Skip to main content

load_or_create_broker_token

synaps_cli::auth

Function load_or_create_broker_token 

Source 
pub fn load_or_create_broker_token(
    path: &Path,
) -> Result<(String, BrokerTokenOrigin), Error>
Expand description

Broker side: read the token at path, or create it when absent.

Hardening (prA I3):

  • a symlink is refused (never followed), as is anything but a regular file, or a file owned by another user;
  • a file readable by group/other is treated as leaked: a NEW token is written (atomically, 0600) instead of chmod-ing and reusing the old one;
  • creation writes a 0600 temp file and hard-links it into place, so a concurrent starter never sees a half-written file, and the loser reads the winner’s token;
  • an empty existing file is an error (delete it to regenerate).