fix(electron): restrict the storage token file to owner-only access (#9971)

Co-authored-by: Mike Pitre <12040919+mikepitre@users.noreply.github.com>

Author: wobsoriano

.changeset/electron-token-file-mode.md

@@ -0,0 +1,5 @@
+---
+'@clerk/electron': patch
+---
+
+The token file written by `storage()` from `@clerk/electron/storage` is now readable and writable only by its owner (`0600`). It was previously world-readable (`0644` under the default umask). Existing token files are updated the next time `storage()` is called.

packages/electron/src/storage/__tests__/index.test.ts

@@ -1,3 +1,5 @@
+import { chmodSync } from 'node:fs';
+
 import { safeStorage } from 'electron';
 import Store from 'electron-store';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
@@ -21,9 +23,14 @@ vi.mock('electron', () => ({
   safeStorage: {},
 }));
 
+vi.mock('node:fs', () => ({
+  chmodSync: vi.fn(),
+}));
+
 vi.mock('electron-store', () => ({
   default: vi.fn(function () {
     return {
+      path: '/tmp/clerk/clerk-tokens.json',
       get: storeGet,
       set: storeSet,
       delete: storeDelete,
@@ -72,26 +79,40 @@ describe('storage options', () => {
   it('creates an electron-store instance with the default store name', () => {
     storage();
 
-    expect(Store).toHaveBeenCalledWith({ name: 'clerk-tokens' });
+    expect(Store).toHaveBeenCalledWith({ name: 'clerk-tokens', configFileMode: 0o600 });
   });
 
   it('supports a custom store name', () => {
     storage({ name: 'custom-clerk-tokens' });
 
-    expect(Store).toHaveBeenCalledWith({ name: 'custom-clerk-tokens' });
+    expect(Store).toHaveBeenCalledWith({ name: 'custom-clerk-tokens', configFileMode: 0o600 });
   });
 
   it('forwards a custom path as electron-store `cwd`', () => {
     storage({ path: '/tmp/clerk' });
 
-    expect(Store).toHaveBeenCalledWith({ name: 'clerk-tokens', cwd: '/tmp/clerk' });
+    expect(Store).toHaveBeenCalledWith({ name: 'clerk-tokens', configFileMode: 0o600, cwd: '/tmp/clerk' });
   });
 
   it('omits `cwd` when no path is provided', () => {
     storage();
 
     expect(Store).toHaveBeenCalledWith(expect.not.objectContaining({ cwd: expect.anything() }));
   });
+
+  it('restricts an existing token file to owner-only access', () => {
+    storage();
+
+    expect(chmodSync).toHaveBeenCalledWith('/tmp/clerk/clerk-tokens.json', 0o600);
+  });
+
+  it('does not throw when the token file cannot be chmodded', () => {
+    vi.mocked(chmodSync).mockImplementationOnce(() => {
+      throw new Error('ENOENT');
+    });
+
+    expect(() => storage()).not.toThrow();
+  });
 });
 
 describe('getItem', () => {

packages/electron/src/storage/index.ts

@@ -1,3 +1,5 @@
+import { chmodSync } from 'node:fs';
+
 import { safeStorage } from 'electron';
 import Store from 'electron-store';
 
@@ -125,8 +127,14 @@ async function resolveCipher(): Promise<Cipher | null> {
 export function storage(options: StorageOptions = {}): TokenStorage {
   const store = new Store<Record<string, string>>({
     name: options.name ?? 'clerk-tokens',
+    configFileMode: 0o600,
     ...(options.path ? { cwd: options.path } : {}),
   });
+  try {
+    chmodSync(store.path, 0o600);
+  } catch {
+    /* the file does not exist yet, or it belongs to another user */
+  }
   const memoryFallback = new Map<string, string>();
   // IPC requests can resolve out of order, so only the latest mutation may update storage.
   const mutationVersions = new Map<string, number>();