Tighten token-store hardening and hygiene

Sanitize the warnPersistence detail. An IO error from the store can
carry the operator-supplied store path (questdb.client.oidc.token.store.dir
or user.home), which could itself hold terminal-spoofing characters, so
route cause.getMessage() through the null-safe sanitizeForDisplay before
printing to System.err - matching how every other untrusted display
string is sanitized.

Reap orphan temp files. A crash between createTempFile and the atomic
rename leaves a <hash>*.tmp holding a valid-at-the-time refresh token;
nothing ever steals it, so they would accumulate across crashes. save()
now best-effort sweeps <hash>*.tmp older than lockStaleMillis, leaving a
concurrent writer's fresh temp (recent mtime) untouched - so the random
per-writer suffix that keeps concurrent saves from colliding stays.

Chmod the store directory only on drift. ensureDirectory re-tightens a
pre-existing directory on every save and every inLock; read the
permissions first and only setPosixFilePermissions when they actually
differ, dropping a redundant write syscall in the common case while
keeping the re-tighten defense and the non-POSIX fallback.

Compare the schema version as a long. The parser narrowed it to an int,
so a tampered "v" of 1 + 2^32 truncated to SCHEMA_VERSION and passed the
gate; keep the full long and compare as a long.

Add tests for the temp-file sweep and the version-overflow reject; each
was proven to fail with its fix reverted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: glasstiger

core/src/main/java/io/questdb/client/cutlass/auth/FileTokenStore.java

@@ -40,6 +40,7 @@
 import java.nio.channels.FileChannel;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.AtomicMoveNotSupportedException;
+import java.nio.file.DirectoryStream;
 import java.nio.file.FileAlreadyExistsException;
 import java.nio.file.Files;
 import java.nio.file.NoSuchFileException;
@@ -245,6 +246,7 @@ public void save(TokenStoreKey key, PersistedToken token) {
         byte[] content = serialize(key, token);
         try {
             ensureDirectory();
+            sweepStaleTempFiles(key.hash());
             Path target = tokenFile(key);
             Path tmp = createTempFile(key.hash());
             boolean moved = false;
@@ -457,16 +459,20 @@ private static void releaseLock(Path lock, String nonce) {
 
     private static void restrictToOwner(Path directory) {
         // best-effort: the at-rest protection of the plaintext token files is exactly these owner-only
-        // directory permissions, so tighten a pre-existing directory rather than trust whatever it had. On a
-        // non-POSIX filesystem (Windows) this is unsupported and falls back to the directory's existing ACL
+        // directory permissions, so re-tighten a pre-existing directory another tool/umask left loose rather
+        // than trust whatever it had. ensureDirectory runs this on every save and every inLock, so only chmod
+        // on detected drift - skip the write syscall in the common case where the permissions already match. On
+        // a non-POSIX filesystem (Windows) this is unsupported and falls back to the directory's existing ACL
         // (owner-only hardening there, via AclFileAttributeView, is a separate follow-up)
         try {
-            Files.setPosixFilePermissions(directory, DIR_PERMS);
+            if (!DIR_PERMS.equals(Files.getPosixFilePermissions(directory))) {
+                Files.setPosixFilePermissions(directory, DIR_PERMS);
+            }
         } catch (UnsupportedOperationException e) {
             // non-POSIX FS (e.g. Windows): cannot enforce owner-only perms; keep the inherited ACL
             warnNoPosixPermsOnce();
         } catch (IOException ignore) {
-            // the directory is not ours to chmod: keep the existing permissions
+            // the directory is not ours to inspect/chmod: keep the existing permissions
         }
     }
 
@@ -614,6 +620,28 @@ private Path lockFile(TokenStoreKey key) {
         return directory.resolve(key.hash() + ".lock");
     }
 
+    private void sweepStaleTempFiles(String hashPrefix) {
+        // a crash between createTempFile and the atomic rename orphans a <hash>*.tmp holding a
+        // valid-at-the-time refresh token; unlike the lock file nothing ever steals it, so it would accumulate
+        // across crashes. Best-effort sweep on save: delete only temps older than the lock-staleness window, so
+        // a temp a concurrent writer is actively using (its mtime is seconds old) is never removed. A separate
+        // random suffix per writer keeps concurrent saves from colliding, which is why temps are not a fixed name
+        try (DirectoryStream<Path> stream = Files.newDirectoryStream(directory, hashPrefix + "*.tmp")) {
+            final long now = System.currentTimeMillis();
+            for (Path tmp : stream) {
+                try {
+                    if (now - Files.getLastModifiedTime(tmp).toMillis() > lockStaleMillis) {
+                        Files.deleteIfExists(tmp);
+                    }
+                } catch (IOException ignore) {
+                    // best-effort; skip this entry and let a later sweep retry
+                }
+            }
+        } catch (IOException ignore) {
+            // best-effort; a sweep failure must never fail a save
+        }
+    }
+
     private Path tokenFile(TokenStoreKey key) {
         return directory.resolve(key.hash() + ".json");
     }
@@ -643,7 +671,7 @@ private static final class TokenFileParser implements JsonParser {
         long expiresAtMillis;
         boolean groupsInToken;
         long tokenTtlMillis;
-        int version;
+        long version;
         private int depth;
         private int field = FIELD_NONE;
         private boolean malformed;
@@ -698,7 +726,9 @@ public void onEvent(int code, CharSequence tag, int position) {
                     if (depth == 1) {
                         switch (field) {
                             case FIELD_VERSION:
-                                version = (int) parseLongOrZero(tag);
+                                // keep the full long: an over-32-bit value (e.g. 1 + 2^32) must not narrow to
+                                // SCHEMA_VERSION and slip through the schema gate, so compare it as a long
+                                version = parseLongOrZero(tag);
                                 break;
                             case FIELD_CLIENT_ID:
                                 putValue(clientId, tag);

