devsyncwrld/backspace
1
0
Fork 0
Code Issues Pull Requests Actions 23 Packages Projects Releases Wiki Activity

harden(security): chmod seed-admin-rotated.txt to 0600 (guarantee perms on overwrite)

Browse Source
This commit is contained in:
Jannis Braun
2026-06-20 02:51:13 +02:00
parent 1c23c1fb60
commit 5107f63e60
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/scripts/remediate-seed-admin.ts
+3
View File
@@ -40,6 +40,9 @@ if (isMain) {
// (on the bind-mount → visible on the host as data/seed-admin-rotated.txt). // (on the bind-mount → visible on the host as data/seed-admin-rotated.txt).
const outFile = path.join(path.dirname(dbPath), 'seed-admin-rotated.txt'); const outFile = path.join(path.dirname(dbPath), 'seed-admin-rotated.txt');
fs.writeFileSync(outFile, `${r.newPassword}\n`, { mode: 0o600 }); fs.writeFileSync(outFile, `${r.newPassword}\n`, { mode: 0o600 });
// `mode` only applies when the file is newly created; chmod guarantees 0600
// even if a prior run left the file with looser permissions (it holds a password).
fs.chmodSync(outFile, 0o600);
console.log('Seed admin password ROTATED.'); console.log('Seed admin password ROTATED.');
console.log(` New password: ${r.newPassword}`); console.log(` New password: ${r.newPassword}`);
console.log(` Also written to: ${outFile} (delete after you have stored it)`); console.log(` Also written to: ${outFile} (delete after you have stored it)`);