1b8d8e670d
Unlink any existing file before writing in writeFileWithMode so the mode option is always applied on fresh file creation (Node.js ignores mode for existing files). This prevents inheriting wrong permissions on Docker bind-mount filesystems such as Synology NAS where ACLs can cause SSH key files to be created with 755 instead of 600. The fs.unlink error is only swallowed for ENOENT (file doesn't exist); other errors (e.g. EPERM) propagate as before. The chmod call is kept as an additional safety net against umask effects. A test for the new-file creation case is added alongside the existing existing-file rewrite test. Agent-Logs-Url: https://github.com/mowdep/zerobyte/sessions/2a4ab129-9668-402e-8687-d792f9b9e704 Co-authored-by: mowdep <10937987+mowdep@users.noreply.github.com>
19 lines
800 B
TypeScript
19 lines
800 B
TypeScript
import fs from "node:fs/promises";
|
|
|
|
export const FILE_MODES = {
|
|
ownerReadWrite: 0o600,
|
|
} as const;
|
|
|
|
type FileMode = (typeof FILE_MODES)[keyof typeof FILE_MODES];
|
|
|
|
export const writeFileWithMode = async (filePath: string, data: string, mode: FileMode) => {
|
|
// Remove any existing file first so the mode option on writeFile is always applied
|
|
// on a fresh file creation (mode is ignored for existing files). This also avoids
|
|
// inheriting incorrect permissions from a previously-created file on filesystems
|
|
// where chmod may not behave as expected (e.g. Docker bind-mounts on some NAS systems).
|
|
await fs.unlink(filePath).catch((error: NodeJS.ErrnoException) => {
|
|
if (error.code !== "ENOENT") throw error;
|
|
});
|
|
await fs.writeFile(filePath, data, { mode });
|
|
await fs.chmod(filePath, mode);
|
|
};
|