feat: establish NekoNest Cloud control and relay

relay/internal/tenantstore/permissions.go

@@ -0,0 +1,49 @@
+package tenantstore
+
+import (
+	"fmt"
+	"os"
+)
+
+const privateDatabaseMode os.FileMode = 0o600
+
+func preparePrivateDatabase(dbPath string) error {
+	if info, err := os.Lstat(dbPath); err == nil {
+		if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+			return fmt.Errorf("sqlite database must be a regular file")
+		}
+	} else if !os.IsNotExist(err) {
+		return fmt.Errorf("inspect sqlite database: %w", err)
+	}
+	file, err := os.OpenFile(dbPath, os.O_CREATE|os.O_RDWR, privateDatabaseMode)
+	if err != nil {
+		return fmt.Errorf("open private sqlite database: %w", err)
+	}
+	if err := file.Chmod(privateDatabaseMode); err != nil {
+		_ = file.Close()
+		return fmt.Errorf("secure sqlite database: %w", err)
+	}
+	if err := file.Close(); err != nil {
+		return fmt.Errorf("close private sqlite database: %w", err)
+	}
+	return tightenPrivateDatabaseArtifacts(dbPath)
+}
+
+func tightenPrivateDatabaseArtifacts(dbPath string) error {
+	for _, path := range []string{dbPath, dbPath + "-wal", dbPath + "-shm"} {
+		if info, err := os.Lstat(path); err == nil {
+			if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+				return fmt.Errorf("sqlite artifact must be a regular file")
+			}
+		} else if !os.IsNotExist(err) {
+			return fmt.Errorf("inspect sqlite artifact: %w", err)
+		}
+		if err := os.Chmod(path, privateDatabaseMode); err != nil {
+			if os.IsNotExist(err) {
+				continue
+			}
+			return fmt.Errorf("secure sqlite artifact: %w", err)
+		}
+	}
+	return nil
+}