fix: harden sing-box egress rollout

tests/test_doctor.py

@@ -1,11 +1,14 @@
 from __future__ import annotations
 
 import json
+import stat
 import subprocess
 import tempfile
 import unittest
 from dataclasses import replace
 from pathlib import Path
+from types import SimpleNamespace
+from unittest import mock
 
 from vpn_egressctl.doctor import Doctor
 from vpn_egressctl.renderer_1_13_19 import render_bytes
@@ -58,6 +61,35 @@ class DoctorTests(unittest.TestCase):
         selected = [check for check in checks if check.name == "tls-insecure"]
         self.assertEqual(selected[0].level, "WARN")
 
+    def test_permissions_reject_non_root_owner_on_posix(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            doctor = Doctor(make_policy(Path(directory)))
+            metadata = SimpleNamespace(
+                st_mode=stat.S_IFREG | 0o600,
+                st_uid=1000,
+                st_gid=1000,
+            )
+            with (
+                mock.patch("vpn_egressctl.doctor.Path.stat", return_value=metadata),
+                mock.patch("vpn_egressctl.doctor.os.name", "posix"),
+            ):
+                doctor._permissions("/protected/file", 0o600)
+        self.assertEqual(doctor.checks[-1].level, "ERROR")
+        self.assertIn("expected 0:0", doctor.checks[-1].message)
+
+    def test_permissions_require_expected_object_type(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            doctor = Doctor(make_policy(Path(directory)))
+            metadata = SimpleNamespace(
+                st_mode=stat.S_IFDIR | 0o700,
+                st_uid=0,
+                st_gid=0,
+            )
+            with mock.patch("vpn_egressctl.doctor.Path.stat", return_value=metadata):
+                doctor._permissions("/protected/file", 0o600)
+        self.assertEqual(doctor.checks[-1].level, "ERROR")
+        self.assertIn("regular file", doctor.checks[-1].message)
+
 
 if __name__ == "__main__":
     unittest.main()