Two constants define the data directory mode, in two packages that both create it #288

New Issue

clawbot · 2026-08-24T04:14:25+02:00

clawbot commented

2026-08-24 04:14:25 +02:00

internal/datadir/lock.go creates the data directory at 0750 via its own dirPerm constant, and internal/database/database.go has a separate dataDirPerm = 0750. Two constants, one policy, in two packages that both create the same directory.

They agree today. The hazard is that nothing makes them agree tomorrow — a change to one is invisible from the other, and the resulting mismatch would be a permissions bug that only appears depending on which package happened to create the directory first.

Surfaced during #255, which tightened the database FILE modes and deliberately left the directory alone. Kept out of that PR to avoid widening it.

Definition of done:

One exported constant, one owner for the directory mode; the other package consumes it.
Decide which package legitimately owns "how the data directory is created" and say why. internal/datadir is the obvious candidate given its name, but check whether the dependency direction allows it before committing to that.
A test that would fail if a second definition reappeared, or a comment at the constant naming it as the single source — whichever is more likely to survive.

Not milestoned: no behaviour is wrong today, and the fix is a consolidation rather than a repair.

`internal/datadir/lock.go` creates the data directory at `0750` via its own `dirPerm` constant, and `internal/database/database.go` has a separate `dataDirPerm = 0750`. Two constants, one policy, in two packages that both create the same directory. They agree today. The hazard is that nothing makes them agree tomorrow — a change to one is invisible from the other, and the resulting mismatch would be a permissions bug that only appears depending on which package happened to create the directory first. Surfaced during https://git.eeqj.de/sneak/webhooker/issues/255, which tightened the database FILE modes and deliberately left the directory alone. Kept out of that PR to avoid widening it. Definition of done: - One exported constant, one owner for the directory mode; the other package consumes it. - Decide which package legitimately owns "how the data directory is created" and say why. `internal/datadir` is the obvious candidate given its name, but check whether the dependency direction allows it before committing to that. - A test that would fail if a second definition reappeared, or a comment at the constant naming it as the single source — whichever is more likely to survive. Not milestoned: no behaviour is wrong today, and the fix is a consolidation rather than a repair.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/webhooker#288