{"version":3,"file":"secret-file-C9wp_FCX.mjs","names":[],"sources":["../src/cli/shared/secret-file.ts"],"sourcesContent":["import * as fs from \"node:fs\";\nimport * as path from \"pathe\";\n\nconst DIR_MODE = 0o700;\nconst FILE_MODE = 0o600;\n\n/**\n * Best-effort chmod that only fires when the current mode differs from the\n * target. No-op on Windows (where POSIX mode bits are advisory and ACLs\n * govern access) and on missing paths / permission errors.\n * @param target - Path to chmod\n * @param mode - Desired POSIX mode bits\n */\nfunction chmodIfDifferent(target: string, mode: number): void {\n  if (process.platform === \"win32\") return;\n  try {\n    if ((fs.statSync(target).mode & 0o777) !== mode) {\n      fs.chmodSync(target, mode);\n    }\n  } catch {\n    // Missing path or permission error — best-effort.\n  }\n}\n\n/**\n * Write a file that may contain secrets with restrictive permissions.\n * Creates the parent directory with 0o700 and the file with 0o600 on POSIX\n * systems so other users on the host cannot read access tokens, refresh\n * tokens, or crash report payloads. On Windows the POSIX mode bits are\n * effectively ignored and ACLs govern access, so the chmod calls are\n * best-effort and silently skipped.\n * @param filePath - Absolute path to write\n * @param content - File content\n */\nexport function writeSecretFile(filePath: string, content: string | Buffer): void {\n  ensureSecretDir(path.dirname(filePath));\n  fs.writeFileSync(filePath, content, { mode: FILE_MODE });\n  chmodIfDifferent(filePath, FILE_MODE);\n}\n\n/**\n * Ensure a directory exists with 0o700 permissions on POSIX systems.\n * `mkdirSync({ recursive: true })` does not chmod existing directories,\n * so this also tightens permissions on directories that were previously\n * created with looser modes.\n * @param dir - Directory path\n */\nexport function ensureSecretDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: DIR_MODE });\n  chmodIfDifferent(dir, DIR_MODE);\n}\n\n/**\n * Tighten an existing file and its parent directory to secret-file modes\n * (0o600 / 0o700) if they are looser. Used by read paths that may not\n * trigger a subsequent write, so that legacy world-readable files are\n * still secured the next time the CLI runs. Silent no-op on Windows and\n * on missing files / permission errors.\n * @param filePath - Absolute path that should be 0o600 and live under a 0o700 directory\n */\nexport function tightenSecretFilePermissions(filePath: string): void {\n  chmodIfDifferent(filePath, FILE_MODE);\n  chmodIfDifferent(path.dirname(filePath), DIR_MODE);\n}\n"],"mappings":"kDAaA,SAAS,iBAAiB,EAAgB,EAAoB,CACxD,WAAQ,WAAa,QACzB,GAAI,EACG,EAAG,SAAS,CAAM,CAAC,CAAC,KAAO,OAAW,GACzC,EAAG,UAAU,EAAQ,CAAI,CAE7B,MAAQ,CAER,CACF,CAYA,SAAgB,gBAAgB,EAAkB,EAAgC,CAChF,gBAAgB,EAAK,QAAQ,CAAQ,CAAC,EACtC,EAAG,cAAc,EAAU,EAAS,CAAE,KAAM,GAAU,CAAC,EACvD,iBAAiB,EAAU,GAAS,CACtC,CASA,SAAgB,gBAAgB,EAAmB,CACjD,EAAG,UAAU,EAAK,CAAE,UAAW,GAAM,KAAM,GAAS,CAAC,EACrD,iBAAiB,EAAK,GAAQ,CAChC,CAUA,SAAgB,6BAA6B,EAAwB,CACnE,iBAAiB,EAAU,GAAS,EACpC,iBAAiB,EAAK,QAAQ,CAAQ,EAAG,GAAQ,CACnD"}