fix(daemon): lock entitlement cache file permissions

crates/hypercolor-daemon/src/cloud_entitlements.rs

@@ -59,10 +59,33 @@ pub async fn store_entitlement_response(
         tokio::fs::create_dir_all(parent).await?;
     }
     let bytes = serde_json::to_vec_pretty(&entitlement)?;
-    tokio::fs::write(path, bytes).await?;
+    write_entitlement_cache(path, bytes).await?;
     Ok(entitlement)
 }
 
+#[cfg(unix)]
+async fn write_entitlement_cache(path: &Path, bytes: Vec<u8>) -> std::io::Result<()> {
+    use std::os::unix::fs::OpenOptionsExt;
+
+    let path = path.to_path_buf();
+    tokio::task::spawn_blocking(move || {
+        let mut file = std::fs::OpenOptions::new()
+            .create(true)
+            .truncate(true)
+            .write(true)
+            .mode(0o600)
+            .open(path)?;
+        std::io::Write::write_all(&mut file, &bytes)
+    })
+    .await
+    .map_err(|error| std::io::Error::other(error.to_string()))?
+}
+
+#[cfg(not(unix))]
+async fn write_entitlement_cache(path: &Path, bytes: Vec<u8>) -> std::io::Result<()> {
+    tokio::fs::write(path, bytes).await
+}
+
 pub async fn load_cached_entitlement(
     path: impl AsRef<Path>,
 ) -> Result<Option<CachedCloudEntitlement>, EntitlementCacheError> {

crates/hypercolor-daemon/tests/cloud_api_tests.rs

@@ -244,6 +244,16 @@ async fn cloud_entitlement_cache_round_trips_and_deletes_token() {
     assert_eq!(cached.jwt, "header.payload.signature");
     assert_eq!(loaded.claims.tier, "free");
     assert!(!loaded.is_stale_at_unix(1_999_999_999));
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let mode = std::fs::metadata(&path)
+            .expect("cached entitlement metadata should load")
+            .permissions()
+            .mode()
+            & 0o777;
+        assert_eq!(mode, 0o600);
+    }
     assert!(
         cloud_entitlements::delete_cached_entitlement(&path)
             .await