direct: Fix handling of case where a work tree subdirectory cannot be written to due to permissions.

Running `git annex direct` would cause loss of data, because the object
was moved to a temp file, which it then tried to replace the work tree file
with, and on failure, the temp file got deleted. Now it's instead moved
back into the annex object location.

Annex/Direct.hs

@@ -354,7 +354,11 @@ toDirectGen k f = do
 		void $ addAssociatedFile k f
 		modifyContent loc $ do
 			thawContent loc
-			replaceFile f $ liftIO . moveFile loc
+			replaceFileOr f
+				(liftIO . moveFile loc)
+				$ \tmp -> do -- rollback
+					liftIO (moveFile tmp loc)
+					freezeContent loc
 	fromdirect loc = do
 		replaceFile f $
 			liftIO . void . copyFileExternal loc

Annex/ReplaceFile.hs

@@ -23,11 +23,16 @@ import Annex.Exception
  - Throws an IO exception when it was unable to replace the file.
  -}
 replaceFile :: FilePath -> (FilePath -> Annex ()) -> Annex ()
-replaceFile file a = do
+replaceFile file action = replaceFileOr file action (liftIO . nukeFile)
+
+{- If unable to replace the file with the temp file, runs the
+ - rollback action, which is responsible for cleaning up the temp file. -}
+replaceFileOr :: FilePath -> (FilePath -> Annex ()) -> (FilePath -> Annex ()) -> Annex ()
+replaceFileOr file action rollback = do
 	tmpdir <- fromRepo gitAnnexTmpMiscDir
 	void $ createAnnexDirectory tmpdir
-	bracketIO (setup tmpdir) nukeFile $ \tmpfile -> do
+	bracketAnnex (liftIO $ setup tmpdir) rollback $ \tmpfile -> do
-		a tmpfile
+		action tmpfile
 		liftIO $ catchIO (rename tmpfile file) (fallback tmpfile)
   where
   	setup tmpdir = do

debian/changelog

@@ -1,6 +1,8 @@
 git-annex (5.20140710) UNRELEASED; urgency=medium
 
   * Fix minor FD leak in journal code.
+  * direct: Fix handling of case where a work tree subdirectory cannot
+    be written to due to permissions.
 
  -- Joey Hess <joeyh@debian.org>  Wed, 09 Jul 2014 23:29:21 -0400