ssh_cli/
fs_perm.rs

1// SPDX-License-Identifier: MIT OR Apache-2.0
2#![forbid(unsafe_code)]
3//! Unix secret file/dir modes — single source (G-AUD-24 / no hardcode drift).
4
5use std::path::Path;
6
7use crate::constants::{SECRET_DIR_MODE_UNIX, SECRET_FILE_MODE_UNIX};
8use crate::errors::{SshCliError, SshCliResult};
9
10/// Sets secret-file mode (`0o600`) on Unix; no-op on other targets.
11pub fn set_secret_file_mode(path: &Path) -> SshCliResult<()> {
12    #[cfg(unix)]
13    {
14        use std::os::unix::fs::PermissionsExt;
15        let mut perms = std::fs::metadata(path)
16            .map_err(SshCliError::Io)?
17            .permissions();
18        perms.set_mode(SECRET_FILE_MODE_UNIX);
19        std::fs::set_permissions(path, perms).map_err(SshCliError::Io)?;
20    }
21    let _ = path;
22    Ok(())
23}
24
25/// Sets secret-dir mode (`0o700`) on Unix; no-op on other targets.
26pub fn set_secret_dir_mode(path: &Path) -> SshCliResult<()> {
27    #[cfg(unix)]
28    {
29        use std::os::unix::fs::PermissionsExt;
30        let mut perms = std::fs::metadata(path)
31            .map_err(SshCliError::Io)?
32            .permissions();
33        perms.set_mode(SECRET_DIR_MODE_UNIX);
34        std::fs::set_permissions(path, perms).map_err(SshCliError::Io)?;
35    }
36    let _ = path;
37    Ok(())
38}
39
40/// Compile-time alias for call sites that need the raw secret-file mode integer.
41#[must_use]
42pub const fn secret_file_mode() -> u32 {
43    SECRET_FILE_MODE_UNIX
44}
45
46/// Compile-time alias for call sites that need the raw secret-dir mode integer.
47#[must_use]
48pub const fn secret_dir_mode() -> u32 {
49    SECRET_DIR_MODE_UNIX
50}
ssh_cli/fs_perm.rs

ssh_cli/
fs_perm.rs
