Centralize path-safe root joins and atomic file operations

internal/fileops/fileops.go

@@ -0,0 +1,128 @@
+package fileops
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// WriteFileAtomic writes data to dst atomically via temp file + rename.
+func WriteFileAtomic(dst string, data []byte, perm os.FileMode) error {
+	if strings.TrimSpace(dst) == "" {
+		return fmt.Errorf("destination path is required")
+	}
+	if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
+		return fmt.Errorf("create destination directory: %w", err)
+	}
+
+	base := filepath.Base(dst)
+	tmp, err := os.CreateTemp(filepath.Dir(dst), "."+base+".tmp-*")
+	if err != nil {
+		return fmt.Errorf("create temp file: %w", err)
+	}
+	tmpPath := tmp.Name()
+	removeTmp := true
+	defer func() {
+		if removeTmp {
+			_ = os.Remove(tmpPath)
+		}
+	}()
+
+	if _, err := tmp.Write(data); err != nil {
+		_ = tmp.Close()
+		return fmt.Errorf("write temp file: %w", err)
+	}
+	if err := tmp.Sync(); err != nil {
+		_ = tmp.Close()
+		return fmt.Errorf("sync temp file: %w", err)
+	}
+	if err := tmp.Close(); err != nil {
+		return fmt.Errorf("close temp file: %w", err)
+	}
+	if err := os.Chmod(tmpPath, perm); err != nil {
+		return fmt.Errorf("set temp file permissions: %w", err)
+	}
+	if err := os.Rename(tmpPath, dst); err != nil {
+		return fmt.Errorf("install temp file: %w", err)
+	}
+	removeTmp = false
+	return nil
+}
+
+// CopyFileAtomic copies src to dst atomically via temp file + rename.
+func CopyFileAtomic(src, dst string, perm os.FileMode) error {
+	_, err := CopyFileAtomicWithChecksum(src, dst, perm)
+	return err
+}
+
+// CopyFileAtomicWithChecksum copies src to dst atomically and returns the SHA-256 checksum.
+func CopyFileAtomicWithChecksum(src, dst string, perm os.FileMode) (string, error) {
+	if strings.TrimSpace(src) == "" || strings.TrimSpace(dst) == "" {
+		return "", fmt.Errorf("source and destination paths are required")
+	}
+
+	in, err := os.Open(src)
+	if err != nil {
+		return "", fmt.Errorf("open source file: %w", err)
+	}
+	defer func() { _ = in.Close() }()
+
+	if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
+		return "", fmt.Errorf("create destination directory: %w", err)
+	}
+
+	base := filepath.Base(dst)
+	tmp, err := os.CreateTemp(filepath.Dir(dst), "."+base+".tmp-*")
+	if err != nil {
+		return "", fmt.Errorf("create temp file: %w", err)
+	}
+	tmpPath := tmp.Name()
+	removeTmp := true
+	defer func() {
+		if removeTmp {
+			_ = os.Remove(tmpPath)
+		}
+	}()
+
+	digest := sha256.New()
+	if _, err := io.Copy(io.MultiWriter(tmp, digest), in); err != nil {
+		_ = tmp.Close()
+		return "", fmt.Errorf("copy file: %w", err)
+	}
+	if err := tmp.Sync(); err != nil {
+		_ = tmp.Close()
+		return "", fmt.Errorf("sync temp file: %w", err)
+	}
+	if err := tmp.Close(); err != nil {
+		return "", fmt.Errorf("close temp file: %w", err)
+	}
+	if err := os.Chmod(tmpPath, perm); err != nil {
+		return "", fmt.Errorf("set temp file permissions: %w", err)
+	}
+	if err := os.Rename(tmpPath, dst); err != nil {
+		return "", fmt.Errorf("install temp file: %w", err)
+	}
+	removeTmp = false
+	return hex.EncodeToString(digest.Sum(nil)), nil
+}
+
+// InstallDownloadedTempFile installs a previously downloaded temp file at dst.
+func InstallDownloadedTempFile(tmpPath, dst string, perm os.FileMode) error {
+	if strings.TrimSpace(tmpPath) == "" || strings.TrimSpace(dst) == "" {
+		return fmt.Errorf("temp and destination paths are required")
+	}
+	if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
+		return fmt.Errorf("create destination directory: %w", err)
+	}
+	if err := os.Chmod(tmpPath, perm); err != nil {
+		return fmt.Errorf("set temp file permissions: %w", err)
+	}
+	if err := os.Rename(tmpPath, dst); err != nil {
+		return fmt.Errorf("install downloaded file: %w", err)
+	}
+	return nil
+}

