feat: establish secure update foundation

internal/secure/secure_test.go

@@ -56,6 +56,13 @@ func TestLoadOrCreateCipherPersistsSecureKey(t *testing.T) {
 	if permissions := info.Mode().Perm(); permissions != 0o600 {
 		t.Fatalf("master key permissions = %o, want 600", permissions)
 	}
+	directoryInfo, err := os.Stat(filepath.Dir(path))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if permissions := directoryInfo.Mode().Perm(); permissions != 0o700 {
+		t.Fatalf("master key directory permissions = %o, want 700", permissions)
+	}
 	ciphertext, nonce, err := first.Encrypt("persistent token")
 	if err != nil {
 		t.Fatal(err)
@@ -70,6 +77,23 @@ func TestLoadOrCreateCipherPersistsSecureKey(t *testing.T) {
 	}
 }
 
+func TestLoadCipherRejectsSymlinkedMasterKey(t *testing.T) {
+	t.Parallel()
+	directory := t.TempDir()
+	target := filepath.Join(directory, "target")
+	key := make([]byte, 32)
+	if err := os.WriteFile(target, []byte(base64.RawStdEncoding.EncodeToString(key)), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(directory, "master_key")
+	if err := os.Symlink(target, link); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := LoadCipher(link); err == nil {
+		t.Fatal("symlinked master key was accepted")
+	}
+}
+
 func TestPasswordHash(t *testing.T) {
 	t.Parallel()
 	hash, err := HashPassword("a secure password")