* fix: enforce secure permissions for cron store and run logs * fix(cron): enforce dir perms and gate posix tests on windows * Cron store tests: cover existing directory permission hardening * Cron run-log tests: cover existing directory permission hardening * Changelog: note cron file permission hardening --------- Co-authored-by: linhey <linhey@mini.local> Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
132 lines
4.1 KiB
TypeScript
132 lines
4.1 KiB
TypeScript
import { randomBytes } from "node:crypto";
|
|
import fs from "node:fs";
|
|
import path from "node:path";
|
|
import JSON5 from "json5";
|
|
import { expandHomePrefix } from "../infra/home-dir.js";
|
|
import { CONFIG_DIR } from "../utils.js";
|
|
import type { CronStoreFile } from "./types.js";
|
|
|
|
export const DEFAULT_CRON_DIR = path.join(CONFIG_DIR, "cron");
|
|
export const DEFAULT_CRON_STORE_PATH = path.join(DEFAULT_CRON_DIR, "jobs.json");
|
|
const serializedStoreCache = new Map<string, string>();
|
|
|
|
export function resolveCronStorePath(storePath?: string) {
|
|
if (storePath?.trim()) {
|
|
const raw = storePath.trim();
|
|
if (raw.startsWith("~")) {
|
|
return path.resolve(expandHomePrefix(raw));
|
|
}
|
|
return path.resolve(raw);
|
|
}
|
|
return DEFAULT_CRON_STORE_PATH;
|
|
}
|
|
|
|
export async function loadCronStore(storePath: string): Promise<CronStoreFile> {
|
|
try {
|
|
const raw = await fs.promises.readFile(storePath, "utf-8");
|
|
let parsed: unknown;
|
|
try {
|
|
parsed = JSON5.parse(raw);
|
|
} catch (err) {
|
|
throw new Error(`Failed to parse cron store at ${storePath}: ${String(err)}`, {
|
|
cause: err,
|
|
});
|
|
}
|
|
const parsedRecord =
|
|
parsed && typeof parsed === "object" && !Array.isArray(parsed)
|
|
? (parsed as Record<string, unknown>)
|
|
: {};
|
|
const jobs = Array.isArray(parsedRecord.jobs) ? (parsedRecord.jobs as never[]) : [];
|
|
const store = {
|
|
version: 1 as const,
|
|
jobs: jobs.filter(Boolean) as never as CronStoreFile["jobs"],
|
|
};
|
|
serializedStoreCache.set(storePath, JSON.stringify(store, null, 2));
|
|
return store;
|
|
} catch (err) {
|
|
if ((err as { code?: unknown })?.code === "ENOENT") {
|
|
serializedStoreCache.delete(storePath);
|
|
return { version: 1, jobs: [] };
|
|
}
|
|
throw err;
|
|
}
|
|
}
|
|
|
|
type SaveCronStoreOptions = {
|
|
skipBackup?: boolean;
|
|
};
|
|
|
|
async function setSecureFileMode(filePath: string): Promise<void> {
|
|
await fs.promises.chmod(filePath, 0o600).catch(() => undefined);
|
|
}
|
|
|
|
export async function saveCronStore(
|
|
storePath: string,
|
|
store: CronStoreFile,
|
|
opts?: SaveCronStoreOptions,
|
|
) {
|
|
const storeDir = path.dirname(storePath);
|
|
await fs.promises.mkdir(storeDir, { recursive: true, mode: 0o700 });
|
|
await fs.promises.chmod(storeDir, 0o700).catch(() => undefined);
|
|
const json = JSON.stringify(store, null, 2);
|
|
const cached = serializedStoreCache.get(storePath);
|
|
if (cached === json) {
|
|
return;
|
|
}
|
|
|
|
let previous: string | null = cached ?? null;
|
|
if (previous === null) {
|
|
try {
|
|
previous = await fs.promises.readFile(storePath, "utf-8");
|
|
} catch (err) {
|
|
if ((err as { code?: unknown }).code !== "ENOENT") {
|
|
throw err;
|
|
}
|
|
}
|
|
}
|
|
if (previous === json) {
|
|
serializedStoreCache.set(storePath, json);
|
|
return;
|
|
}
|
|
const tmp = `${storePath}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
|
|
await fs.promises.writeFile(tmp, json, { encoding: "utf-8", mode: 0o600 });
|
|
await setSecureFileMode(tmp);
|
|
if (previous !== null && !opts?.skipBackup) {
|
|
try {
|
|
const backupPath = `${storePath}.bak`;
|
|
await fs.promises.copyFile(storePath, backupPath);
|
|
await setSecureFileMode(backupPath);
|
|
} catch {
|
|
// best-effort
|
|
}
|
|
}
|
|
await renameWithRetry(tmp, storePath);
|
|
await setSecureFileMode(storePath);
|
|
serializedStoreCache.set(storePath, json);
|
|
}
|
|
|
|
const RENAME_MAX_RETRIES = 3;
|
|
const RENAME_BASE_DELAY_MS = 50;
|
|
|
|
async function renameWithRetry(src: string, dest: string): Promise<void> {
|
|
for (let attempt = 0; attempt <= RENAME_MAX_RETRIES; attempt++) {
|
|
try {
|
|
await fs.promises.rename(src, dest);
|
|
return;
|
|
} catch (err) {
|
|
const code = (err as { code?: string }).code;
|
|
if (code === "EBUSY" && attempt < RENAME_MAX_RETRIES) {
|
|
await new Promise((resolve) => setTimeout(resolve, RENAME_BASE_DELAY_MS * 2 ** attempt));
|
|
continue;
|
|
}
|
|
// Windows doesn't reliably support atomic replace via rename when dest exists.
|
|
if (code === "EPERM" || code === "EEXIST") {
|
|
await fs.promises.copyFile(src, dest);
|
|
await fs.promises.unlink(src).catch(() => {});
|
|
return;
|
|
}
|
|
throw err;
|
|
}
|
|
}
|
|
}
|