Confine local file installation paths

internal/audio/s3_audio.go

@@ -3,6 +3,7 @@ package audio
 import (
 	"context"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -142,29 +143,7 @@ func downloadObjectAtomic(ctx context.Context, store storage.ObjectStore, key, d
 	if err := fileops.EnsureWorkspaceDirectory(dir); err != nil {
 		return fmt.Errorf("create destination directory: %w", err)
 	}
-	base := filepath.Base(destPath)
-	tmp, err := os.CreateTemp(dir, "."+base+".download-*.tmp")
-	if err != nil {
-		return fmt.Errorf("create temp file: %w", err)
-	}
-	tmpPath := tmp.Name()
-	if err := tmp.Close(); err != nil {
-		_ = os.Remove(tmpPath)
-		return fmt.Errorf("close temp file: %w", err)
-	}
-	removeTmp := true
-	defer func() {
-		if removeTmp {
-			_ = os.Remove(tmpPath)
-		}
-	}()
-
-	if err := store.Download(ctx, key, tmpPath); err != nil {
-		return err
-	}
-	if err := fileops.InstallDownloadedTempFile(tmpPath, destPath, fileops.WorkspaceFileMode); err != nil {
-		return err
-	}
-	removeTmp = false
-	return nil
+	return fileops.DownloadAndInstall(destPath, fileops.WorkspaceFileMode, func(destination io.Writer) error {
+		return storage.DownloadTo(ctx, store, key, destination)
+	})
 }