From 41dd030cd6414f0acf60a32dcc4de415966601d0 Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Tue, 16 Jun 2026 00:00:45 -0500 Subject: chore(scripts): warn when apikey.txt is group/other-readable The seed script reads the Linear key from the environment, but the README sources it from a gitignored `apikey.txt` that was landing at mode 644. `main` now warns on startup when that file is group- or other-accessible, so a loose key file gets flagged instead of sitting silently exposed. The warning points at `chmod 600`. --- scripts/tests/test_seed_pearl_workspace.py | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'scripts/tests') diff --git a/scripts/tests/test_seed_pearl_workspace.py b/scripts/tests/test_seed_pearl_workspace.py index 5f4147e..e52d78a 100644 --- a/scripts/tests/test_seed_pearl_workspace.py +++ b/scripts/tests/test_seed_pearl_workspace.py @@ -296,3 +296,25 @@ def test_client_raises_on_graphql_errors(): client = seed.LinearClient("key", transport=fake) with pytest.raises(seed.LinearError, match="bad key"): client.execute("query Teams { teams { nodes { id } } }", {}) + + +# --- key-file permission warning ---------------------------------------------- + +def test_warn_key_file_world_readable_warns(tmp_path, capsys): + p = tmp_path / "apikey.txt" + p.write_text("lin_api_secret") + os.chmod(p, 0o644) + assert seed.warn_if_key_file_world_readable(str(p)) is True + assert "600" in capsys.readouterr().err + + +def test_warn_key_file_mode_600_is_silent(tmp_path, capsys): + p = tmp_path / "apikey.txt" + p.write_text("lin_api_secret") + os.chmod(p, 0o600) + assert seed.warn_if_key_file_world_readable(str(p)) is False + assert capsys.readouterr().err == "" + + +def test_warn_key_file_absent_is_silent(tmp_path): + assert seed.warn_if_key_file_world_readable(str(tmp_path / "nope.txt")) is False -- cgit v1.2.3