1 files changed, 18 insertions, 0 deletions
diff --git a/tests/test_privileges.cpp b/tests/test_privileges.cpp
new file mode 100644
index 0000000..287d654
--- /dev/null
+++ b/tests/test_privileges.cpp
@@ -0,0 +1,18 @@
+#include <doctest/doctest.h>
+#include <unistd.h>
+
+#include "wireframe/privileges.hpp"
+
+// The actual drop sequence (setuid/setgid) can only be meaningfully
+// exercised by literally running as root, which a unit test shouldn't
+// do - permanently dropping the test runner's own privileges mid-suite
+// would be a real, surprising side effect, not a safe thing to assert
+// on. That path is verified live instead (running the real binary via
+// sudo and checking the dropped-to UID actually took effect - see
+// PLAN.md). This only covers the no-op path any non-root test run
+// takes, which is still worth locking in: it must never attempt to
+// touch privileges it doesn't have.
+TEST_CASE("drop_privileges_if_root is a no-op when not running as root") {
+    if (geteuid() == 0) return;  // this test only makes sense unprivileged
+    CHECK_FALSE(wireframe::drop_privileges_if_root().has_value());
+}