Make main() and the security gates testable (closes #13)

[dolph]

Closes #13.

Summary

Refactors main() and two of the security gates so the gate sequencing and the bit-mask logic are exercisable in-process. Coverage 42.7% → 62.4% (+19.7pts). No production behavior change — same gates fire in the same order with the same user-visible messages.

This addresses the issue's two remaining acceptance criteria after PRs #29 and #38 took the args-handling piece:

• main refactored for testability (closes the "0% on main" gap).
• Each security.go gate has positive and negative tests (closes the "0% on the security gates" gap).

Run's coverage is still tracked separately by #14 (the integration-test issue) — this PR injects runFn so the test for runMain can assert "was Run called?" without actually invoking it.

Refactor shape

security.go

func isExecutableWritable() bool {
    p, err := os.Executable()
    if err != nil { /* unchanged */ }
    return isPathUnsafelyWritable(p)
}

// New: testable against any chmod'd temp file.
func isPathUnsafelyWritable(path string) bool { ... }

// New: testable with uid 0/1/1000 directly.
func uidIsRoot(uid int) bool { return uid == 0 }

func isRunningAsRoot() bool { return uidIsRoot(os.Getuid()) }

ussher.go

type runDeps struct {
    executableWritable func() bool
    runningAsRoot      func() bool
    initLog            func()
    validUser          func(name string) bool
    loadConfig         func(username string, c *Config)
    runFn              func(*Config)
}

func defaultDeps() runDeps { /* production wiring */ }

func runMain(args []string, d runDeps) error {
    // same gate ordering as old main(), returns errors instead of log.Fatal
}

func main() {
    if err := runMain(os.Args, defaultDeps()); err != nil {
        log.Fatal(err)
    }
}

User-visible error messages — "Refusing to run due to permissions issue on the ussher executable", "Refusing to run as root", "User not found" — are preserved verbatim so the existing README troubleshooting headings still match.

The fmt.Println diagnostics inside isPathUnsafelyWritable now include the path being checked ("/usr/local/bin/ussher is group writable" instead of "ussher binary is group writable"). Marginal log-quality improvement; still going to stdout, which is the wrong channel — that's #36, deliberately not in this PR.

Tests added

File	Test	What it covers
ussher_test.go	TestRunMain	6 table-driven cases: missing args, --version short-circuits before any gate (asserted by setting all gates to "would fail" and verifying nothing fired), each gate's failure path, happy path.
ussher_test.go	TestDefaultDeps_AllSet	Sanity that the production wiring leaves nothing nil.
security_test.go	TestUidIsRoot	uid 0 → true; 1, 500, 1000, -1 → false.
security_test.go	TestIsPathUnsafelyWritable	8 modes (0700, 0750, 0755, 0770, 0775, 0707, 0757, 0777) plus a missing-path failsafe case. Uses t.TempDir() and os.Chmod to defeat umask.
security_test.go	TestIsFileWorldWritable	Previously-untested function: non-world-writable, world-writable, missing file.

captureRunMain builds a runDeps that records initLog / loadConfig / runFn invocations so each test can assert "did we short-circuit before getting here?".

Test plan

• go test -race -cover ./... green.
• Coverage 42.7% → 62.4%.
• ./build.sh green.
• Production smoke: ./ussher (no args), ./ussher --version, ./ussher Nonexistent all behave as before — same exit codes, same user-visible messages.
• CI shellcheck + build jobs both green on the PR.

Out of scope

• No end-to-end integration test exercising Run() against a fake source server #14 — integration test for Run. This PR makes runFn injectable so a future PR can plug in an httptest-backed test, but the actual end-to-end coverage of the goroutine fan-out is still that issue's job.
• initLog fallback to ./ussher.log is silently broken by variable shadowing #30 — initLog shadowing bug. This PR injects initLog for testability but leaves the implementation alone. Fixing the shadowing is its own small change.
• security.go writes diagnostics to stdout (sshd's input channel) instead of stderr #36 — fmt.Println to stdout. Touched the surrounding lines; deliberately didn't change the channel. Adopters who see the messages in sshd's auth log are unaffected by this PR; security.go writes diagnostics to stdout (sshd's input channel) instead of stderr #36 is the place to fix that.
• security_test.go hard-codes 'root' and 'nobody' as positive cases — host-dependent #20 — security_test.go hard-codes root/nobody. The new tests don't depend on host users; the existing TestIsValidUser cases still do.

https://claude.ai/code/session_013HnepY8MhhxrJJjE5ysW47

---

Generated by Claude Code

[Jah-yee]

Hi! Just checking in on this PR — it's been open for 14 days without a review. Could you please take a look? Happy to make any changes if needed. Thanks! 🙏

[Jah-yee]

Hi! Just following up on this PR — it's been another day without a review. Happy to address any feedback or make changes. Thanks for your time! 🙏

[Jah-yee]

Friendly ping @dolph 👋 This PR has been waiting ~14 days for review. The fix adds an 8-line config file safety check using the existing isFileWorldWritable helper — purely additive, no breaking changes. Is there anything I can adjust to get this merged? 🙏