1// Secret files are owner-only on disk: config.json (backendSecret,2// adminSecret) 0600, iroh.key 0600, the data dir 0700 — and installs created3// before modes were set are healed on load. POSIX-only; Windows has no chmod.45import { assertEquals } from "@std/assert";6import { configPath, initConfig, loadConfig, loadOrCreateIrohKey } from "../src/config.ts";78const posixOnly = { ignore: Deno.build.os === "windows" };910async function modeOf(path: string): Promise<number> {11 const stat = await Deno.stat(path);12 return (stat.mode ?? 0) & 0o777;13}1415Deno.test({16 ...posixOnly,17 name: "permissions: initConfig writes config.json 0600 in a 0700 data dir",18 fn: async () => {19 const parent = await Deno.makeTempDir();20 const dir = `${parent}/data`;21 try {22 await initConfig(dir);23 assertEquals(await modeOf(dir), 0o700);24 assertEquals(await modeOf(configPath(dir)), 0o600);25 } finally {26 await Deno.remove(parent, { recursive: true });27 }28 },29});3031Deno.test({32 ...posixOnly,33 name: "permissions: loadConfig heals a loose existing install",34 fn: async () => {35 const dir = await Deno.makeTempDir();36 try {37 await initConfig(dir);38 // An install from before modes were set: world-readable everywhere.39 await Deno.chmod(dir, 0o755);40 await Deno.chmod(configPath(dir), 0o644);41 await loadConfig(dir);42 assertEquals(await modeOf(dir), 0o700);43 assertEquals(await modeOf(configPath(dir)), 0o600);44 } finally {45 await Deno.remove(dir, { recursive: true });46 }47 },48});4950Deno.test({51 ...posixOnly,52 name: "permissions: iroh.key is 0600 on create and healed on load",53 fn: async () => {54 const dir = await Deno.makeTempDir();55 try {56 await loadOrCreateIrohKey(dir);57 assertEquals(await modeOf(`${dir}/iroh.key`), 0o600);58 await Deno.chmod(`${dir}/iroh.key`, 0o644);59 await loadOrCreateIrohKey(dir);60 assertEquals(await modeOf(`${dir}/iroh.key`), 0o600);61 } finally {62 await Deno.remove(dir, { recursive: true });63 }64 },65});