Fix step-ca root CA access on Linux CI

Host chmod cannot open 0700 dirs owned by UID 1000, so
`-f` never sees root_ca.crt. Chmod from inside the
container as root while waiting for the cert.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/complianceportal/session.go

@@ -39,6 +39,7 @@ func NewSessionHostMiddleware(cookieConfig securecookie.Config) func(next http.H
 		return http.HandlerFunc(
 			func(w http.ResponseWriter, r *http.Request) {
 				ctx := r.Context()
+
 				session := authn.SessionFromContext(ctx)
 				if session == nil {
 					next.ServeHTTP(w, r)
@@ -52,6 +53,7 @@ func NewSessionHostMiddleware(cookieConfig securecookie.Config) func(next http.H
 				}
 
 				securecookie.Clear(w, cookieConfig)
+
 				ctx = authn.ContextWithSession(ctx, nil)
 				ctx = authn.ContextWithIdentity(ctx, nil)
 				next.ServeHTTP(w, r.WithContext(ctx))

pkg/server/api/complianceportal/session_test.go

@@ -49,6 +49,7 @@ func TestSessionHostMiddleware_RejectsMismatchedHost(t *testing.T) {
 	handler := NewSessionHostMiddleware(securecookie.Config{Name: "ssid"})(
 		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			authenticated = authn.IdentityFromContext(r.Context()) != nil
+
 			w.WriteHeader(http.StatusOK)
 		}),
 	)
@@ -80,6 +81,7 @@ func TestSessionHostMiddleware_AllowsMatchingTLSHost(t *testing.T) {
 	handler := NewSessionHostMiddleware(securecookie.Config{Name: "ssid"})(
 		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			authenticated = authn.IdentityFromContext(r.Context()) != nil
+
 			w.WriteHeader(http.StatusOK)
 		}),
 	)
@@ -111,6 +113,7 @@ func TestSessionHostMiddleware_RejectsSpoofedHostHeader(t *testing.T) {
 	handler := NewSessionHostMiddleware(securecookie.Config{Name: "ssid"})(
 		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			authenticated = authn.IdentityFromContext(r.Context()) != nil
+
 			w.WriteHeader(http.StatusOK)
 		}),
 	)

pkg/server/api/complianceportal/v1/brand_logo_handler.go

@@ -63,6 +63,7 @@ func (h *brandLogoHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 
 	var fileID *gid.GID
+
 	switch h.variant {
 	case brandLogoVariantLogo:
 		fileID = compliancePage.LogoFileID

pkg/server/api/complianceportal/v1/oauth_callback_handler.go

@@ -77,6 +77,7 @@ func (h *OAuthCallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
 	}
 
 	code := r.URL.Query().Get("code")
+
 	stateToken := r.URL.Query().Get("state")
 	if code == "" || stateToken == "" {
 		httpserver.RenderError(w, http.StatusBadRequest, errInvalidOAuthRequest)
@@ -92,6 +93,7 @@ func (h *OAuthCallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
 	}
 
 	portal := complianceportal.CompliancePageFromContext(ctx)
+
 	portalBaseURL := complianceportal.CompliancePageBaseURLFromContext(ctx)
 	if portal == nil || portalBaseURL == nil {
 		httpserver.RenderError(w, http.StatusNotFound, errNotFound)

pkg/server/api/connect/v1/magic_link_handler_test.go

@@ -105,5 +105,4 @@ func TestMagicLinkHandler_SendHandler_Validation(t *testing.T) {
 
 		assert.Equal(t, http.StatusBadRequest, rec.Code)
 	})
-
 }

pkg/server/api/console/v1/trust_center_resolvers.go

@@ -142,6 +142,7 @@ func (r *customDomainResolver) Certificate(ctx context.Context, obj *types.Custo
 		}
 
 		r.logger.ErrorCtx(ctx, "cannot load certificate", log.Error(err))
+
 		return nil, gqlutils.Internal(ctx)
 	}
 
@@ -1204,6 +1205,7 @@ func (r *trustCenterResolver) DefaultDomain(ctx context.Context, obj *types.Trus
 		}
 
 		r.logger.ErrorCtx(ctx, "cannot load default domain", log.Error(err))
+
 		return nil, gqlutils.Internal(ctx)
 	}
 
@@ -1228,6 +1230,7 @@ func (r *trustCenterResolver) CustomDomain(ctx context.Context, obj *types.Trust
 		}
 
 		r.logger.ErrorCtx(ctx, "cannot load custom domain", log.Error(err))
+
 		return nil, gqlutils.Internal(ctx)
 	}
 

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -4953,6 +4953,7 @@ func (r *Resolver) UpdateTrustCenterTool(ctx context.Context, req *mcp.CallToolR
 	updateReq.WebsiteURL = UnwrapOmittable(input.WebsiteURL)
 	updateReq.Email = UnwrapOmittable(input.Email)
 	updateReq.HeadquarterAddress = UnwrapOmittable(input.HeadquarterAddress)
+
 	if title := UnwrapOmittable(input.Title); title != nil {
 		updateReq.Title = *title
 	}