fix(api): hide campaign operational internals

src/govoplan_campaign/backend/persistence/campaigns.py

@@ -1,13 +1,14 @@
 from __future__ import annotations
 
+import copy
 import hashlib
 import json
+import os
+from datetime import UTC, datetime
 from email import policy
 from email.parser import BytesParser
 from pathlib import Path
 from typing import Any
-import copy
-from datetime import UTC, datetime
 from uuid import uuid4
 
 from sqlalchemy import func
@@ -44,8 +45,9 @@ class CampaignPersistenceError(RuntimeError):
 
 
 def _ensure_dirs() -> None:
-    CAMPAIGN_SNAPSHOT_DIR.mkdir(parents=True, exist_ok=True)
-    BUILD_OUTPUT_DIR.mkdir(parents=True, exist_ok=True)
+    for directory in (CAMPAIGN_SNAPSHOT_DIR, BUILD_OUTPUT_DIR):
+        directory.mkdir(parents=True, mode=0o700, exist_ok=True)
+        directory.chmod(0o700)
 
 
 
@@ -74,7 +76,18 @@ def load_campaign_config_from_json(
 def _write_campaign_snapshot(version: CampaignVersion) -> Path:
     _ensure_dirs()
     path = CAMPAIGN_SNAPSHOT_DIR / f"{version.id}.json"
-    path.write_text(json.dumps(version.raw_json, ensure_ascii=False, indent=2), encoding="utf-8")
+    flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    descriptor = os.open(path, flags, 0o600)
+    try:
+        os.fchmod(descriptor, 0o600)
+        with os.fdopen(descriptor, "w", encoding="utf-8") as stream:
+            descriptor = -1
+            json.dump(version.raw_json, stream, ensure_ascii=False, indent=2)
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
     return path