Function restrictDbFilePermissions

apps/local/src/db/libsql.ts:41–53

(path: string)

 * mount, must not stop the server booting over a permission it cannot set.
 */
const restrictDbFilePermissions = (path: string): void => {
  if (path === ":memory:") return;
  const base = resolve(path);
  for (const suffix of DB_FILE_SUFFIXES) {
    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: chmod on a file that may not exist yet or a filesystem without POSIX modes; hardening must never block boot
    try {
      chmodSync(`${base}${suffix}`, 0o600);
    } catch {
      // Sidecars only exist once WAL has been used, and not every filesystem
      // supports chmod. Either way the open proceeds.
    }
  }
};

/**
 * Open a libSQL client for a local on-disk DB and apply the per-connection