fix: serialize persistent profile mutations

internal/profile/store.go

@@ -4,9 +4,13 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"io/fs"
 	"os"
+	"os/user"
 	"path/filepath"
+	"strings"
+	"syscall"
 )
 
 type FileStore struct {
@@ -17,22 +21,137 @@ func NewFileStore(path string) *FileStore {
 	return &FileStore{path: path}
 }
 
-func ConfigPath() (string, error) {
-	configDir, err := os.UserConfigDir()
+type UserIdentity struct {
+	Username string
+	HomeDir  string
+}
+
+type IdentityEnvironment interface {
+	CurrentUser() (UserIdentity, error)
+	LookupUser(string) (UserIdentity, error)
+	LookupEnv(string) (string, bool)
+}
+
+type systemIdentityEnvironment struct{}
+
+func (systemIdentityEnvironment) CurrentUser() (UserIdentity, error) {
+	value, err := user.Current()
 	if err != nil {
-		return "", fmt.Errorf("locate user configuration directory: %w", err)
+		return UserIdentity{}, err
+	}
+	return UserIdentity{Username: value.Username, HomeDir: value.HomeDir}, nil
+}
+
+func (systemIdentityEnvironment) LookupUser(name string) (UserIdentity, error) {
+	value, err := user.Lookup(name)
+	if err != nil {
+		return UserIdentity{}, err
+	}
+	return UserIdentity{Username: value.Username, HomeDir: value.HomeDir}, nil
+}
+
+func (systemIdentityEnvironment) LookupEnv(name string) (string, bool) {
+	return os.LookupEnv(name)
+}
+
+func ConfigPath() (string, error) {
+	return ConfigPathWith(systemIdentityEnvironment{})
+}
+
+func ConfigPathWith(environment IdentityEnvironment) (string, error) {
+	owner, err := environment.CurrentUser()
+	if err != nil {
+		return "", fmt.Errorf("identify configuration owner: %w", err)
+	}
+	invokingUser := false
+	if name, ok := environment.LookupEnv("SUDO_USER"); ok && name != "" && name != owner.Username {
+		owner, err = environment.LookupUser(name)
+		if err != nil {
+			return "", fmt.Errorf("identify invoking user %q: %w", name, err)
+		}
+		invokingUser = true
+	}
+	if owner.HomeDir == "" {
+		return "", errors.New("configuration owner has no home directory")
+	}
+
+	configDir := ""
+	if value, ok := environment.LookupEnv("XDG_CONFIG_HOME"); ok && filepath.IsAbs(value) {
+		if !invokingUser || pathWithin(value, owner.HomeDir) {
+			configDir = value
+		}
+	}
+	if configDir == "" {
+		configDir = filepath.Join(owner.HomeDir, ".config")
 	}
 	return filepath.Join(configDir, "proxyctl", "profiles.json"), nil
 }
 
+func pathWithin(path, parent string) bool {
+	relative, err := filepath.Rel(parent, path)
+	return err == nil && relative != ".." && !strings.HasPrefix(relative, ".."+string(filepath.Separator))
+}
+
 func (s *FileStore) Load() (State, error) {
-	data, err := os.ReadFile(s.path)
+	return s.load()
+}
+
+func (s *FileStore) Mutate(change func(State) (State, error)) (State, error) {
+	if err := s.secureDirectory(); err != nil {
+		return State{}, err
+	}
+	lock, err := os.OpenFile(s.path+".lock", os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		return State{}, fmt.Errorf("open Profile configuration lock: %w", err)
+	}
+	defer lock.Close()
+	if err := lock.Chmod(0o600); err != nil {
+		return State{}, fmt.Errorf("secure Profile configuration lock: %w", err)
+	}
+	if err := syscall.Flock(int(lock.Fd()), syscall.LOCK_EX); err != nil {
+		return State{}, fmt.Errorf("lock Profile configuration: %w", err)
+	}
+	defer syscall.Flock(int(lock.Fd()), syscall.LOCK_UN) //nolint:errcheck -- closing also releases the lock
+
+	current, err := s.load()
+	if err != nil {
+		return State{}, err
+	}
+	next, err := change(current)
+	if err != nil {
+		return current, err
+	}
+	if err := s.save(next); err != nil {
+		return current, err
+	}
+	return next, nil
+}
+
+func (s *FileStore) load() (State, error) {
+	file, err := os.Open(s.path)
 	if errors.Is(err, fs.ErrNotExist) {
 		return State{}, nil
 	}
 	if err != nil {
 		return State{}, fmt.Errorf("read Profile configuration: %w", err)
 	}
+	defer file.Close()
+	info, err := file.Stat()
+	if err != nil {
+		return State{}, fmt.Errorf("inspect Profile configuration: %w", err)
+	}
+	if !info.Mode().IsRegular() {
+		return State{}, errors.New("Profile configuration is not a regular file")
+	}
+	if info.Mode().Perm() != 0o600 {
+		if err := file.Chmod(0o600); err != nil {
+			return State{}, fmt.Errorf("secure Profile configuration: %w", err)
+		}
+	}
+	data, err := io.ReadAll(file)
+	if err != nil {
+		return State{}, fmt.Errorf("read Profile configuration: %w", err)
+	}
 	var state State
 	if err := json.Unmarshal(data, &state); err != nil {
 		return State{}, fmt.Errorf("parse Profile configuration: %w", err)
@@ -40,13 +159,21 @@ func (s *FileStore) Load() (State, error) {
 	return state, nil
 }
 
-func (s *FileStore) Save(state State) error {
-	if err := os.MkdirAll(filepath.Dir(s.path), 0o700); err != nil {
+func (s *FileStore) secureDirectory() error {
+	directory := filepath.Dir(s.path)
+	if err := os.MkdirAll(directory, 0o700); err != nil {
 		return fmt.Errorf("create Profile configuration directory: %w", err)
 	}
-	if err := os.Chmod(filepath.Dir(s.path), 0o700); err != nil {
+	if err := os.Chmod(directory, 0o700); err != nil {
 		return fmt.Errorf("secure Profile configuration directory: %w", err)
 	}
+	return nil
+}
+
+func (s *FileStore) save(state State) error {
+	if err := s.secureDirectory(); err != nil {
+		return err
+	}
 	data, err := json.MarshalIndent(state, "", "  ")
 	if err != nil {
 		return fmt.Errorf("encode Profile configuration: %w", err)
@@ -73,19 +200,10 @@ func (s *FileStore) Save(state State) error {
 	if err := temp.Close(); err != nil {
 		return fmt.Errorf("close temporary Profile configuration: %w", err)
 	}
+	// Rename is the commit point. There are deliberately no fallible operations
+	// afterwards, so callers never retain stale memory after a visible commit.
 	if err := os.Rename(tempName, s.path); err != nil {
 		return fmt.Errorf("replace Profile configuration: %w", err)
 	}
-	if err := os.Chmod(s.path, 0o600); err != nil {
-		return fmt.Errorf("secure Profile configuration: %w", err)
-	}
-	dir, err := os.Open(filepath.Dir(s.path))
-	if err == nil {
-		err = dir.Sync()
-		_ = dir.Close()
-	}
-	if err != nil {
-		return fmt.Errorf("sync Profile configuration directory: %w", err)
-	}
 	return nil
 }