From 0f8ed97878b8e87391b51f88a2f58c84ce02a089 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mats=20T=C3=B6rnberg?= Date: Mon, 17 Aug 2026 21:53:37 +0200 Subject: [PATCH] fix(auth): write the shared API-key store world-readable so other services see key changes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The key store holds only SHA-256 hashes + metadata (no plaintext keys) and is read by other services in their own containers running as different non-root uids. saveLocked wrote it 0600, so when the backoffice pod (running as root) minted or revoked a key the file became root-owned 0600 — unreadable to the ledger/cart services, freezing their mtime-reload snapshots: new keys 401'd and revocations never took effect. Write 0644 so every reader reloads. 🤖 Generated with Codebuff Co-Authored-By: Codebuff --- auth/apikey.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/auth/apikey.go b/auth/apikey.go index 77e48c9..da200be 100644 --- a/auth/apikey.go +++ b/auth/apikey.go @@ -166,7 +166,12 @@ func (s *KeyStore) saveLocked() error { return err } tmp := s.path + ".tmp" - if err := os.WriteFile(tmp, raw, 0o600); err != nil { + // 0644, not 0600: the store holds only SHA-256 hashes + metadata (no + // plaintext keys) and is read by OTHER services in their own containers + // (they run as different, non-root uids), so the written file must be + // world-readable. A 0600 file owned by the writing pod's uid would go + // unreadable to them and freeze their ReloadIfChanged snapshots. + if err := os.WriteFile(tmp, raw, 0o644); err != nil { return err } return os.Rename(tmp, s.path)