feat(chat): create session files with 0600 owner-only permissions (#366)

SAY-5 · SAY-5 · web-flow · commit d29d34644966 · 2026-05-05T14:15:46.000+02:00
Closes #355. Signed-off-by: SAY-5 <saiasish.cnp@gmail.com> Co-authored-by: SAY-5 <saiasish.cnp@gmail.com>
diff --git a/pkg/chat/chat.go b/pkg/chat/chat.go
@@ -31,7 +31,7 @@ import (
 )
 
 const (
-	defaultFilePermissions = 0755
+	defaultFilePermissions = 0600
 	sessionNameMaxLength   = 65
 )
 
diff --git a/pkg/chat/filesystem.go b/pkg/chat/filesystem.go
@@ -161,8 +161,8 @@ func (m FilesystemChatSessionManager) SaveSession(sessionName string, messages [
 		}
 		slog.Debug("Existing session file opened and truncated")
 	} else {
-		// Create file
-		file, err = os.Create(sessionFilepath)
+		// Create file with owner-only permissions; sessions may contain sensitive data.
+		file, err = os.OpenFile(sessionFilepath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, defaultFilePermissions)
 		if err != nil {
 			return err
 		}
diff --git a/pkg/chat/filesystem_test.go b/pkg/chat/filesystem_test.go
@@ -290,6 +290,33 @@ func createTestConfig(t *testing.T) *viper.Viper {
 	return config
 }
 
+func TestFilesystemChatSessionManager_SaveSession_FilePermissions(t *testing.T) {
+	config := createTestConfig(t)
+
+	manager, err := NewFilesystemChatSessionManager(config)
+	require.NoError(t, err)
+
+	messages := createTestMessages()
+
+	// New session: file is created via os.Create.
+	err = manager.SaveSession("perm_new", messages)
+	require.NoError(t, err)
+
+	info, err := os.Stat(filepath.Join(config.GetString("cacheDir"), "perm_new"))
+	require.NoError(t, err)
+	require.Equal(t, os.FileMode(0600), info.Mode().Perm(),
+		"new session file must be owner-only (0600), got %o", info.Mode().Perm())
+
+	// Existing session: file is reopened via os.OpenFile with defaultFilePermissions.
+	err = manager.SaveSession("perm_new", messages)
+	require.NoError(t, err)
+
+	info, err = os.Stat(filepath.Join(config.GetString("cacheDir"), "perm_new"))
+	require.NoError(t, err)
+	require.Equal(t, os.FileMode(0600), info.Mode().Perm(),
+		"reopened session file must remain owner-only (0600), got %o", info.Mode().Perm())
+}
+
 func TestFilesystemChatSessionManager_GetSession_ScannerError(t *testing.T) {
 	config := createTestConfig(t)
 

Original file line number	Diff line number	Diff line change
`@@ -31,7 +31,7 @@ import (`
`31`	`31`	`)`
`32`	`32`
`33`	`33`	`const (`
`34`		`- defaultFilePermissions = 0755`
	`34`	`+ defaultFilePermissions = 0600`
`35`	`35`	`sessionNameMaxLength = 65`
`36`	`36`	`)`
`37`	`37`
Original file line number	Diff line number	Diff line change
`@@ -161,8 +161,8 @@ func (m FilesystemChatSessionManager) SaveSession(sessionName string, messages [`
`161`	`161`	`}`
`162`	`162`	`slog.Debug("Existing session file opened and truncated")`
`163`	`163`	`} else {`
`164`		`- // Create file`
`165`		`- file, err = os.Create(sessionFilepath)`
	`164`	`+ // Create file with owner-only permissions; sessions may contain sensitive data.`
	`165`	`+ file, err = os.OpenFile(sessionFilepath, os.O_WRONLY\|os.O_CREATE\|os.O_TRUNC, defaultFilePermissions)`
`166`	`166`	`if err != nil {`
`167`	`167`	`return err`
`168`	`168`	`}`