Revert "update file permissions to read/write (#751)" (#755)

chrnorm · jpbelleau · web-flow · commit 18daa6ef3756 · 2024-09-24T18:09:50.000+01:00
Fixes the permissions issue in the latest Granted release.

---------

Co-authored-by: James Belleau &lt;james.belleau@instructure.com&gt;
diff --git a/pkg/accessrequest/role.go b/pkg/accessrequest/role.go
@@ -14,11 +14,6 @@ import (
 	"github.com/common-fate/granted/pkg/config"
 )
 
-const (
-	// permission for user to read/write.
-	USER_READ_WRITE_PERM = 0644
-)
-
 type Role struct {
 	Account string `json:"account"`
 	Role    string `json:"role"`
@@ -51,7 +46,7 @@ func (r Role) Save() error {
 	}
 
 	file := filepath.Join(configFolder, "latest-role")
-	return os.WriteFile(file, roleBytes, USER_READ_WRITE_PERM)
+	return os.WriteFile(file, roleBytes, 0644)
 }
 
 func LatestRole() (*Role, error) {
@@ -96,7 +91,7 @@ func (p Profile) Save() error {
 	}
 
 	file := filepath.Join(configFolder, "latest-profile")
-	return os.WriteFile(file, profileBytes, USER_READ_WRITE_PERM)
+	return os.WriteFile(file, profileBytes, 0644)
 }
 
 func LatestProfile() (*Profile, error) {
diff --git a/pkg/cfaws/ssotoken.go b/pkg/cfaws/ssotoken.go
@@ -15,11 +15,6 @@ import (
 	"github.com/common-fate/granted/pkg/securestorage"
 )
 
-const (
-	// permission for user to read/write.
-	USER_READ_WRITE_PERM = 0644
-)
-
 type SSOPlainTextOut struct {
 	AccessToken    string `json:"accessToken"`
 	ExpiresAt      string `json:"expiresAt"`
@@ -93,13 +88,13 @@ func dumpTokenFile(jsonToken []byte, key string) error {
 	}
 
 	if _, err := os.Stat(path); os.IsNotExist(err) {
-		err := os.MkdirAll(path, USER_READ_WRITE_PERM)
+		err := os.MkdirAll(path, 0700)
 		if err != nil {
 			return fmt.Errorf("unable to create sso cache directory with err: %s", err)
 		}
 	}
 
-	err = os.WriteFile(filepath.Join(path, key), jsonToken, USER_READ_WRITE_PERM)
+	err = os.WriteFile(filepath.Join(path, key), jsonToken, 0600)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/config/config.go b/pkg/config/config.go
@@ -17,16 +17,6 @@ import (
 	"github.com/common-fate/granted/internal/build"
 )
 
-const (
-	// permission for user to read/write.
-	USER_READ_WRITE_PERM = 0644
-)
-
-const (
-	// permission for user to read/write.
-	USER_READ_WRITE_EXECUTE_PERM = 0700
-)
-
 type BrowserLaunchTemplate struct {
 	// UseForkProcess specifies whether to use forkprocess to launch the browser.
 	//
@@ -152,7 +142,7 @@ func SetupConfigFolder() error {
 		return err
 	}
 	if _, err := os.Stat(grantedFolder); os.IsNotExist(err) {
-		err := os.Mkdir(grantedFolder, USER_READ_WRITE_PERM)
+		err := os.Mkdir(grantedFolder, 0700)
 		if err != nil {
 			return err
 		}
@@ -168,14 +158,14 @@ func SetupZSHAutoCompleteFolderAssume() (string, error) {
 	}
 	zshPath := path.Join(grantedFolder, "zsh_autocomplete")
 	if _, err := os.Stat(zshPath); os.IsNotExist(err) {
-		err := os.Mkdir(zshPath, USER_READ_WRITE_EXECUTE_PERM)
+		err := os.Mkdir(zshPath, 0700)
 		if err != nil {
 			return "", err
 		}
 	}
 	zshPath = path.Join(zshPath, build.AssumeScriptName())
 	if _, err := os.Stat(zshPath); os.IsNotExist(err) {
-		err := os.Mkdir(zshPath, USER_READ_WRITE_EXECUTE_PERM)
+		err := os.Mkdir(zshPath, 0700)
 		if err != nil {
 			return "", err
 		}
@@ -191,14 +181,14 @@ func SetupZSHAutoCompleteFolderGranted() (string, error) {
 	}
 	zshPath := path.Join(grantedFolder, "zsh_autocomplete")
 	if _, err := os.Stat(zshPath); os.IsNotExist(err) {
-		err := os.Mkdir(zshPath, USER_READ_WRITE_EXECUTE_PERM)
+		err := os.Mkdir(zshPath, 0700)
 		if err != nil {
 			return "", err
 		}
 	}
 	zshPath = path.Join(zshPath, build.GrantedBinaryName())
 	if _, err := os.Stat(zshPath); os.IsNotExist(err) {
-		err := os.Mkdir(zshPath, USER_READ_WRITE_EXECUTE_PERM)
+		err := os.Mkdir(zshPath, 0700)
 		if err != nil {
 			return "", err
 		}
@@ -284,7 +274,7 @@ func Load() (*Config, error) {
 		return nil, err
 	}
 
