F-LEAK third attempt: band-scoped fenced destroy (v0.110.0)

The per-VM ACL is consumed by the destroy it authorises (PVE remove_vm_access,
LXC.pm:906), so it works once per slot. Fourth root-fenced exception, band-enforced in
sudoers literally + in code + at the caller. API destroy still tried first.

internal/proxmox/scratch_destroy_test.go

@@ -0,0 +1,101 @@
+package proxmox
+
+import (
+	"context"
+	"io"
+	"strings"
+	"testing"
+)
+
+// F-LEAK (Campaign 8): the fourth root-fenced exception. Its whole justification is that the band is
+// enforced rather than assumed, so these tests are about the REFUSALS, not the happy path.
+//
+// The band is checked in three independent places on purpose: sudoers matches the vmid literally
+// (`pct destroy 99000[0-9] --purge`), this method re-checks before exec, and the caller checks journal
+// provenance. These tests pin the middle one; the sudoers glob is proven live.
+
+type recordingRunner struct {
+	calls [][]string
+	err   error
+}
+
+func (r *recordingRunner) Run(_ context.Context, name string, args ...string) ([]byte, []byte, error) {
+	r.calls = append(r.calls, append([]string{name}, args...))
+	return nil, nil, r.err
+}
+
+func (r *recordingRunner) RunStdin(_ context.Context, _ io.Reader, name string, args ...string) ([]byte, []byte, error) {
+	r.calls = append(r.calls, append([]string{name}, args...))
+	return nil, nil, r.err
+}
+
+// A vmid inside the band is destroyed, with --purge so no config/ACL/firewall residue survives.
+//
+// RED-PROOF: drop "--purge" from the args → this fails with "destroy is not --purge", and the live
+// sudoers rule (which matches the FULL vector including --purge) would refuse the call outright.
+func TestDestroyScratchLXC_InBandDestroysWithPurge(t *testing.T) {
+	r := &recordingRunner{}
+	if err := NewPrivileged(r, "").DestroyScratchLXC(context.Background(), 990003, 990000, 990009); err != nil {
+		t.Fatalf("in-band destroy failed: %v", err)
+	}
+	if len(r.calls) != 1 {
+		t.Fatalf("want exactly 1 exec, got %d: %v", len(r.calls), r.calls)
+	}
+	got := strings.Join(r.calls[0], " ")
+	if got != "pct destroy 990003 --purge" {
+		t.Errorf("exec vector = %q, want %q (it must match the sudoers rule byte for byte)",
+			got, "pct destroy 990003 --purge")
+	}
+}
+
+// THE ONE THAT MATTERS. A vmid outside the band must be refused WITHOUT EXECUTING ANYTHING — a real
+// customer guest, the golden image, a co-tenant's VM.
+//
+// RED-PROOF: remove the `vmid < bandMin || vmid > bandMax` check → this fails with
+// "REFUSAL FAILED: executed [pct destroy 9201 --purge] for out-of-band vmid 9201".
+func TestDestroyScratchLXC_RefusesOutOfBandWithoutExecuting(t *testing.T) {
+	for _, vmid := range []int{
+		1,      // arbitrary
+		9201,   // the LIVE customer guest on both demo boxes
+		9100,   // golden image
+		9999,   // reserved
+		989999, // one below the band
+		990010, // one ABOVE the band — the off-by-one
+	} {
+		r := &recordingRunner{}
+		err := NewPrivileged(r, "").DestroyScratchLXC(context.Background(), vmid, 990000, 990009)
+		if err == nil {
+			t.Errorf("vmid %d was NOT refused — the fence is open", vmid)
+		}
+		if len(r.calls) != 0 {
+			t.Errorf("REFUSAL FAILED: executed %v for out-of-band vmid %d", r.calls, vmid)
+		}
+		if err != nil && !strings.Contains(err.Error(), "outside the scratch band") {
+			t.Errorf("vmid %d refused with an unhelpful error: %v", vmid, err)
+		}
+	}
+}
+
+// An unconfigured or inverted band must refuse everything rather than defaulting to something. A zero
+// band is what a mis-wired caller looks like, and "destroy vmid 0" must never become reachable.
+//
+// RED-PROOF: drop the `bandMin <= 0 || bandMax < bandMin` check → the [0,0] case admits vmid 0 and
+// this fails with "an unconfigured band admitted vmid 0".
+func TestDestroyScratchLXC_RefusesUnconfiguredBand(t *testing.T) {
+	cases := []struct{ vmid, min, max int }{
+		{0, 0, 0},                // nothing configured at all
+		{990000, 0, 0},           // band absent, real scratch vmid
+		{990000, 0, 990009},      // min unset
+		{990005, 990009, 990000}, // inverted
+		{990000, -1, 990009},     // negative
+	}
+	for _, c := range cases {
+		r := &recordingRunner{}
+		if err := NewPrivileged(r, "").DestroyScratchLXC(context.Background(), c.vmid, c.min, c.max); err == nil {
+			t.Errorf("band [%d,%d] admitted vmid %d — an unconfigured band must refuse", c.min, c.max, c.vmid)
+		}
+		if len(r.calls) != 0 {
+			t.Errorf("an unconfigured band admitted vmid %d and EXECUTED %v", c.vmid, r.calls)
+		}
+	}
+}