Fix control socket path detection for non-group users (#30)

Check /run/fips/ directory existence instead of the socket file inside
it. Users not in the fips group can stat the directory but not traverse
it, so the socket file check silently returned false and fell back to
$XDG_RUNTIME_DIR with a misleading "No such file" error.

CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Control socket path detection in fipsctl and fipstop now checks for
+  the `/run/fips/` directory instead of the socket file inside it, so
+  users not yet in the `fips` group get a clear "Permission denied"
+  error instead of a misleading "No such file" fallback to
+  `$XDG_RUNTIME_DIR` ([#30](https://github.com/jmcorgan/fips/issues/30),
+  reported by [@Sebastix](https://github.com/Sebastix))
+
 ## [0.2.0] - 2026-03-22
 
 ### Added

src/bin/fipsctl.rs

@@ -113,8 +113,10 @@ impl ShowCommands {
 ///
 /// Checks the system-wide path first (used when the daemon runs as a
 /// systemd service), then falls back to the user's XDG runtime directory.
+/// Uses directory existence rather than socket file existence so the check
+/// works even when the user lacks traverse permission on /run/fips/ (0750).
 fn default_socket_path() -> PathBuf {
-    if Path::new("/run/fips/control.sock").exists() {
+    if Path::new("/run/fips").exists() {
         PathBuf::from("/run/fips/control.sock")
     } else if let Ok(runtime_dir) = std::env::var("XDG_RUNTIME_DIR") {
         PathBuf::from(format!("{runtime_dir}/fips/control.sock"))

src/bin/fipstop/main.rs

@@ -34,8 +34,10 @@ struct Cli {
 ///
 /// Checks the system-wide path first (used when the daemon runs as a
 /// systemd service), then falls back to the user's XDG runtime directory.
+/// Uses directory existence rather than socket file existence so the check
+/// works even when the user lacks traverse permission on /run/fips/ (0750).
 fn default_socket_path() -> PathBuf {
-    if Path::new("/run/fips/control.sock").exists() {
+    if Path::new("/run/fips").exists() {
         PathBuf::from("/run/fips/control.sock")
     } else if let Ok(runtime_dir) = std::env::var("XDG_RUNTIME_DIR") {
         PathBuf::from(format!("{runtime_dir}/fips/control.sock"))