v0.35.0

src/secret_store/tests.rs

@@ -1,9 +1,23 @@
 mod tests {
     use super::*;
 
+    fn private_tempdir() -> tempfile::TempDir {
+        let dir = tempfile::tempdir().unwrap();
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(
+                dir.path(),
+                std::fs::Permissions::from_mode(0o700),
+            )
+            .unwrap();
+        }
+        dir
+    }
+
     #[tokio::test]
     async fn secret_round_trip_is_encrypted_in_sqlite_and_survives_key_reload() {
-        let dir = tempfile::tempdir().unwrap();
+        let dir = private_tempdir();
         crate::auth::prepare_directory(dir.path()).unwrap();
         let database = dir.path().join("config.sqlite3");
         crate::auth::prepare_database(&database).unwrap();
@@ -47,7 +61,7 @@ mod tests {
 
     #[tokio::test]
     async fn tampered_ciphertext_is_rejected() {
-        let dir = tempfile::tempdir().unwrap();
+        let dir = private_tempdir();
         crate::auth::prepare_directory(dir.path()).unwrap();
         let database = dir.path().join("config.sqlite3");
         crate::auth::prepare_database(&database).unwrap();