fix(notify): cover expiry cleanup and harden the image-removal guard

Split the dismiss test so expiry is exercised on its own: Expire removes
the image without deleting the inert entry, and nothing asserted it.

removeImage now requires filepath.Dir(filepath.Clean(path)) to equal the
image directory, so a path carrying .. cannot reach a sibling daemon file
such as queue.json. The previous prefix test accepted it. Not exploitable
until Task 4 populates Popup.Image from a client hint, which is exactly
why the guard is fixed now.

1 files changed, 11 insertions, 1 deletions

diff --git a/internal/notify/store_test.go b/internal/notify/store_test.go
index a0ab7be..13f78dc 100644
--- a/internal/notify/store_test.go
+++ b/internal/notify/store_test.go
@@ -133,7 +133,7 @@ func TestHistoryRingCapsAtTwenty(t *testing.T) {
 	}
 }
 
-func TestStoreRemovesImageOnDismissAndExpire(t *testing.T) {
+func TestStoreRemovesImageOnDismiss(t *testing.T) {
 	var removed []string
 	s := NewStore(func(uint32, uint32) {}, func(_, _ []Popup) {}, func(p string) { removed = append(removed, p) })
 	id, _ := s.Add(&Popup{Image: "/run/img/1.png"}, "", 0)
@@ -144,6 +144,16 @@ func TestStoreRemovesImageOnDismissAndExpire(t *testing.T) {
 	}
 }
 
+func TestStoreRemovesImageOnExpire(t *testing.T) {
+	var removed []string
+	s := NewStore(func(uint32, uint32) {}, func(_, _ []Popup) {}, func(p string) { removed = append(removed, p) })
+	id, _ := s.Add(&Popup{Image: "/run/img/expire.png"}, "", 0)
+	s.Expire(id)
+	if len(removed) != 1 || removed[0] != "/run/img/expire.png" {
+		t.Fatalf("expire removed %v", removed)
+	}
+}
+
 func TestStoreRemovesImageOnReplace(t *testing.T) {
 	var removed []string
 	s := NewStore(func(uint32, uint32) {}, func(_, _ []Popup) {}, func(p string) { removed = append(removed, p) })