From 9adb459d9998d79b00737d0175664a11d5f1ccb9 Mon Sep 17 00:00:00 2001 From: Brian Krabach Date: Sat, 28 Mar 2026 21:04:31 -0700 Subject: [PATCH] fix(auth): use _config_dir() in load_or_create_secret for consistent 0700 dir permissions Replace bare path.parent.mkdir() (no mode, defaults to umask ~0755) with _config_dir() which always creates ~/.config/muxplex with mode=0o700. This matches the pattern already used by generate_and_save_password() and ensures the config directory is never left traversable by other users. Also update the module docstring to reflect that the module now manages both passwords and signing secrets. --- muxplex/auth.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/muxplex/auth.py b/muxplex/auth.py index fe74478..05d907f 100644 --- a/muxplex/auth.py +++ b/muxplex/auth.py @@ -1,5 +1,5 @@ """ -muxplex authentication — password file management. +muxplex authentication — password and signing secret file management. """ import secrets @@ -62,7 +62,7 @@ def load_or_create_secret() -> str: if path.exists(): return path.read_text().strip() secret = secrets.token_urlsafe(32) - path.parent.mkdir(parents=True, exist_ok=True) + _config_dir() # ensures dir exists with mode 0700, consistent with generate_and_save_password() path.write_text(secret + "\n") path.chmod(0o600) return secret