Keep a directory owner's settings at the controller's terminal (issue 279)

Root chowns a directory to the number its owner's setting names, so a key
an owner asks for must not change through the settings verb: any caller
could have set puid to 0 or to its own uid. TerminalKeys now takes every
${setting:…} in a directory's owner, whatever else asks for it, and the
owner is written as the parsed number so "0001" never reaches the
node-engine as text (review 60).

cmd/mesh-controller/terminal_settings_test.go

@@ -344,3 +344,58 @@ func TestAnyKeyOfAModuleWithATrustedMergeableFileIsRefusedThroughAVerb(t *testin
 		t.Fatalf("a file marked untrusted through the verb: %v", err)
 	}
 }
+
+// Who owns a module's directory is said at the terminal alone (novox/hq issue 279): a directory's owner may name
+// the settings the module runs as, root chowns the folder to them at the next push, and through the settings verb
+// any caller could have set puid to 0 or to its own uid. The key is refused through every verb route even where a
+// file nothing trusts also asks for it, and taken at the terminal; the layer a refused call meets is unchanged.
+func TestADirectoryOwnersKeyIsRefusedThroughAVerb(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "sonarr", Version: "1",
+		Resources: []map[string]any{
+			{"id": "recycle-bin", "type": "directory", "mode": "0755", "owner": "${setting:puid}:${setting:pgid}"},
+			{"id": "identity", "type": "file", "path": "/etc/sonarr.env", "mode": "0644", "trusted": false,
+				"content": "PUID=${setting:puid}\nPGID=${setting:pgid}\nX=${setting:x}\n"}}})
+	if err := atTheTerminal(t, "settings", "set", "sonarr", `{"puid":1001,"pgid":2000,"x":0}`,
+		"--node", "anchor"); err != nil {
+		t.Fatalf("the owner at the terminal: %v", err)
+	}
+	if _, err := assign(ctx, open, "anchor", "sonarr"); err != nil {
+		t.Fatal(err)
+	}
+	layer := func() string {
+		t.Helper()
+		values, _, err := open.inventory.Layer(ctx, "anchor", "sonarr")
+		if err != nil {
+			t.Fatal(err)
+		}
+		raw, _ := json.Marshal(values)
+		return string(raw)
+	}
+	kept := layer()
+	refused := func(what string, err error) {
+		t.Helper()
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal") {
+			t.Fatalf("%s: %v", what, err)
+		}
+	}
+	refused("puid 0 through the verb", throughVerb(t, "settings", map[string]any{"module": "sonarr",
+		"node": "anchor", "values": `{"puid":0,"pgid":2000,"x":0}`}))
+	refused("pgid through the verb, mesh-wide", throughVerb(t, "settings", map[string]any{"module": "sonarr",
+		"values": `{"pgid":0}`}))
+	refused("cleared through the verb", throughVerb(t, "settings", map[string]any{"module": "sonarr",
+		"node": "anchor", "clear": "true"}))
+	if err := throughVerb(t, "command", map[string]any{
+		"command": `settings set sonarr '{"puid":0,"pgid":2000,"x":0}' --node anchor`}); err == nil {
+		t.Fatal("the command verb set the owner")
+	}
+	if got := layer(); got != kept {
+		t.Fatalf("a refused call changed the layer: %s, was %s", got, kept)
+	}
+	// Another key, the owner kept, is still the verb's.
+	if err := throughVerb(t, "settings", map[string]any{"module": "sonarr", "node": "anchor",
+		"values": `{"puid":1001,"pgid":2000,"x":1}`}); err != nil {
+		t.Fatalf("another key through the verb, the owner kept: %v", err)
+	}
+}