fix: preserve MOTIS staging permissions

Author: Medformatik

services/data-manager/__tests__/transitous/promote.test.ts

@@ -1,11 +1,13 @@
 import {
+  chmodSync,
   cpSync,
   existsSync,
   mkdirSync,
   mkdtempSync,
   readdirSync,
   readFileSync,
   rmSync,
+  statSync,
   writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
@@ -266,6 +268,25 @@ describe("promote stage", () => {
     expect(artifacts.previousDir).toBe(fx.previousDir);
   });
 
+  it("preserves staging directory permissions for the next import", async () => {
+    const fx = setupFixture({ staging: true, current: true });
+    chmodSync(fx.stagingDir, 0o777);
+    globalThis.fetch = vi.fn(async (input: unknown) => {
+      const url = typeof input === "string" ? input : (input as Request | URL).toString();
+      return jsonResponse(successfulBody(url));
+    }) as unknown as typeof fetch;
+
+    const result = await promoteRun(
+      makeCtx({
+        dataDir: fx.dataDir,
+        runner: async () => {},
+      }),
+    );
+
+    expect(result.status).toBe("ok");
+    expect(statSync(fx.stagingDir).mode & 0o777).toBe(0o777);
+  });
+
   it("rejects a candidate whose epoch duplicates the active dataset", async () => {
     const fx = setupFixture({ staging: true });
     cpSync(fx.stagingDir, fx.currentDir, { recursive: true });

services/data-manager/src/jobs/transitous/promote.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, renameSync, rmSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, renameSync, rmSync, statSync } from "node:fs";
 import { join } from "node:path";
 import {
   CANDIDATE_MANIFEST_FILENAME,
@@ -355,7 +355,8 @@ async function promoteTwoSlot(
  *   3. `docker stop motis`, then rename `data/motis/live` →
  *      `data/motis/live.previous` and `data/motis/staging` →
  *      `data/motis/live` (so the rename never happens under a running mount).
- *      Recreate an empty staging dir so the next pipeline run has a clean target.
+ *      Recreate an empty staging dir with the same permissions so the next
+ *      pipeline run has a clean, writable target.
  *   4. `docker restart motis` and poll `/api/v1/map/initial` until it responds
  *      (5-minute budget).
  *
@@ -471,6 +472,17 @@ export const run: StageFn = async (ctx) => {
     }
 
     // Second rename: staging → current.
+    // Preserve the staging root's access mode across the rename. The next
+    // import writes MOTIS's compiled data into a newly-created staging dir;
+    // mkdir's default mode would otherwise apply the process umask and can
+    // silently turn a deliberately group/world-writable bind dir into 0755.
+    let stagingMode = 0o755;
+    try {
+      stagingMode = statSync(stagingDir).mode & 0o777;
+    } catch {
+      // The rename below will provide the authoritative failure if the path
+      // disappeared between the pre-flight check and the swap.
+    }
     try {
       renameSync(stagingDir, currentDir);
     } catch (error) {
@@ -497,7 +509,10 @@ export const run: StageFn = async (ctx) => {
 
     // Recreate an empty staging dir for the next cycle.
     try {
-      mkdirSync(stagingDir, { recursive: true });
+      mkdirSync(stagingDir, { recursive: true, mode: stagingMode });
+      // mkdir applies the process umask, so explicitly restore the exact mode
+      // captured above rather than relying on the requested mode alone.
+      chmodSync(stagingDir, stagingMode);
     } catch {
       // Non-fatal: the next pipeline run will recreate it.
     }