Take issue 1843's owner change back out: giving the converter the module root opens a link swap to root (review), so 1843 needs its own design

modules/only-office/manifest_test.go

@@ -125,55 +125,3 @@ func TestLibDirectoryLetsNginxThrough(t *testing.T) {
 	}
 	t.Fatal("manifest declares no lib directory")
 }
-
-// 1843/AC1 (unit: manifest check)
-// Given the catalogue, when only-office's manifest is read, then its state directory (the module
-// root, bind-mounted nowhere, so the container never passes through it) is mode 0710 and belongs
-// to the converter account — the only host process that reaches through the root to read
-// ${dir:state}/jwt.secret and broker-converter.secret — so no other account on the machine can
-// pass through it to the converted documents under lib (which stays 0711, 1837/AC3).
-func TestStateDirectoryBarsOtherAccounts(t *testing.T) {
-	raw, err := os.ReadFile("module.json")
-	if err != nil {
-		t.Fatalf("reading module.json: %v", err)
-	}
-	var m struct {
-		Resources []struct {
-			ID    string `json:"id"`
-			Type  string `json:"type"`
-			Mode  string `json:"mode"`
-			Owner string `json:"owner"`
-			Name  string `json:"name"`
-		} `json:"resources"`
-	}
-	if err := json.Unmarshal(raw, &m); err != nil {
-		t.Fatalf("parsing module.json: %v", err)
-	}
-
-	var converterAccount string
-	for _, r := range m.Resources {
-		if r.Type == "user" {
-			converterAccount = r.Name
-		}
-	}
-	if converterAccount == "" {
-		t.Fatal("manifest declares no user resource for the converter account")
-	}
-
-	var sawState bool
-	for _, r := range m.Resources {
-		if r.ID == "state" && r.Type == "directory" {
-			sawState = true
-			if r.Mode != "0710" {
-				t.Errorf("state directory mode = %q, want 0710", r.Mode)
-			}
-			if r.Owner != converterAccount {
-				t.Errorf("state directory owner = %q, want %q, the converter account (whose own group "+
-					"the mode's group bit then names)", r.Owner, converterAccount)
-			}
-		}
-	}
-	if !sawState {
-		t.Fatal("manifest declares no state directory")
-	}
-}

modules/only-office/module.json

@@ -144,8 +144,7 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0710",
+      "mode": "0711",
-      "owner": "only-office-converter",
       "place": ".",
       "unknown": "program"
     },