-	file, err := os.OpenFile(configFilePath, os.O_RDWR|os.O_CREATE, USER_READ_WRITE_PERM)
+	file, err := os.OpenFile(configFilePath, os.O_RDWR|os.O_CREATE, 0600)
 	if err != nil {
 		return nil, err
 	}
@@ -306,7 +296,7 @@ func (c *Config) Save() error {
 		return err
 	}
 
-	file, err := os.OpenFile(configFilePath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, USER_READ_WRITE_PERM)
+	file, err := os.OpenFile(configFilePath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0600)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/frecency/frecency.go b/pkg/frecency/frecency.go
@@ -11,11 +11,6 @@ import (
 	"github.com/common-fate/granted/pkg/config"
 )
 
-const (
-	// permission for user to read/write.
-	USER_READ_WRITE_PERM = 0644
-)
-
 // change these to play with the weights
 // values between 0 and 1
 // 0 will exclude the metric all together from the ordering
@@ -75,14 +70,14 @@ func Load(fecencyStoreKey string) (*FrecencyStore, error) {
 
 	// check if the providers file exists
 	if _, err = os.Stat(c.path); os.IsNotExist(err) {
-		err := os.MkdirAll(configFolder, USER_READ_WRITE_PERM)
+		err := os.MkdirAll(configFolder, 0700)
 		if err != nil {
 			return nil, err
 		}
 		return &c, nil
 	}
 
-	file, err := os.OpenFile(c.path, os.O_RDWR|os.O_CREATE, USER_READ_WRITE_PERM)
+	file, err := os.OpenFile(c.path, os.O_RDWR|os.O_CREATE, 0600)
 	if err != nil {
 		return nil, err
 	}
@@ -191,7 +186,7 @@ func (store *FrecencyStore) save() error {
 	// 	store.Entries = store.Entries[0 : len(store.Entries)-1]
 	// }
 
-	file, err := os.OpenFile(store.path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, USER_READ_WRITE_PERM)
+	file, err := os.OpenFile(store.path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0600)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/granted/exp/request/request.go b/pkg/granted/exp/request/request.go
@@ -38,11 +38,6 @@ import (
 	"gopkg.in/ini.v1"
 )
 
-const (
-	// permission for user to read/write.
-	USER_READ_WRITE_PERM = 0644
-)
-
 var Command = cli.Command{
 	Name:  "request",
 	Usage: "Request access to a role",
@@ -731,7 +726,7 @@ func updateCachedAccessRule(ctx context.Context, opts updateCacheOpts) error {
 		return err
 	}
 
-	err = os.WriteFile(filename, ruleBytes, USER_READ_WRITE_PERM)
+	err = os.WriteFile(filename, ruleBytes, 0644)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/granted/registry/add.go b/pkg/granted/registry/add.go
@@ -15,6 +15,11 @@ import (
 	"github.com/urfave/cli/v2"
 )
 
