@threadedstack/wmd-web 0.1.14 → 0.1.15

package/RELEASE.json

@@ -1,7 +1,7 @@
 {
   "name": "wmd-web",
   "version": "0.3.2",
-  "commit": "1fe3dd6c164b913eecd21d64097b285c51fc1401",
+  "commit": "b591b664091fb3105d0cd0f341c56fe04131ff2c",
   "previous": "wmd-web-v0.1.0",
   "decisions": [
     "D-486",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@threadedstack/wmd-web",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "license": "MIT",
   "homepage": "https://github.com/threadedstack/wmd-releases",
   "repository": {
@@ -9,8 +9,8 @@
   },
   "description": "Browser host for wmd's guest vm.wasm (Web Workers + shared memory + WASI preview1)",
   "wmd": {
-    "tag": "v0.1.14",
-    "commit": "1fe3dd6c164b913eecd21d64097b285c51fc1401",
+    "tag": "v0.1.15",
+    "commit": "b591b664091fb3105d0cd0f341c56fe04131ff2c",
     "web": "0.3.2"
   },
   "type": "module",

package/relay/logfile.ts

@@ -26,14 +26,22 @@ export function createLogFile(o: LogFileOptions) {
   const retainMs = (o.retainDays ?? 14) * 24 * 3600_000
   const maxDir = o.maxLogDirBytes ?? 2 ** 30
   const warn = o.warn ?? ((m: string) => void process.stderr.write(`${m}\n`))
-  const append = o.append ?? ((p: string, t: string) => appendFileSync(p, t, { mode: 0o600 }))
-  // the directory holds connection metadata: owner only, also when it already existed with a looser mode
-  mkdirSync(o.dir, { recursive: true, mode: 0o700 })
+  // The directory holds connection metadata: never open to others. Its group bits are the operator's: on Linux they
+  // are the ACL mask, and a chmod to 0700 would switch off a reader granted with setfacl. New files are group-readable
+  // only when the directory is, so such a reader can read them too.
+  const lockDown = () => {
+    mkdirSync(o.dir, { recursive: true, mode: 0o700 })
+    const m = statSync(o.dir).mode & 0o777
+    if (m & 0o007) chmodSync(o.dir, m & 0o770)
+    return m & 0o040 ? 0o640 : 0o600
+  }
+  let fileMode: number
   try {
-    chmodSync(o.dir, 0o700)
+    fileMode = lockDown()
   } catch (e: any) {
-    throw new Error(`the log directory ${o.dir} must be owner-only (0700) and cannot be made so: ${e?.message ?? e}`)
+    throw new Error(`the log directory ${o.dir} must be closed to others and cannot be made so: ${e?.message ?? e}`)
   }
+  const append = o.append ?? ((p: string, t: string) => appendFileSync(p, t, { mode: fileMode }))
   const live = join(o.dir, LIVE)
   let size = existsSync(live) ? statSync(live).size : 0
   let born = existsSync(live) ? statSync(live).birthtimeMs || statSync(live).mtimeMs : now()
@@ -93,8 +101,7 @@ export function createLogFile(o: LogFileOptions) {
         append(live, text)
       } catch (e: any) {
         if (e?.code !== 'ENOENT') throw e
-        mkdirSync(o.dir, { recursive: true, mode: 0o700 }) // the directory was removed: make it again and try once more
-        chmodSync(o.dir, 0o700)
+        fileMode = lockDown() // the directory was removed: make it again and try once more
         size = 0
         append(live, text)
       }