test(storage): isolate temp directories in tests

Cargo.lock

@@ -550,6 +550,7 @@ dependencies = [
  "rusqlite",
  "serde",
  "serde_json",
+ "tempfile",
  "thiserror 2.0.18",
  "tracing",
  "zeroize",

crates/chanora_storage/Cargo.toml

@@ -28,3 +28,6 @@ serde_json = "1"
 # in-memory provider, so we keep a file-on-disk fallback there.
 [target.'cfg(any(target_os = "linux", target_os = "macos", target_os = "windows", target_os = "ios"))'.dependencies]
 keyring = { version = "3", default-features = false, features = ["sync-secret-service", "linux-native", "apple-native", "windows-native"] }
+
+[dev-dependencies]
+tempfile = "3"

crates/chanora_storage/src/lib.rs

@@ -1021,6 +1021,7 @@ impl BookmarkRepository {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use tempfile::TempDir;
 
     /// Tests always run against the file fallback. A real keyring
     /// hit would either prompt the developer or block on a missing
@@ -1179,7 +1180,7 @@ mod tests {
         force_keyring_off();
         let tmp = tempdir();
         // Pre-Beta on-disk format: raw base64 with counter prefix.
-        let path = tmp.join("identity.tskey");
+        let path = tmp.path().join("identity.tskey");
         fs::write(&path, b"9999VabcdefghIJKLmnop=\n").unwrap();
         let store = IdentityFileStore::new(&tmp).unwrap();
         let v = store.load().unwrap();
@@ -1212,7 +1213,7 @@ mod tests {
             })
             .unwrap();
         // The on-disk row must not contain the plain password.
-        let conn = rusqlite::Connection::open(tmp.join("chanora.db")).unwrap();
+        let conn = rusqlite::Connection::open(tmp.path().join("chanora.db")).unwrap();
         let row: (Option<String>, Option<Vec<u8>>) = conn
             .query_row(
                 "SELECT password, password_blob FROM bookmarks WHERE id=?1",
@@ -1261,7 +1262,7 @@ mod tests {
             password: Some("old".to_string()),
         })
         .unwrap();
-        let conn = rusqlite::Connection::open(tmp.join("chanora.db")).unwrap();
+        let conn = rusqlite::Connection::open(tmp.path().join("chanora.db")).unwrap();
         let row: (Option<String>, Option<Vec<u8>>) = conn
             .query_row(
                 "SELECT password, password_blob FROM bookmarks WHERE id=?1",
@@ -1304,18 +1305,22 @@ mod tests {
         assert_eq!(store.get_release_tail_ms(), 0);
     }
 
-    fn tempdir() -> PathBuf {
+    #[test]
-        let p = std::env::temp_dir()
+    fn tempdir_is_cleaned_up_on_drop() {
-            .join("chanora_storage_test")
+        let path = {
-            .join(std::process::id().to_string())
+            let tmp = tempdir();
-            .join(
+            let path = tmp.path().to_path_buf();
-                std::time::SystemTime::now()
+            assert!(path.exists());
-                    .duration_since(std::time::UNIX_EPOCH)
+            path
-                    .unwrap()
+        };
-                    .as_nanos()
+
-                    .to_string(),
+        assert!(!path.exists());
-            );
+    }
-        fs::create_dir_all(&p).unwrap();
+
-        p
+    fn tempdir() -> TempDir {
+        tempfile::Builder::new()
+            .prefix("chanora_storage_test_")
+            .tempdir()
+            .unwrap()
     }
 }