Migrate ordinary I/O from confined file helpers

internal/app/secrets_env.go

@@ -49,7 +49,14 @@ func loadSecretsFromConfig(cfg *config.Config, logger *slog.Logger) (*secretsLoa
 	}
 	resolvedDir = filepath.Clean(resolvedDir)
 
-	if err := fileops.ValidateConfinedDirectory(resolvedDir, validateSecretDirectory); err != nil {
+	directoryInfo, err := os.Lstat(resolvedDir)
+	if err != nil {
+		return nil, fmt.Errorf("API-key loader: validate secrets env_dir: %w", err)
+	}
+	if directoryInfo.Mode()&os.ModeSymlink != 0 {
+		return nil, fmt.Errorf("API-key loader: secrets env_dir must not be a symbolic link")
+	}
+	if err := validateSecretDirectory(directoryInfo); err != nil {
 		return nil, fmt.Errorf("API-key loader: validate secrets env_dir: %w", err)
 	}
 
@@ -57,6 +64,13 @@ func loadSecretsFromConfig(cfg *config.Config, logger *slog.Logger) (*secretsLoa
 	if err != nil {
 		return nil, fmt.Errorf("API-key loader: read secrets env_dir %q: %w", resolvedDir, err)
 	}
+	directoryInfo, err = os.Lstat(resolvedDir)
+	if err != nil || directoryInfo.Mode()&os.ModeSymlink != 0 {
+		if err == nil {
+			err = fmt.Errorf("symbolic links are not allowed")
+		}
+		return nil, fmt.Errorf("API-key loader: validate secrets env_dir: %w", err)
+	}
 
 	stats := &secretsLoadStats{Dir: resolvedDir}
 	for _, entry := range entries {
@@ -107,15 +121,23 @@ func validateSecretFile(info os.FileInfo) error {
 }
 
 func readAPIKeyFile(directory, name string) (string, error) {
-	content, err := fileops.ReadRegularFileUnderRoot(
-		directory,
-		name,
-		APIKeyFileByteLimit,
-		validateSecretDirectory,
-		validateSecretFile,
-	)
+	path := filepath.Join(directory, name)
+	info, err := os.Lstat(path)
+	if err == nil && info.Mode()&os.ModeSymlink != 0 {
+		return "", fmt.Errorf("API-key loader: read secret file %q with %d-byte limit: symbolic links are not allowed", name, APIKeyFileByteLimit)
+	}
+	if err == nil {
+		err = validateSecretFile(info)
+	}
+	if err == nil {
+		content, readErr := fileops.ReadFileBounded(path, APIKeyFileByteLimit)
+		if readErr == nil {
+			return strings.TrimRight(string(content), "\r\n"), nil
+		}
+		err = readErr
+	}
 	if err != nil {
 		return "", fmt.Errorf("API-key loader: read secret file %q with %d-byte limit: %w", name, APIKeyFileByteLimit, err)
 	}
-	return strings.TrimRight(string(content), "\r\n"), nil
+	return "", fmt.Errorf("API-key loader: read secret file %q with %d-byte limit", name, APIKeyFileByteLimit)
 }