fix(auth): create config files with private mode

Author: altaywtf

src/internal/state.test.ts

@@ -2,6 +2,8 @@ import { mkdtemp, readFile, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
+import * as FileSystem from "effect/FileSystem";
+import * as PlatformError from "effect/PlatformError";
 import { Cause, ConfigProvider, Effect, Exit, Option } from "effect";
 import { describe, expect, it } from "vite-plus/test";
 
@@ -98,6 +100,47 @@ describe("resolveConfigPath", () => {
     expect(contents.auth_token).toBe("dummy-token");
   });
 
+  it("creates config files with private permissions before chmod", async () => {
+    const writeModes: Array<number | undefined> = [];
+    const chmodModes: Array<number> = [];
+    const fileSystem = FileSystem.makeNoop({
+      chmod: (_path, mode) =>
+        Effect.sync(() => {
+          chmodModes.push(mode);
+        }),
+      makeDirectory: () => Effect.void,
+      readFileString: (path) =>
+        Effect.fail(
+          PlatformError.systemError({
+            _tag: "NotFound",
+            module: "FileSystem",
+            method: "readFileString",
+            pathOrDescriptor: path,
+          }),
+        ),
+      writeFileString: (_path, _data, options) =>
+        Effect.sync(() => {
+          writeModes.push(options?.mode);
+        }),
+    });
+
+    await Effect.runPromise(
+      savePersistedState(
+        {
+          token: "dummy-token",
+          apiBaseUrl: "https://api.put.io",
+        },
+        "/tmp/putio-cli/config.json",
+      ).pipe(
+        Effect.provideService(FileSystem.FileSystem, fileSystem),
+        Effect.provide(makeCliAppLayer(makeCliRuntime())),
+      ),
+    );
+
+    expect(writeModes).toEqual([0o600]);
+    expect(chmodModes).toEqual([0o600]);
+  });
+
   it("exposes persisted-state operations through the CliState service", async () => {
     const dir = await mkdtemp(join(tmpdir(), "putio-cli-"));
     const configPath = join(dir, "config.json");

src/internal/state.ts

@@ -272,7 +272,9 @@ const persistConfigEffect = (
       .makeDirectory(runtime.dirname(effectiveConfigPath), { recursive: true })
       .pipe(Effect.mapError((error) => mapFileSystemError(error, message)));
     yield* fs
-      .writeFileString(effectiveConfigPath, `${JSON.stringify(state, null, 2)}\n`)
+      .writeFileString(effectiveConfigPath, `${JSON.stringify(state, null, 2)}\n`, {
+        mode: CONFIG_FILE_MODE,
+      })
       .pipe(Effect.mapError((error) => mapFileSystemError(error, message)));
     yield* fs
       .chmod(effectiveConfigPath, CONFIG_FILE_MODE)