State Persistence - File I/O and keypair generation

[m-005]

Part 4 of the Foundation stage for objects-node daemon.

Changes

Implements state persistence with secure file I/O:

• StateError enum with proper error handling (IO, Parse, Permission errors)
• load_or_create() - Load from file or generate new keypair if missing
• load() and save() - JSON file I/O with secure permissions
• generate_new() - Cryptographically secure keypair generation using rand::rng()
• ensure_permissions() - Parent directory creation and validation
• Unix file permissions enforced (600) on state files

Security

• State files automatically created with 600 permissions (owner read/write only)
• Parent directories created recursively as needed
• Validation prevents writing to invalid paths (e.g., when parent is a file)
• Uses cryptographically secure random number generation

Testing

Comprehensive test coverage:

• File creation and loading
• Round-trip serialization with and without identity
• Unix file permission verification (600)
• Parent directory creation
• Error cases (missing files, invalid paths)

Dependencies

• Added rand to main dependencies for secure key generation

Part of the Foundation stage (4/4). Builds on: #51.

Foundation stage complete! Config and state management fully implemented with 22 passing tests.

[claude]

Code Review

Security Issue: TOCTOU Race Condition in File Permissions

Location: bins/objects-node/src/state.rs:100-114

Issue: The file containing the private key is written using std::fs::write() with default permissions (typically 0o644 based on umask), and only afterward are the permissions changed to 0o600. During this window between file creation and permission change, other users on the system could potentially read the private key.

According to Rust's documentation for OpenOptionsExt::mode(): "If no mode is set, the default of 0o666 will be used. The operating system masks out bits with the system's umask, to produce the final permissions." With a typical umask of 0o022, files are created with 0o644 permissions (world-readable).

Suggested fix:

use std::os::unix::fs::OpenOptionsExt;
use std::io::Write;

let contents = serde_json::to_string_pretty(self)?;
let mut file = std::fs::OpenOptions::new()
    .write(true)
    .create(true)
    .truncate(true)
    .mode(0o600)  // Set permissions atomically at creation
    .open(path)?;
file.write_all(contents.as_bytes())?;

This eliminates the race window entirely by setting permissions atomically when the file is created.

[claude]

Code Review

Found 1 security issue that needs to be addressed.

See inline comment on bins/objects-node/src/state.rs for details about a race condition that exposes the private key during file creation.

[claude]

Test comment - checking inline comment capability

[claude]

Inline Comment for bins/objects-node/src/state.rs:104

Security Issue: Race condition exposes private key

The save() method creates the state file with world-readable permissions before restricting them to 0o600. This creates a race condition window where the node's private key can be read by other processes.

Problem:

See:

protocol/bins/objects-node/src/state.rs

Lines 103 to 114 in 5f315cd

	let contents = serde_json::to_string_pretty(self)?;
	std::fs::write(path, contents)?;
	// Set file permissions to 600 (owner read/write only)
	#[cfg(unix)]
	{
	use std::os::unix::fs::PermissionsExt;
	let metadata = std::fs::metadata(path)?;
	let mut permissions = metadata.permissions();
	permissions.set_mode(0o600);
	std::fs::set_permissions(path, permissions)?;
	}

std::fs::write() creates files using the process's umask, typically resulting in 0644 permissions (world-readable). Only afterwards are the permissions restricted to 0o600.

Fix:

Use std::fs::OpenOptions to atomically create the file with correct permissions. This is a larger structural change (6+ lines), so describing rather than providing a committable suggestion:

1. Import std::fs::OpenOptions and std::os::unix::fs::OpenOptionsExt
2. Replace std::fs::write() with OpenOptions::new().write(true).create(true).truncate(true).mode(0o600).open(path)?.write_all(contents.as_bytes())? on Unix
3. Keep std::fs::write() for non-Unix platforms

This ensures the file is created with 0o600 permissions from the start, eliminating the race condition.

[claude]

Code Review Summary

Issues Found: 1

I reviewed this PR for bugs and CLAUDE.md compliance and found 1 high-severity security issue:

Security Issue - Race Condition in File Permissions

Location: bins/objects-node/src/state.rs:104

The save() method has a race condition that exposes the node's private key with world-readable permissions between file creation and permission restriction. See detailed comment above with fix recommendations.

---

CLAUDE.md Compliance: ✓ No violations found
Bug Scan: ⚠️ 1 security issue found (see above)