Ivan Pereira
76dbc20064
Enforce 0600 permissions after every auth token write so existing files with broader modes are corrected. Add a regression test for the permission hardening path and document the Bun runtime dependency used by the Node/jiti search subprocess path. Also declare bun in package dependencies and engines.
47 lines
1.4 KiB
TypeScript
47 lines
1.4 KiB
TypeScript
import { afterEach, describe, expect, mock, test } from "bun:test";
|
|
import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
|
|
import { tmpdir } from "node:os";
|
|
import { dirname, join } from "node:path";
|
|
|
|
async function importStorageModule() {
|
|
return import(`../../src/auth/storage.ts?test=${crypto.randomUUID()}`);
|
|
}
|
|
|
|
afterEach(() => {
|
|
mock.restore();
|
|
});
|
|
|
|
describe("auth/storage", () => {
|
|
test("saveToken enforces 0600 permissions even when token file already exists", async () => {
|
|
const homeDir = await mkdtemp(join(tmpdir(), "pi-perplexity-storage-"));
|
|
const tokenPath = join(homeDir, ".config", "pi-perplexity", "auth.json");
|
|
|
|
try {
|
|
mock.module("node:os", () => ({
|
|
homedir: () => homeDir,
|
|
}));
|
|
|
|
await mkdir(dirname(tokenPath), { recursive: true });
|
|
await writeFile(tokenPath, '{"type":"oauth","access":"old"}\n', {
|
|
encoding: "utf8",
|
|
mode: 0o644,
|
|
});
|
|
|
|
const { saveToken } = await importStorageModule();
|
|
await saveToken({ type: "oauth", access: "new-token" });
|
|
|
|
const fileMode = (await stat(tokenPath)).mode & 0o777;
|
|
expect(fileMode).toBe(0o600);
|
|
|
|
const saved = JSON.parse(await readFile(tokenPath, "utf8")) as {
|
|
type: string;
|
|
access: string;
|
|
};
|
|
expect(saved.type).toBe("oauth");
|
|
expect(saved.access).toBe("new-token");
|
|
} finally {
|
|
await rm(homeDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
});
|