Harden installer runtime secrets

tests/test_module_system.py

@@ -8,6 +8,7 @@ import os
 import re
 import shlex
 import shutil
+import stat
 import subprocess
 import sys
 import tempfile
@@ -2562,9 +2563,33 @@ finally:
         self.assertEqual("external", database_backup["metadata"]["snapshot"])
         self.assertEqual("postgresql://govoplan:***@db.example.invalid/govoplan", database_backup["metadata"]["pgtools_url"])
         self.assertEqual("postgresql+psycopg://govoplan:***@db.example.invalid/govoplan", database_backup["stdout"].strip())
-        self.assertEqual(database_url, (result.record_path.parent / database_backup["database_url_secret"]).read_text(encoding="utf-8"))
+        secret_path = result.record_path.parent / database_backup["database_url_secret"]
+        self.assertEqual(database_url, secret_path.read_text(encoding="utf-8"))
+        self.assertEqual(0o700, stat.S_IMODE(result.record_path.parent.stat().st_mode))
+        self.assertEqual(0o600, stat.S_IMODE(secret_path.stat().st_mode))
         self.assertEqual("backup", (result.record_path.parent / "database.external.backup").read_text(encoding="utf-8"))
 
+    def test_installer_secret_creation_refuses_an_existing_path(self) -> None:
+        root = Path(tempfile.mkdtemp(prefix="govoplan-installer-secret-existing-", dir=_TEST_ROOT))
+        secret_path = root / "database-url.secret"
+        secret_path.write_text("existing-value", encoding="utf-8")
+
+        with self.assertRaisesRegex(module_installer_module.ModuleInstallerError, "Could not create private installer secret file"):
+            module_installer_module._write_installer_secret(secret_path, "replacement-value")
+
+        self.assertEqual("existing-value", secret_path.read_text(encoding="utf-8"))
+
+    def test_installer_run_directory_remains_usable_with_a_restrictive_umask(self) -> None:
+        root = Path(tempfile.mkdtemp(prefix="govoplan-installer-run-umask-", dir=_TEST_ROOT))
+        run_dir = root / "run"
+        previous_umask = os.umask(0o777)
+        try:
+            module_installer_module._create_private_installer_run_dir(run_dir)
+        finally:
+            os.umask(previous_umask)
+
+        self.assertEqual(0o700, stat.S_IMODE(run_dir.stat().st_mode))
+
     def test_module_installer_rejects_unsafe_external_database_hook_command(self) -> None:
         root = Path(tempfile.mkdtemp(prefix="govoplan-installer-unsafe-hook-", dir=_TEST_ROOT))
         settings = _settings(root)