fix(moss-cli): enforce 0600 on existing config.json

AS
1mo ago
+18-0

Description

save_config() creates ~/.moss/config.json with os.open(..., 0o600), but open(2) only applies that mode when it creates the file. If config.json already exists with looser permissions (for example 0644 after a backup restore, dotfile sync, or manual chmod), every later moss init / profile write keeps those permissions and writes the plaintext project_key into a group/world-readable file.

This adds an explicit os.chmod(path, 0o600) right after opening the file. The file has already been truncated at that point, so it is tightened before any credentials are written. This covers every caller of save_config() (set_profile_credentials(), delete_profile()).

Reported by Nikhil Sai (@NSK-394).

Type of Change

  • Bug fix (non-breaking change which fixes an issue)

Testing

  • Added test_save_config_restricts_existing_file_permissions: starts from an existing 0644 config.json, writes credentials, asserts the file ends up 0600. Fails on main, passes with this change. Skipped on Windows.
  • pytest packages/moss-cli/tests: all profile tests pass. The 2 test_completions failures are pre-existing on main and unrelated.
  • Re-ran the reporter's repro: a pre-existing 0644 file becomes 0600 after set_profile_credentials() and delete_profile().

Summary by CodeRabbit

  • Security
    • Configuration files are now restricted to owner-only access, including when updating an existing file with broader permissions.