Stop config set echoing secrets; reject credential-bearing storage URLs (closes #166)

config set now prints only the key name after a write, never the value:
a value may be a secret such as s3.secret_access_key, and echoing it
leaks into captured stdout and pasted terminals. The set logic moves
into writeConfigSet so this is testable.

config set also tightens a pre-existing group- or world-readable config
to 0600 after writing. os.WriteFile does not change an existing file's
mode, so the previous stat-and-preserve-mode block had no effect; it is
removed.

ParseStorageURL now rejects s3:// and rclone:// URLs that carry
credentials in the userinfo or an unknown query parameter, and names
s3.access_key_id and s3.secret_access_key as where credentials belong;
rclone:// accepts no parameters, so a misspelt one is caught rather than
silently sending the backup to the default endpoint. On a url.Parse
failure only the inner cause is wrapped, so the raw URL is not echoed.
file:// is unchanged.

Model: opus-4-8

internal/storage/url.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"net/url"
+	"slices"
 	"strings"
 )
 
@@ -23,6 +24,10 @@ var (
 	ErrUnsupportedScheme = errors.New(
 		"unsupported URL scheme: must start with s3://, file://, or rclone://")
 	ErrUnsupportedStorage = errors.New("unsupported storage scheme")
+	ErrURLCredentials     = errors.New(
+		"storage URL must not carry credentials; " +
+			"set s3.access_key_id and s3.secret_access_key in the config instead")
+	ErrURLUnknownParam = errors.New("unknown query parameter in storage URL")
 )
 
 // URL represents a parsed storage URL.
@@ -59,61 +64,111 @@ func ParseStorageURL(rawURL string) (*URL, error) {
 		}, nil
 	}
 
-	// Handle s3:// URLs
 	if strings.HasPrefix(rawURL, "s3://") {
-		u, err := url.Parse(rawURL)
-		if err != nil {
-			return nil, fmt.Errorf("invalid URL: %w", err)
-		}
-
-		bucket := u.Host
-		if bucket == "" {
-			return nil, ErrMissingBucket
-		}
-
-		prefix := strings.TrimPrefix(u.Path, "/")
-
-		query := u.Query()
-
-		useSSL := true
-		if query.Get("ssl") == "false" {
-			useSSL = false
-		}
-
-		return &URL{
-			Scheme:   schemeS3,
-			Bucket:   bucket,
-			Prefix:   prefix,
-			Endpoint: query.Get("endpoint"),
-			Region:   query.Get("region"),
-			UseSSL:   useSSL,
-		}, nil
+		return parseS3URL(rawURL)
 	}
 
-	// Handle rclone:// URLs
 	if strings.HasPrefix(rawURL, "rclone://") {
-		u, err := url.Parse(rawURL)
-		if err != nil {
-			return nil, fmt.Errorf("invalid URL: %w", err)
-		}
-
-		remote := u.Host
-		if remote == "" {
-			return nil, ErrMissingRemote
-		}
-
-		path := strings.TrimPrefix(u.Path, "/")
-
-		return &URL{
-			Scheme:       schemeRclone,
-			Prefix:       path,
-			RcloneRemote: remote,
-		}, nil
+		return parseRcloneURL(rawURL)
 	}
 
 	return nil, ErrUnsupportedScheme
 }
 
+// parseS3URL parses an s3://bucket/prefix URL. It rejects credentials in
+// the userinfo and any query parameter other than endpoint, region and
+// ssl, so a credential-bearing URL is never stored or echoed.
+func parseS3URL(rawURL string) (*URL, error) {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return nil, wrapParseError(err)
+	}
+
+	if u.User != nil {
+		return nil, ErrURLCredentials
+	}
+
+	bucket := u.Host
+	if bucket == "" {
+		return nil, ErrMissingBucket
+	}
+
+	query := u.Query()
+
+	err = rejectUnknownParams(query, "endpoint", "region", "ssl")
+	if err != nil {
+		return nil, err
+	}
+
+	return &URL{
+		Scheme:   schemeS3,
+		Bucket:   bucket,
+		Prefix:   strings.TrimPrefix(u.Path, "/"),
+		Endpoint: query.Get("endpoint"),
+		Region:   query.Get("region"),
+		UseSSL:   query.Get("ssl") != "false",
+	}, nil
+}
+
+// parseRcloneURL parses an rclone://remote/path URL. rclone:// takes no
+// query parameters, so credentials in the userinfo and any parameter at
+// all are rejected rather than silently ignored.
+func parseRcloneURL(rawURL string) (*URL, error) {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return nil, wrapParseError(err)
+	}
+
+	if u.User != nil {
+		return nil, ErrURLCredentials
+	}
+
+	remote := u.Host
+	if remote == "" {
+		return nil, ErrMissingRemote
+	}
+
+	err = rejectUnknownParams(u.Query())
+	if err != nil {
+		return nil, err
+	}
+
+	return &URL{
+		Scheme:       schemeRclone,
+		Prefix:       strings.TrimPrefix(u.Path, "/"),
+		RcloneRemote: remote,
+	}, nil
+}
+
+// rejectUnknownParams returns an error naming the first query parameter
+// not in allowed. The parameter's name is included (so a misspelt
+// endpoint= is caught), but never its value, which could be a secret,
+// and never the whole URL.
+func rejectUnknownParams(query url.Values, allowed ...string) error {
+	for name := range query {
+		if !slices.Contains(allowed, name) {
+			return fmt.Errorf(
+				"%w: %q; put credentials in s3.access_key_id and "+
+					"s3.secret_access_key, not the URL",
+				ErrURLUnknownParam, name)
+		}
+	}
+
+	return nil
+}
+
+// wrapParseError wraps only the inner cause of a url.Parse failure. The
+// *url.Error that url.Parse returns embeds the raw URL in its message, so
+// wrapping it directly would echo a credential-bearing URL into logs.
+func wrapParseError(err error) error {
+	var uerr *url.Error
+	if errors.As(err, &uerr) {
+		return fmt.Errorf("invalid URL: %w", uerr.Err)
+	}
+
+	return fmt.Errorf("invalid URL: %w", err)
+}
+
 // String returns a human-readable representation of the storage URL.
 func (u *URL) String() string {
 	switch u.Scheme {