+const (
+	// permission for user to read/write/execute.
+	USER_READ_WRITE_PERM = 0700
+)
+
 var AddCommand = cli.Command{
 	Name:        "add",
 	Description: "Add a Profile Registry that you want to sync with aws config file",
diff --git a/pkg/granted/registry/ini.go b/pkg/granted/registry/ini.go
@@ -10,11 +10,6 @@ import (
 	"gopkg.in/ini.v1"
 )
 
-const (
-	// permission for user to read/write.
-	USER_READ_WRITE_PERM = 0644
-)
-
 // Find the ~/.aws/config absolute path based on OS.
 func getDefaultAWSConfigLocation() (string, error) {
 	h, err := os.UserHomeDir()
diff --git a/pkg/shells/file.go b/pkg/shells/file.go
@@ -6,11 +6,6 @@ import (
 	"strings"
 )
 
-const (
-	// permission for user to read/write.
-	USER_READ_WRITE_PERM = 0644
-)
-
 // AppendLine writes a line to a file if it does not already exist
 func AppendLine(file string, line string) error {
 	b, err := os.ReadFile(file)
@@ -24,7 +19,7 @@ func AppendLine(file string, line string) error {
 	}
 
 	// open the file for writing
-	out, err := os.OpenFile(file, os.O_APPEND|os.O_WRONLY, USER_READ_WRITE_PERM)
+	out, err := os.OpenFile(file, os.O_APPEND|os.O_WRONLY, 0644)
 	if err != nil {
 		return err
 	}
@@ -78,7 +73,7 @@ func RemoveLine(file string, lineToRemove string) error {
 	}
 
 	output := strings.Join(ignored, "\n")
-	err = os.WriteFile(file, []byte(output), USER_READ_WRITE_PERM)
+	err = os.WriteFile(file, []byte(output), 0644)
 	if err != nil {
 		return err
 	}

