Present desktop authentication and automatic relocking

crates/storage/tests/config_contract.rs

@@ -63,8 +63,11 @@ fn explicit_relative_configuration_resolves_deterministically() -> TestResult {
         .loader()
         .load(Some(Path::new("config/config.toml")))?;
 
-    assert_eq!(config.source(), fixture.explicit_path());
-    assert_eq!(config.vault(), fixture.temporary.path().join("cwd/vault"));
+    assert_eq!(config.source(), fs::canonicalize(fixture.explicit_path())?);
+    assert_eq!(
+        config.vault(),
+        fs::canonicalize(fixture.temporary.path())?.join("cwd/vault")
+    );
     assert_eq!(
         config.key_material(),
         fs::canonicalize(fixture.temporary.path().join("cwd/config/keys"))?
@@ -170,7 +173,7 @@ fn native_default_path_is_used_without_an_explicit_path() -> TestResult {
     fs::write(&default, fixture.valid_contents())?;
 
     let config = fixture.loader().load(None)?;
-    assert_eq!(config.source(), default);
+    assert_eq!(config.source(), fs::canonicalize(default)?);
     Ok(())
 }
 

crates/storage/tests/git_embedded.rs

@@ -110,7 +110,10 @@ fn nested_repository_selection_is_innermost() -> TestResult {
 
     let selected =
         GitRepository::open_innermost(&outer_store, Path::new("nested/secret.gpg"), identity())?;
-    assert_eq!(selected.root(), temporary.path().join("nested"));
+    assert_eq!(
+        selected.root(),
+        fs::canonicalize(temporary.path().join("nested"))?
+    );
     Ok(())
 }
 

crates/storage/tests/repository_core.rs

@@ -155,7 +155,7 @@ fn hostile_logical_paths_are_rejected_before_filesystem_access() {
 fn symlinks_and_unsupported_file_types_are_rejected() -> TestResult {
     use std::os::unix::fs::symlink;
 
-    use rustix::fs::{CWD, Mode, mkfifoat};
+    use nix::{sys::stat::Mode, unistd::mkfifo};
 
     let temporary = tempfile::tempdir()?;
     let vault = temporary.path().join("vault");
@@ -174,10 +174,9 @@ fn symlinks_and_unsupported_file_types_are_rejected() -> TestResult {
     assert_eq!(fs::read(temporary.path().join("outside.gpg"))?, b"outside");
 
     fs::remove_file(vault.join("escape.gpg"))?;
-    mkfifoat(
-        CWD,
-        vault.join("unsupported.gpg"),
-        Mode::from_raw_mode(0o600),
+    mkfifo(
+        &vault.join("unsupported.gpg"),
+        Mode::from_bits_truncate(0o600),
     )?;
     assert!(matches!(
         repository.snapshot(),