narrow settings permissions to 0o600 and settings dir to 0o700

internal/settings/settings.go

@@ -13,6 +13,11 @@ import (
 	"github.com/tursodatabase/turso-cli/internal/flags"
 )
 
+const (
+	settingsFileMode = 0o600
+	settingsDirMode  = 0o700
+)
+
 type Settings struct {
 	changed bool
 }
@@ -44,10 +49,12 @@ func ReadSettings() (*Settings, error) {
 	if err != nil {
 		return nil, err
 	}
+	_ = os.Chmod(configPath, settingsDirMode)
 
 	viper.SetConfigName("settings")
 	viper.SetConfigType("json")
 	viper.AddConfigPath(configPath)
+	viper.SetConfigPermissions(settingsFileMode)
 	configFile := path.Join(configPath, "settings.json")
 	if abs, err := filepath.Abs(configFile); err == nil {
 		configFile = abs
@@ -97,6 +104,9 @@ func TryToPersistChanges() error {
 	if err := viper.WriteConfig(); err != nil {
 		return fmt.Errorf("failed to persist turso settings file: %w", err)
 	}
+	if configFile := viper.ConfigFileUsed(); configFile != "" {
+		_ = os.Chmod(configFile, settingsFileMode)
+	}
 	return nil
 }
 

internal/settings/settings_perm_test.go

@@ -0,0 +1,45 @@
+package settings
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestPersistTightensFilePermissions(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("TURSO_CONFIG_FOLDER", dir)
+
+	s, err := ReadSettings()
+	if err != nil {
+		t.Fatalf("ReadSettings: %v", err)
+	}
+
+	file := filepath.Join(dir, "settings.json")
+	st, err := os.Stat(file)
+	if err != nil {
+		t.Fatalf("stat after create: %v", err)
+	}
+	if got := st.Mode().Perm(); got != 0o600 {
+		t.Errorf("fresh file mode = %o, want 600", got)
+	}
+	stDir, _ := os.Stat(dir)
+	if got := stDir.Mode().Perm(); got != 0o700 {
+		t.Errorf("fresh dir mode = %o, want 700", got)
+	}
+
+	if err := os.Chmod(file, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	s.SetUsername("alice")
+	if err := TryToPersistChanges(); err != nil {
+		t.Fatalf("TryToPersistChanges: %v", err)
+	}
+	st, err = os.Stat(file)
+	if err != nil {
+		t.Fatalf("stat after persist: %v", err)
+	}
+	if got := st.Mode().Perm(); got != 0o600 {
+		t.Errorf("file mode after persist = %o, want 600", got)
+	}
+}