Original file line number	Diff line number	Diff line change
`@@ -14,11 +14,6 @@ import (`
`14`	`14`	`"github.com/common-fate/granted/pkg/config"`
`15`	`15`	`)`
`16`	`16`
`17`		`-const (`
`18`		`- // permission for user to read/write.`
`19`		`- USER_READ_WRITE_PERM = 0644`
`20`		`-)`
`21`		`-`
`22`	`17`	`type Role struct {`
`23`	`18`	Account string `json:"account"`
`24`	`19`	Role string `json:"role"`
`@@ -51,7 +46,7 @@ func (r Role) Save() error {`
`51`	`46`	`}`
`52`	`47`
`53`	`48`	`file := filepath.Join(configFolder, "latest-role")`
`54`		`- return os.WriteFile(file, roleBytes, USER_READ_WRITE_PERM)`
	`49`	`+ return os.WriteFile(file, roleBytes, 0644)`
`55`	`50`	`}`
`56`	`51`
`57`	`52`	`func LatestRole() (*Role, error) {`
`@@ -96,7 +91,7 @@ func (p Profile) Save() error {`
`96`	`91`	`}`
`97`	`92`
`98`	`93`	`file := filepath.Join(configFolder, "latest-profile")`
`99`		`- return os.WriteFile(file, profileBytes, USER_READ_WRITE_PERM)`
	`94`	`+ return os.WriteFile(file, profileBytes, 0644)`
`100`	`95`	`}`
`101`	`96`
`102`	`97`	`func LatestProfile() (*Profile, error) {`
Original file line number	Diff line number	Diff line change
`@@ -15,11 +15,6 @@ import (`
`15`	`15`	`"github.com/common-fate/granted/pkg/securestorage"`
`16`	`16`	`)`
`17`	`17`
`18`		`-const (`
`19`		`- // permission for user to read/write.`
`20`		`- USER_READ_WRITE_PERM = 0644`
`21`		`-)`
`22`		`-`
`23`	`18`	`type SSOPlainTextOut struct {`
`24`	`19`	AccessToken string `json:"accessToken"`
`25`	`20`	ExpiresAt string `json:"expiresAt"`
`@@ -93,13 +88,13 @@ func dumpTokenFile(jsonToken []byte, key string) error {`
`93`	`88`	`}`
`94`	`89`
`95`	`90`	`if _, err := os.Stat(path); os.IsNotExist(err) {`
`96`		`- err := os.MkdirAll(path, USER_READ_WRITE_PERM)`
	`91`	`+ err := os.MkdirAll(path, 0700)`
`97`	`92`	`if err != nil {`
`98`	`93`	`return fmt.Errorf("unable to create sso cache directory with err: %s", err)`
`99`	`94`	`}`
`100`	`95`	`}`
`101`	`96`
`102`		`- err = os.WriteFile(filepath.Join(path, key), jsonToken, USER_READ_WRITE_PERM)`
	`97`	`+ err = os.WriteFile(filepath.Join(path, key), jsonToken, 0600)`
`103`	`98`	`if err != nil {`
`104`	`99`	`return err`
`105`	`100`	`}`
Original file line number	Diff line number	Diff line change
`@@ -17,16 +17,6 @@ import (`
`17`	`17`	`"github.com/common-fate/granted/internal/build"`
`18`	`18`	`)`
`19`	`19`
`20`		`-const (`
`21`		`- // permission for user to read/write.`
`22`		`- USER_READ_WRITE_PERM = 0644`
`23`		`-)`
`24`		`-`
`25`		`-const (`
`26`		`- // permission for user to read/write.`
`27`		`- USER_READ_WRITE_EXECUTE_PERM = 0700`
`28`		`-)`
`29`		`-`
`30`	`20`	`type BrowserLaunchTemplate struct {`
`31`	`21`	`// UseForkProcess specifies whether to use forkprocess to launch the browser.`
`32`	`22`	`//`
`@@ -152,7 +142,7 @@ func SetupConfigFolder() error {`
`152`	`142`	`return err`
`153`	`143`	`}`
`154`	`144`	`if _, err := os.Stat(grantedFolder); os.IsNotExist(err) {`
`155`		`- err := os.Mkdir(grantedFolder, USER_READ_WRITE_PERM)`
	`145`	`+ err := os.Mkdir(grantedFolder, 0700)`
`156`	`146`	`if err != nil {`
`157`	`147`	`return err`
`158`	`148`	`}`
`@@ -168,14 +158,14 @@ func SetupZSHAutoCompleteFolderAssume() (string, error) {`
`168`	`158`	`}`
`169`	`159`	`zshPath := path.Join(grantedFolder, "zsh_autocomplete")`
`170`	`160`	`if _, err := os.Stat(zshPath); os.IsNotExist(err) {`
`171`		`- err := os.Mkdir(zshPath, USER_READ_WRITE_EXECUTE_PERM)`
	`161`	`+ err := os.Mkdir(zshPath, 0700)`
`172`	`162`	`if err != nil {`
`173`	`163`	`return "", err`
`174`	`164`	`}`
`175`	`165`	`}`
`176`	`166`	`zshPath = path.Join(zshPath, build.AssumeScriptName())`
