Documentation
¶
Overview ¶
Package userdirs resolves the per-user directories where the Entire CLIs keep global state. It is the single implementation of that resolution — don't derive ~/.config/entire or ~/.cache/entire paths anywhere else.
- Config: contexts.json, version_check.json, the file-backed token store. $ENTIRE_CONFIG_DIR if set, else ~/.config/entire.
- Cache: discovery caches (nodes.json, cluster_cores.json, api_discovery.json). $XDG_CACHE_HOME/entire if set, else ~/.cache/entire.
Under `go test`, both fall back to a throwaway per-process directory when their env override is unset (see internal/testdirs), so a test that forgets to isolate can never read or pollute the developer's real state.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CacheRoot ¶ added in v0.10.4
CacheRoot returns the shared *os.Root over the per-user cache directory, creating it. CacheRootForRead is the same without creation.
func CacheRootForRead ¶ added in v0.10.4
CacheRootForRead is CacheRoot without creating the directory.
func ConfigRoot ¶ added in v0.10.4
ConfigRoot returns the shared *os.Root over the per-user config directory, creating the directory if it does not exist. ConfigRootForRead is the same without creation.
Every read and write of contexts.json, version_check.json, and the file-backed token store goes through this rather than through a path joined onto Config(). The names inside are fixed today, but the point of the root is that they do not have to stay that way: a future context name, cluster slug, or token key that reaches a filename cannot escape the directory, and a symlink swapped in between resolution and open surfaces as an error rather than a redirected write to somewhere in the user's home.
The create/no-create split matters here for the same reason it does for .entire: a command that only looks for a saved login must not leave an ~/.config/entire behind on a machine that has never used one.
func ConfigRootForRead ¶ added in v0.10.4
ConfigRootForRead is ConfigRoot without creating the directory. A missing directory is reported unwrapped, so callers classify it with os.IsNotExist.
func EnsurePrivateDir ¶ added in v0.10.4
EnsurePrivateDir creates dir as a private, user-only directory (0700) and, when it already exists with group or other access, clears those bits.
The tightening step is the point. Config() holds bearer tokens — the login JWTs in contexts.json and the file token store's tokens.json — and those files are written 0600, but a mode-0755 parent leaks their existence and hands anyone on the box a directory they can traverse and enumerate. Because os.MkdirAll is a no-op on an existing path, whichever caller created the directory first fixes its mode permanently: a version check that ran before the first login used to leave it 0755 for good, and the credential stores' own MkdirAll(0700) could never repair it.
Only the group and other bits are ever cleared: the owner bits are carried across untouched, so a directory the user deliberately made stricter than 0700 stays that way whether or not it also needed tightening (0500 survives, 0555 becomes 0500). Masking can leave the owner no access at all, which is the same thing an already-private 0000 directory gets: this function makes a directory private, and does not claim to make it usable.
Windows has no unix permission bits (Go reports synthetic modes and Chmod only toggles the read-only flag), so the tightening step is skipped there.
Types ¶
This section is empty.
Source Files