Create credential files with owner-only permissions (#945)

Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>

tests/test_secret_files.py

@@ -0,0 +1,65 @@
+from __future__ import annotations
+
+import json
+import os
+import stat
+import sys
+from typing import TYPE_CHECKING
+
+import pytest
+
+from strix.utils.secret_files import SECRET_FILE_MODE, write_secret_text
+
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+
+posix_only = pytest.mark.skipif(
+    sys.platform == "win32", reason="POSIX permission bits are not modelled on Windows"
+)
+
+
+def test_content_round_trips(tmp_path: Path) -> None:
+    target = tmp_path / "nested" / "auth.json"
+    payload = json.dumps({"token": "s3cret", "refresh": "r3fresh"})
+    write_secret_text(target, payload)
+    assert json.loads(target.read_text(encoding="utf-8"))["token"] == "s3cret"  # noqa: S105
+
+
+@posix_only
+def test_file_is_owner_only(tmp_path: Path) -> None:
+    target = tmp_path / "auth.json"
+    write_secret_text(target, "{}")
+    assert stat.S_IMODE(target.stat().st_mode) == SECRET_FILE_MODE
+
+
+@posix_only
+def test_a_permissive_umask_cannot_widen_the_file(tmp_path: Path) -> None:
+    previous = os.umask(0)
+    try:
+        target = tmp_path / "auth.json"
+        write_secret_text(target, "{}")
+        assert stat.S_IMODE(target.stat().st_mode) == SECRET_FILE_MODE
+    finally:
+        os.umask(previous)
+
+
+@posix_only
+def test_a_stale_temporary_does_not_leak_its_mode(tmp_path: Path) -> None:
+    target = tmp_path / "auth.json"
+    stale = target.with_suffix(target.suffix + ".tmp")
+    stale.write_text("leftover", encoding="utf-8")
+    stale.chmod(0o666)
+
+    write_secret_text(target, "{}")
+    assert stat.S_IMODE(target.stat().st_mode) == SECRET_FILE_MODE
+
+
+def test_overwriting_an_existing_record_keeps_it_restricted(tmp_path: Path) -> None:
+    target = tmp_path / "auth.json"
+    write_secret_text(target, json.dumps({"v": 1}))
+    write_secret_text(target, json.dumps({"v": 2}))
+    assert json.loads(target.read_text(encoding="utf-8"))["v"] == 2
+    if sys.platform != "win32":
+        assert stat.S_IMODE(target.stat().st_mode) == SECRET_FILE_MODE