core/src/main/java/io/questdb/client/cutlass/auth/OidcDeviceAuth.java

@@ -1499,9 +1499,11 @@ private boolean tryRefreshCoordinated() {
     }
 
     private void warnPersistence(String operation, Throwable cause) {
-        // best-effort persistence: report to System.err and carry on with the in-memory token. The store
-        // never puts token bytes in its messages, so this cannot leak the secret.
-        String detail = cause.getMessage();
+        // best-effort persistence: report to System.err and carry on with the in-memory token. The store never
+        // puts token bytes in its messages, but an IO error can carry the operator-supplied store path, which
+        // could itself hold terminal-spoofing characters - sanitize the detail before printing, as every other
+        // untrusted display string is sanitized (sanitizeForDisplay is null-safe).
+        String detail = sanitizeForDisplay(cause.getMessage());
         System.err.println("questdb client: OIDC token store " + operation
                 + " failed; continuing without persistence" + (detail != null ? " [" + detail + ']' : ""));
     }

core/src/test/java/io/questdb/client/test/cutlass/auth/FileTokenStoreTest.java

@@ -709,6 +709,30 @@ public void testSpecialCharactersAndNullsRoundTrip() throws Exception {
         });
     }
 
+    @Test
+    public void testStaleTempFilesAreSweptOnSave() throws Exception {
+        assertMemoryLeak(() -> {
+            Path dir = storeDir();
+            Files.createDirectories(dir);
+            // 1s staleness window so the test does not have to wait
+            FileTokenStore store = new FileTokenStore(dir, 3_000, 1_000);
+            TokenStoreKey key = sampleKey();
+            // an orphan temp left by a crashed save (backdated past the staleness window) must be reaped on the
+            // next save; a fresh temp (recent mtime - a concurrent writer's) must be left untouched
+            Path staleTmp = dir.resolve(key.hash() + "stale.tmp");
+            Files.createFile(staleTmp);
+            Files.setLastModifiedTime(staleTmp, FileTime.fromMillis(System.currentTimeMillis() - 10_000));
+            Path freshTmp = dir.resolve(key.hash() + "fresh.tmp");
+            Files.createFile(freshTmp);
+
+            store.save(key, sampleToken("ACCESS-1", "REFRESH-1"));
+
+            Assert.assertFalse("a stale orphan temp must be swept on save", Files.exists(staleTmp));
+            Assert.assertTrue("a fresh temp (a concurrent writer's) must not be swept", Files.exists(freshTmp));
+            Assert.assertNotNull("the save must still succeed", store.load(key));
+        });
+    }
+
     @Test
     public void testTokenStoreKeyRejectsNullRequiredFields() throws Exception {
         assertMemoryLeak(() -> {
@@ -757,6 +781,23 @@ public void testTruncatedJsonReturnsNull() throws Exception {
         });
     }
 
+    @Test
+    public void testVersionOverflowReturnsNull() throws Exception {
+        assertMemoryLeak(() -> {
+            Path dir = storeDir();
+            FileTokenStore store = new FileTokenStore(dir);
+            TokenStoreKey key = sampleKey();
+            // a tampered version that narrows to SCHEMA_VERSION when cast to int (1 + 2^32) must not pass the
+            // schema gate: the parser keeps the version as a long and compares it as a long
+            store.save(key, sampleToken("ACCESS-1", "REFRESH-1"));
+            Assert.assertNotNull("the valid entry must load", store.load(key));
+            byte[] valid = Files.readAllBytes(tokenFile(dir, key));
+            String tampered = new String(valid, StandardCharsets.UTF_8).replace("\"v\":1", "\"v\":4294967297");
+            Files.write(tokenFile(dir, key), tampered.getBytes(StandardCharsets.UTF_8));
+            Assert.assertNull("a version that truncates to 1 as an int must be rejected", store.load(key));
+        });
+    }
+
     private static TokenStoreKey sampleKey() {
         return new TokenStoreKey("questdb", "https://idp.example.com:443/token",
                 "https://idp.example.com:443/device", "openid", null, false);