if err := GenerateSessionKey(path); err != nil {
+		t.Fatal(err)
+	}
+	first, err := LoadSessionKey(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first == ([32]byte{}) {
+		t.Fatal("generated all-zero key")
+	}
+	if err := GenerateSessionKey(path); err == nil {
+		t.Fatal("keygen overwrote an existing key")
+	}
+}
+
+func TestWriteFileAtomicReplacesExisting(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "report.json")
+	if err := writeFileAtomic(path, []byte("first"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := writeFileAtomic(path, []byte("second"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got, err := os.ReadFile(path); err != nil || string(got) != "second" {
+		t.Fatalf("replacement = %q, %v", got, err)
+	}
+}