fix user profile unload

[Tess Gauthier (tgauth)]

PR Summary

• ensures that UnloadUserProfile() is called when sshd-session child process for the connection is reaped using user's token (duplicated to ensure only permissions required to UnloadUserProfile() are persisted).
• fixes some token cleanup at the same time - removes CloseHandle(user_token) for gss-api as its owned by gss_release_cred() and ensures global password_auth_token is not left dangling.
• adds Pester test to verify UnloadUserProfile() is working.

PR Context

• fix open handles to users registry files make it impossible to delete user profile after ssh connection Win32-OpenSSH#1694

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR fixes a Windows-specific resource leak by ensuring user profiles loaded for session processes are reliably unloaded when the corresponding sshd-session child process is reaped, and it tightens token lifecycle handling for password-auth and SSPI/GSS scenarios. It also adds a Pester regression test targeting Win32-OpenSSH issue #1694.

Changes:

• Track per-child loaded profile handles + a dedicated token for later UnloadUserProfile() during SIGCHLD-based child reaping.
• Fix token cleanup semantics (avoid closing SSPI-owned tokens; clear password_auth_token after use).
• Add a Pester regression test that checks the user hive is unloaded after a session ends.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
regress/pesterTests/UserProfileUnload.Tests.ps1	Adds a regression test for user hive unload after session exit.
contrib/win32/win32compat/win32_usertoken_utils.c	Returns the loaded profile handle from load_user_profile() and adds unload_user_profile().
contrib/win32/win32compat/spawn-ext.c	Loads profile before spawning, duplicates a minimal token for later unload, registers child/profile association, and corrects token cleanup behavior.
contrib/win32/win32compat/signal_sigchld.c	Stores and unloads per-child profiles/tokens when removing children from the tracking table.
contrib/win32/win32compat/signal_internal.h	Extends child tracking structure and adds register_child_profile() declaration.
contrib/win32/win32compat/misc_internal.h	Updates load_user_profile() signature and declares unload_user_profile().

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Tess Gauthier (tgauth)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Tess Gauthier (tgauth)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Tess Gauthier (tgauth)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Tess Gauthier (tgauth)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Tess Gauthier (tgauth)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).