Preserve private mode for OAuth fallback writes
Cooper Gamble committed
May 29, 2026 at 11:23 UTC
1acf88e323f5a0855458422c4993f578726f0b12
2 files changed
+6
plugins/_oauth/helpers/codex.py
+4
@@ -1085,6 +1085,10 @@ def _write_auth_file_in_place(path: Path, data: dict[str, Any]) -> None:
1085
handle.write(json.dumps(data, indent=2) + "\n")
1086
handle.flush()
1087
os.fsync(handle.fileno())
1088
+ try:
1089
+ path.chmod(0o600)
1090
+ except OSError:
1091
+ pass
1092
1093
1094
def _validate_private_auth_path(path: Path) -> Path:
tests/test_oauth_codex.py
+2
@@ -304,6 +304,7 @@ def test_write_auth_file_falls_back_for_file_bind_mount(tmp_path, monkeypatch):
304
assert json.loads(auth_path.read_text(encoding="utf-8")) == {
305
"tokens": {"refresh_token": "refresh-1"}
306
}
307
+ assert stat.S_IMODE(auth_path.stat().st_mode) == 0o600
308
assert list(tmp_path.glob(".auth.json.*.tmp")) == []
309
310
@@ -324,6 +325,7 @@ def test_write_auth_file_falls_back_when_parent_rejects_temporary_files(tmp_path
325
assert json.loads(auth_path.read_text(encoding="utf-8")) == {
326
"tokens": {"refresh_token": "refresh-1"}
327
}
328
+ assert stat.S_IMODE(auth_path.stat().st_mode) == 0o600
329
assert not auth_path.with_name(".auth.json.lock").exists()
330
331