fix(oci): the access prompt says what it grants, and two checks name what differs

oci/remote/install_oci.sh

@@ -1876,7 +1876,7 @@ while IFS=$'\t' read -r TYPE TARGET SOURCE SIZE BACKUP READ_ONLY CREATE_IF_MISSI
         MOUNT_NOTES+=("$(translate "Access granted to the application on:") $SOURCE")
       else
         oci_log "Could not grant access with an ACL: $SOURCE"
-        MOUNT_WARNINGS+=("$(translate "Access could not be granted; the application cannot write to:") $SOURCE")
+        MOUNT_WARNINGS+=("$(translate "Access could not be granted completely; the application may be unable to write to:") $SOURCE")
       fi
     fi
     if [[ -d $SOURCE ]]; then

oci/remote/oci_instance_transaction.py

@@ -520,7 +520,9 @@ def preflight(record, candidate, config, coordinated=None):
             else:
                 raise ValueError(translate('Unsupported mount type'))
             paths.append(target)
-    if cfg.get('unprivileged', '0') != ('1' if unprivileged else '0') or ':' not in cfg.get('rootfs', ''):
+    if cfg.get('unprivileged', '0') != ('1' if unprivileged else '0'):
+        raise ValueError(translate('The privilege mode of the container does not match the saved record'))
+    if ':' not in cfg.get('rootfs', ''):
         raise ValueError(translate('The container disks do not match the saved record'))
     if desired['rootfs'] != deployment['rootfs']:
         raise ValueError(translate('Changing the rootfs or its storage requires a separate migration'))

oci/remote/oci_runtime_settings.py

@@ -92,7 +92,7 @@ def check(config, deployment, vmid):
     includes = [line.split(': ',1)[1] for line in lines if line.startswith('lxc.include: ')]
     if deployment.get('host_monitor'):
         if not host_monitor_include(includes):
-            raise ValueError(translate('The sysctl include is unknown or differs from the saved record'))
+            raise ValueError(translate('The host monitor include is unknown or differs from the saved record'))
         return
     content = sysctl_content(deployment)
     allowed = [[str(include_path(vmid))], [str(legacy_include_path(vmid))]] if content else [[]]

oci/src/proxmenux_oci/installer.py

@@ -194,13 +194,17 @@ def ask_shared_directories(ui, template: dict[str, Any], mounts: list[dict[str,
             uid, gid = int(owner.get("uid", 0)) + shift, int(owner.get("gid", 0)) + shift
             if os.path.isdir(mount["source"]) and not host.can_write(mount["source"], uid, gid):
                 title = source_text(template["catalog_ui"]["title"]) or app_id
+                # The rules name the identity of the application and, in an
+                # unprivileged container, the one its root has on the host.
+                ids = ", ".join(str(value) for value in dict.fromkeys([uid, gid, *([shift] if shift else [])]))
                 if ui.confirm(translate(
                         "{path} already exists and belongs to another user of the host, so {app} cannot "
-                        "write to it.\n\nProxMenux can add an access rule (ACL) for the identity {app} uses "
-                        "on the host (UID {uid}). Nothing that is there changes owner or permissions: "
-                        "whatever reads or writes those files today keeps doing so, and the owner of the "
-                        "directory also gets access to the files {app} creates.\n\nGrant {app} access to "
-                        "this directory?").format(path=mount["source"], app=title, uid=uid), True):
+                        "write to it.\n\nProxMenux can add access rules (ACL) to this directory, to "
+                        "everything inside it and to what is created there later, for the users and groups "
+                        "{app} runs as on the host (IDs {ids}). The owner of the files does not change and "
+                        "whatever reads or writes them today keeps doing so; the owner of the directory "
+                        "also gets access to the files {app} creates.\n\nGrant {app} access to this "
+                        "directory?").format(path=mount["source"], app=title, ids=ids), True):
                     mount["grant_access"] = True
         from .custom_mounts import validate_mount
         mount["container_path"] = validate_mount(mount, [*mounts, *added])

oci/tests/test_shared_directories.py

@@ -145,8 +145,9 @@ class SharedDirectoriesTests(unittest.TestCase):
                 question = next(text for text in ui.asked if "Grant ShareCoveX access" in text)
                 # The identity is the one of the volumes, in the range of an unprivileged container.
                 check.assert_called_once_with(directory, 101000, 101000)
-                self.assertIn("UID 101000", question)
-                self.assertIn("changes owner or permissions", question)
+                # The identity and the root of the container, as the host sees them.
+                self.assertIn("(IDs 101000, 100000)", question)
+                self.assertIn("everything inside it and to what is created there later", question)
                 self.assertIs(plan["mounts"][1]["grant_access"], True)
                 _ui, _template, declined = self.build({**answers, question: [False]})
                 self.assertNotIn("grant_access", declined["mounts"][1])
@@ -162,9 +163,10 @@ class SharedDirectoriesTests(unittest.TestCase):
                 first = build_deployment(template, ui, ADVANCED_MODE)
                 prompt = next(text for text in ui.asked if nfsv4 in text)
                 check.reset_mock()
-                build_deployment(self.catalog.compose("sharecovex"), ScriptedUI({**answers, prompt: [True]}),
-                                 ADVANCED_MODE)
+                privileged = ScriptedUI({**answers, prompt: [True]})
+                build_deployment(self.catalog.compose("sharecovex"), privileged, ADVANCED_MODE)
                 check.assert_called_once_with(directory, 1000, 1000)
+                self.assertTrue(any("(IDs 1000)" in text for text in privileged.asked))
                 self.assertIsNotNone(first)
 
     def test_a_directory_that_does_not_exist_yet_is_created_for_the_application(self, *_):