`177`	`167`	`if _, err := os.Stat(zshPath); os.IsNotExist(err) {`
`178`		`- err := os.Mkdir(zshPath, USER_READ_WRITE_EXECUTE_PERM)`
	`168`	`+ err := os.Mkdir(zshPath, 0700)`
`179`	`169`	`if err != nil {`
`180`	`170`	`return "", err`
`181`	`171`	`}`
`@@ -191,14 +181,14 @@ func SetupZSHAutoCompleteFolderGranted() (string, error) {`
`191`	`181`	`}`
`192`	`182`	`zshPath := path.Join(grantedFolder, "zsh_autocomplete")`
`193`	`183`	`if _, err := os.Stat(zshPath); os.IsNotExist(err) {`
`194`		`- err := os.Mkdir(zshPath, USER_READ_WRITE_EXECUTE_PERM)`
	`184`	`+ err := os.Mkdir(zshPath, 0700)`
`195`	`185`	`if err != nil {`
`196`	`186`	`return "", err`
`197`	`187`	`}`
`198`	`188`	`}`
`199`	`189`	`zshPath = path.Join(zshPath, build.GrantedBinaryName())`
`200`	`190`	`if _, err := os.Stat(zshPath); os.IsNotExist(err) {`
`201`		`- err := os.Mkdir(zshPath, USER_READ_WRITE_EXECUTE_PERM)`
	`191`	`+ err := os.Mkdir(zshPath, 0700)`
`202`	`192`	`if err != nil {`
`203`	`193`	`return "", err`
`204`	`194`	`}`
`@@ -284,7 +274,7 @@ func Load() (*Config, error) {`
`284`	`274`	`return nil, err`
`285`	`275`	`}`
`286`	`276`
`287`		`- file, err := os.OpenFile(configFilePath, os.O_RDWR\|os.O_CREATE, USER_READ_WRITE_PERM)`
	`277`	`+ file, err := os.OpenFile(configFilePath, os.O_RDWR\|os.O_CREATE, 0600)`
`288`	`278`	`if err != nil {`
`289`	`279`	`return nil, err`
`290`	`280`	`}`
`@@ -306,7 +296,7 @@ func (c *Config) Save() error {`
`306`	`296`	`return err`
`307`	`297`	`}`
`308`	`298`
`309`		`- file, err := os.OpenFile(configFilePath, os.O_RDWR\|os.O_CREATE\|os.O_TRUNC, USER_READ_WRITE_PERM)`
	`299`	`+ file, err := os.OpenFile(configFilePath, os.O_RDWR\|os.O_CREATE\|os.O_TRUNC, 0600)`
`310`	`300`	`if err != nil {`
`311`	`301`	`return err`
`312`	`302`	`}`
Original file line number	Diff line number	Diff line change
`@@ -38,11 +38,6 @@ import (`
`38`	`38`	`"gopkg.in/ini.v1"`
`39`	`39`	`)`
`40`	`40`
`41`		`-const (`
`42`		`- // permission for user to read/write.`
`43`		`- USER_READ_WRITE_PERM = 0644`
`44`		`-)`
`45`		`-`
`46`	`41`	`var Command = cli.Command{`
`47`	`42`	`Name: "request",`
`48`	`43`	`Usage: "Request access to a role",`
`@@ -731,7 +726,7 @@ func updateCachedAccessRule(ctx context.Context, opts updateCacheOpts) error {`
`731`	`726`	`return err`
`732`	`727`	`}`
`733`	`728`
`734`		`- err = os.WriteFile(filename, ruleBytes, USER_READ_WRITE_PERM)`
	`729`	`+ err = os.WriteFile(filename, ruleBytes, 0644)`
`735`	`730`	`if err != nil {`
`736`	`731`	`return err`
`737`	`732`	`}`
Original file line number	Diff line number	Diff line change
`@@ -6,11 +6,6 @@ import (`
`6`	`6`	`"strings"`
`7`	`7`	`)`
`8`	`8`
`9`		`-const (`
`10`		`- // permission for user to read/write.`
`11`		`- USER_READ_WRITE_PERM = 0644`
`12`		`-)`
`13`		`-`
`14`	`9`	`// AppendLine writes a line to a file if it does not already exist`
`15`	`10`	`func AppendLine(file string, line string) error {`
`16`	`11`	`b, err := os.ReadFile(file)`
`@@ -24,7 +19,7 @@ func AppendLine(file string, line string) error {`
`24`	`19`	`}`
`25`	`20`
`26`	`21`	`// open the file for writing`
`27`		`- out, err := os.OpenFile(file, os.O_APPEND\|os.O_WRONLY, USER_READ_WRITE_PERM)`
	`22`	`+ out, err := os.OpenFile(file, os.O_APPEND\|os.O_WRONLY, 0644)`
`28`	`23`	`if err != nil {`
`29`	`24`	`return err`
`30`	`25`	`}`
`@@ -78,7 +73,7 @@ func RemoveLine(file string, lineToRemove string) error {`
`78`	`73`	`}`
`79`	`74`
`80`	`75`	`output := strings.Join(ignored, "\n")`
`81`		`- err = os.WriteFile(file, []byte(output), USER_READ_WRITE_PERM)`
	`76`	`+ err = os.WriteFile(file, []byte(output), 0644)`
`82`	`77`	`if err != nil {`
`83`	`78`	`return err`
`84`	`79`	`}`