feat(security): enforce least-privilege private permissions (0600/0700) on secret-bearing files and directories (Closes #661)

[stayzappy]

Objective & Overview

Closes #661

This Pull Request implements least-privilege file and directory permission enforcement (0600 for secret files, 0700 for directories) across secret-bearing persistence stores in StarForge (.starforge config directory, starforge.db database, wallet backups, and credentials files). It includes automatic audit & repair capabilities to fix legacy or overly permissive files (0644, 0755) upon CLI execution.

---

Key Changes Made

1. Security Permissions Utility Module (src/utils/fs_permissions.rs):

   • ensure_private_file_permissions(&Path): Checks file mode and enforces 0600 (-rw-------) on Unix systems (cfg(unix)).
   • ensure_private_dir_permissions(&Path): Checks directory mode and enforces 0700 (drwx------) on Unix systems.
   • create_private_dir_all(&Path): Recursively creates directory tree with 0700 permissions.
   • create_private_file(&Path, content): Creates/overwrites files atomically with 0600 permissions.
   • audit_and_repair_config_dir(&Path): Audits .starforge directory contents, repairs loose permissions (0644/0755 -> 0600/0700), and returns a detailed PermissionAuditReport.

2. Core Integration:

   • Configuration (src/utils/config.rs): Integrated create_private_dir_all and ensure_private_dir_permissions in config_dir() and get_data_dir(), and create_private_file in backup_config().
   • Database (src/utils/database.rs): Integrated ensure_private_file_permissions in Database::open() for starforge.db.

3. Automated Unit Tests:

   • Added unit tests in src/utils/fs_permissions.rs covering:
     • Primary flow: Creation and permissions verification (0600 file, 0700 dir).
     • Boundary & Repair: Automatic detection and repair of loose permissions (0644 -> 0600, 0755 -> 0700).
     • Failure case: Graceful handling of invalid paths, non-existent files, and type mismatches.
   • All tests pass cleanly (3/3 passed).

---

Acceptance Criteria Checklist

• Clear handling for invalid input, unsupported environments, and failure paths.
• Automated tests cover primary flow, boundary case, and failure case.
• Developer guidance and security documentation notes included.

[drips-wave]

@stayzappy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits