Respect deployment permissions for chunk plans

internal/framework/chunkplan/store_permissions_unix_test.go

@@ -0,0 +1,76 @@
+//go:build linux || darwin
+
+package chunkplan
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+)
+
+func TestFilesystemStorePermissions(t *testing.T) {
+	for _, test := range []struct {
+		name     string
+		umask    int
+		dirMode  os.FileMode
+		fileMode os.FileMode
+	}{
+		{name: "private", umask: 0o077, dirMode: 0o700, fileMode: 0o600},
+		{name: "group", umask: 0o007, dirMode: 0o770, fileMode: 0o660},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			previousUmask := syscall.Umask(test.umask)
+			defer syscall.Umask(previousUmask)
+
+			root := filepath.Join(t.TempDir(), "plans")
+			store := newStore(t, root)
+			if err := store.Save(testRecord(t, 1)); err != nil {
+				t.Fatal(err)
+			}
+			digestDir := filepath.Join(root, strings.TrimPrefix(testSourceDigest, "sha256:"))
+			for path, want := range map[string]os.FileMode{
+				root:                                  test.dirMode,
+				digestDir:                             test.dirMode,
+				filepath.Join(digestDir, "plan.json"): test.fileMode,
+			} {
+				assertStorePermissions(t, path, want)
+			}
+		})
+	}
+}
+
+func TestFilesystemStoreLeavesExistingDirectoriesUntouched(t *testing.T) {
+	previousUmask := syscall.Umask(0o077)
+	defer syscall.Umask(previousUmask)
+
+	root := filepath.Join(t.TempDir(), "plans")
+	digestDir := filepath.Join(root, strings.TrimPrefix(testSourceDigest, "sha256:"))
+	syscall.Umask(0)
+	if err := os.Mkdir(root, 0o751); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Mkdir(digestDir, 0o753); err != nil {
+		t.Fatal(err)
+	}
+	syscall.Umask(0o077)
+
+	store := newStore(t, root)
+	if err := store.Save(testRecord(t, 1)); err != nil {
+		t.Fatal(err)
+	}
+	assertStorePermissions(t, root, 0o751)
+	assertStorePermissions(t, digestDir, 0o753)
+}
+
+func assertStorePermissions(t *testing.T, path string, want os.FileMode) {
+	t.Helper()
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := info.Mode().Perm(); got != want {
+		t.Fatalf("%s mode = %#o, want %#o", path, got, want)
+	}
+}