|
| 1 | +import { mkdirSync, renameSync, writeFileSync } from 'node:fs' |
| 2 | +import { mkdir, rename, unlink, writeFile } from 'node:fs/promises' |
| 3 | +import { dirname } from 'node:path' |
| 4 | + |
| 5 | +/** Owner-only, matching every store that keeps user data in userData. */ |
| 6 | +const FILE_MODE = 0o600 |
| 7 | + |
| 8 | +/** |
| 9 | + * Distinct per call, not just per process. |
| 10 | + * |
| 11 | + * The pid keeps a second Sim process from sharing the path — the site |
| 12 | + * directory used a bare `.tmp` and could be clobbered by exactly that. The |
| 13 | + * counter covers the other half: these stores are read-modify-write with no |
| 14 | + * lock, so two overlapping writes to the SAME store in one process (a password |
| 15 | + * import racing a forget) would otherwise both truncate and write the one |
| 16 | + * temp file, and the first rename would publish a spliced blob. The vault |
| 17 | + * treats an unparseable file as empty, so that surfaces as every saved |
| 18 | + * password silently vanishing. |
| 19 | + */ |
| 20 | +let temporaryFileCounter = 0 |
| 21 | +function temporaryPathFor(filePath: string): string { |
| 22 | + temporaryFileCounter += 1 |
| 23 | + return `${filePath}.${process.pid}.${temporaryFileCounter}.tmp` |
| 24 | +} |
| 25 | + |
| 26 | +/** |
| 27 | + * Crash-safe JSON writes for the small encrypted stores in userData. |
| 28 | + * |
| 29 | + * Every one of them (local-filesystem grants, the credential vault, the site |
| 30 | + * directory) had written this same temp-file-then-rename sequence by hand, and |
| 31 | + * they had already drifted: two scoped the temporary file by pid and the third |
| 32 | + * did not, so two Sim processes writing that store could clobber each other |
| 33 | + * through a shared `.tmp` path. Owning the sequence once removes the class. |
| 34 | + */ |
| 35 | +export async function writeJsonFileAtomically(filePath: string, value: unknown): Promise<void> { |
| 36 | + await mkdir(dirname(filePath), { recursive: true }) |
| 37 | + const temporaryPath = temporaryPathFor(filePath) |
| 38 | + await writeFile(temporaryPath, JSON.stringify(value), { mode: FILE_MODE }) |
| 39 | + await rename(temporaryPath, filePath) |
| 40 | +} |
| 41 | + |
| 42 | +/** |
| 43 | + * The same sequence for a caller that cannot await. |
| 44 | + * |
| 45 | + * Only the settings store needs this: it flushes on `before-quit`, where the |
| 46 | + * event loop stops before a promise would settle. `indent` because that file |
| 47 | + * is one users open and edit by hand. |
| 48 | + */ |
| 49 | +export function writeJsonFileAtomicallySync( |
| 50 | + filePath: string, |
| 51 | + value: unknown, |
| 52 | + indent?: number |
| 53 | +): void { |
| 54 | + mkdirSync(dirname(filePath), { recursive: true }) |
| 55 | + const temporaryPath = temporaryPathFor(filePath) |
| 56 | + writeFileSync(temporaryPath, JSON.stringify(value, null, indent), { mode: FILE_MODE }) |
| 57 | + renameSync(temporaryPath, filePath) |
| 58 | +} |
| 59 | + |
| 60 | +/** |
| 61 | + * Deletes a store file, treating "already gone" as success. |
| 62 | + * |
| 63 | + * Anything else rethrows: a store that reports a successful `clear()` after an |
| 64 | + * EACCES tells sign-out teardown the data is gone when it is still on disk. |
| 65 | + */ |
| 66 | +export async function removeFileIfPresent(filePath: string): Promise<void> { |
| 67 | + try { |
| 68 | + await unlink(filePath) |
| 69 | + } catch (error) { |
| 70 | + if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error |
| 71 | + } |
| 72 | +} |
0 commit comments