harden(auth): create token cache file 0600 from the start; backfill tests

Use os.open() with O_CREAT|O_TRUNC|0o600 in _write_cache so the
temp token file is never briefly world-readable under a permissive
umask. Add two tests for custom bearer-env-var derivation and
read-through (test_auth.py), plus an end-to-end auto_login test that
runs setup_environment(auto_login=True) through to ensure_token
(test_environment.py). 130 passed / 6 skipped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: sammuli

fdp/auth.py

@@ -176,7 +176,13 @@ def _write_cache(handle, token: str) -> None:
     path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
     os.chmod(path.parent, 0o700)
     tmp = path.with_suffix(".token.tmp")
-    tmp.write_text(token)
+    # Create with 0o600 from the start so the token is never briefly
+    # world-readable under a permissive umask. O_TRUNC overwrites any
+    # stale tmp from a crashed run; the explicit chmod fixes the mode of
+    # such a pre-existing file (O_CREAT won't change an existing file's mode).
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as f:
+        f.write(token)
     os.chmod(tmp, 0o600)
     os.replace(tmp, path)
 

tests/test_auth.py

@@ -126,6 +126,22 @@ def test_unusable_legacy_file_warns(self):
     def test_all_empty_returns_none(self):
         self.assertIsNone(auth.get_valid_token(_bearer_handle()))
 
+    def test_bearer_env_custom_name(self):
+        hint = SimpleNamespace(kind="bearer_token", env="FDP_TOKEN_X")
+        loc = SimpleNamespace(auth=hint)
+        handle = SimpleNamespace(schema=SimpleNamespace(
+            name="x", pelican_root="p", locators=[loc]))
+        self.assertEqual(auth.bearer_env(handle), "FDP_TOKEN_X")
+
+    def test_custom_env_var_used(self):
+        os.environ["FDP_TOKEN_X"] = "ctok"
+        self.addCleanup(os.environ.pop, "FDP_TOKEN_X", None)
+        hint = SimpleNamespace(kind="bearer_token", env="FDP_TOKEN_X")
+        loc = SimpleNamespace(auth=hint)
+        handle = SimpleNamespace(schema=SimpleNamespace(
+            name="x", pelican_root="p", locators=[loc]))
+        self.assertEqual(auth.get_valid_token(handle), "ctok")
+
 
 class TestLoginLogout(unittest.TestCase):
     def setUp(self):

tests/test_environment.py

@@ -198,6 +198,28 @@ def test_no_warn_when_opted_out(self):
                     [w for w in caught if issubclass(w.category, UserWarning)],
                     [])
 
+    def test_auto_login_sets_token_end_to_end(self):
+        token = _unexpired_jwt()
+        from fdp import auth
+
+        def fake_login(handle, write=False):
+            cache = Path.home() / ".fdp" / "cache"
+            cache.mkdir(parents=True, exist_ok=True)
+            (cache / f"{handle.schema.name}.token").write_text(token)
+            return auth.CachedToken(handle.schema.name, "read",
+                                    auth.decode_exp(token))
+
+        with tempfile.TemporaryDirectory() as td:
+            home = Path(td)
+            (home / ".fdp").mkdir()
+            with mock.patch.object(Path, "home", return_value=home):
+                os.environ.pop("BEARER_TOKEN", None)
+                with mock.patch("fdp.auth.login", side_effect=fake_login), \
+                     mock.patch("fdp.auth._auto_login_allowed",
+                                return_value=True):
+                    setup_environment(auto_login=True)
+                self.assertEqual(os.environ["BEARER_TOKEN"], token)
+
 
 _MAST_TEST_YAML = """\
 schema_version: 1