From 9e54838f800b8a6b015646797002e2af48a44c68 Mon Sep 17 00:00:00 2001
From: Alex Bespoyasov <aleksandrb@spotify.com>
Date: Thu, 23 Jul 2026 11:40:33 +0200
Subject: [PATCH] fix: tighten token files permissions

---
 src/lib/auth.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index 7f83884..b4c11fa 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -51,9 +51,10 @@ function extractRegion(token: string): 'EU' | 'US' {
 }
 
 function persistTokens(accessToken: string, refreshToken?: string): void {
-  writeFileSync(TOKEN_FILE, accessToken, 'utf-8');
+  const config = { encoding: 'utf-8', mode: 0o600 } as const;
+  writeFileSync(TOKEN_FILE, accessToken, config);
   if (refreshToken) {
-    writeFileSync(REFRESH_TOKEN_FILE, refreshToken, 'utf-8');
+    writeFileSync(REFRESH_TOKEN_FILE, refreshToken, config);
   }
 }