internal/fileops/fileops_test.go

@@ -0,0 +1,125 @@
+package fileops
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestWriteFileAtomicOverwritesAndLeavesNoTempFile(t *testing.T) {
+	root := t.TempDir()
+	dst := filepath.Join(root, "out", "value.txt")
+
+	if err := WriteFileAtomic(dst, []byte("one"), 0o644); err != nil {
+		t.Fatalf("WriteFileAtomic(first) error = %v", err)
+	}
+	if err := WriteFileAtomic(dst, []byte("two"), 0o644); err != nil {
+		t.Fatalf("WriteFileAtomic(second) error = %v", err)
+	}
+
+	data, err := os.ReadFile(dst)
+	if err != nil {
+		t.Fatalf("ReadFile() error = %v", err)
+	}
+	if string(data) != "two" {
+		t.Fatalf("file content = %q, want %q", string(data), "two")
+	}
+
+	assertNoMatchingTempFiles(t, filepath.Dir(dst), "."+filepath.Base(dst)+".tmp-")
+}
+
+func TestWriteFileAtomicCleansTempFileOnInstallFailure(t *testing.T) {
+	root := t.TempDir()
+	blockedPath := filepath.Join(root, "blocked")
+	if err := os.MkdirAll(blockedPath, 0o755); err != nil {
+		t.Fatalf("MkdirAll(blockedPath) error = %v", err)
+	}
+
+	err := WriteFileAtomic(blockedPath, []byte("data"), 0o644)
+	if err == nil {
+		t.Fatal("WriteFileAtomic() error = nil, want install failure")
+	}
+	assertNoMatchingTempFiles(t, root, ".blocked.tmp-")
+}
+
+func TestCopyFileAtomicWithChecksumMatchesDestination(t *testing.T) {
+	root := t.TempDir()
+	src := filepath.Join(root, "source.txt")
+	dst := filepath.Join(root, "out", "copied.txt")
+	if err := os.WriteFile(src, []byte("copied-data"), 0o644); err != nil {
+		t.Fatalf("WriteFile(source) error = %v", err)
+	}
+
+	checksum, err := CopyFileAtomicWithChecksum(src, dst, 0o644)
+	if err != nil {
+		t.Fatalf("CopyFileAtomicWithChecksum() error = %v", err)
+	}
+	wantChecksum := "6e5c3f239e28cc315d57b2fcfc24169369c44a25802c0616a6d7081707fd24df"
+	if checksum != wantChecksum {
+		t.Fatalf("checksum = %q, want %q", checksum, wantChecksum)
+	}
+
+	data, err := os.ReadFile(dst)
+	if err != nil {
+		t.Fatalf("ReadFile(destination) error = %v", err)
+	}
+	if string(data) != "copied-data" {
+		t.Fatalf("destination content = %q, want %q", string(data), "copied-data")
+	}
+	assertNoMatchingTempFiles(t, filepath.Dir(dst), ".copied.txt.tmp-")
+}
+
+func TestCopyFileAtomicCleansTempFileOnInstallFailure(t *testing.T) {
+	root := t.TempDir()
+	src := filepath.Join(root, "source.txt")
+	if err := os.WriteFile(src, []byte("copied-data"), 0o644); err != nil {
+		t.Fatalf("WriteFile(source) error = %v", err)
+	}
+
+	blockedPath := filepath.Join(root, "blocked")
+	if err := os.MkdirAll(blockedPath, 0o755); err != nil {
+		t.Fatalf("MkdirAll(blockedPath) error = %v", err)
+	}
+	err := CopyFileAtomic(src, blockedPath, 0o644)
+	if err == nil {
+		t.Fatal("CopyFileAtomic() error = nil, want install failure")
+	}
+	assertNoMatchingTempFiles(t, root, ".blocked.tmp-")
+}
+
+func TestInstallDownloadedTempFileSetsPermissions(t *testing.T) {
+	root := t.TempDir()
+	tmpPath := filepath.Join(root, ".payload.tmp")
+	dst := filepath.Join(root, "out", "payload.json")
+	if err := os.WriteFile(tmpPath, []byte("{\"ok\":true}\n"), 0o600); err != nil {
+		t.Fatalf("WriteFile(temp) error = %v", err)
+	}
+
+	if err := InstallDownloadedTempFile(tmpPath, dst, 0o644); err != nil {
+		t.Fatalf("InstallDownloadedTempFile() error = %v", err)
+	}
+	if _, err := os.Stat(tmpPath); !os.IsNotExist(err) {
+		t.Fatalf("temp file still exists: stat err = %v", err)
+	}
+	info, err := os.Stat(dst)
+	if err != nil {
+		t.Fatalf("Stat(destination) error = %v", err)
+	}
+	if info.Mode().Perm() != 0o644 {
+		t.Fatalf("destination mode = %o, want 644", info.Mode().Perm())
+	}
+}
+
+func assertNoMatchingTempFiles(t *testing.T, dir, prefix string) {
+	t.Helper()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatalf("ReadDir(%q) error = %v", dir, err)
+	}
+	for _, e := range entries {
+		if strings.HasPrefix(e.Name(), prefix) {
+			t.Fatalf("unexpected temp file residue: %s", filepath.Join(dir, e.Name()))
+		}
+	}
+}