Code review: flowstate Existing token file permissions are never validated

[ajbeaver]

Generated by Offband issue reporting.

Summary

Code review: flowstate Existing token file permissions are never validated

Routing

• Repo: offband/FlowState
• Repo class: public_tool
• Rule id: code_review.security_surface
• Candidate key: code-review:flowstate:auth-backup-permission-release-validation
• Category: code-review
• Severity: warning
• Review profile: code_review
• Review target: flowstate
• Labels: offband-report, weekly, needs-owner, code-review
• Source: code_review.bounded_ai

Expected

Product repositories should avoid actionable code risks identified by bounded source review.

Observed

src/flowstate_runtime/auth.py:14: ensure_token() returns an existing token file immediately without checking or correcting its mode; chmod is only applied after creating or rotating a token.

Why It Matters

If ~<redacted-path> or the token file was created with permissive permissions by backup/restore, manual edits, or older versions, the bearer token can remain readable by other local users while still being accepted for runtime auth.

Decision Needed

Validate existing token file permissions before returning it, or refuse/repair insecure token files.

Policy Source

config/issue-reporting.json: code_review

Evidence

{
  "artifact_path": "<redacted-path>",
  "canonical_topic": "auth-backup-permission-release-validation",
  "dedupe_core": "ensure-token",
  "dedupe_subject": "symbol:ensure-token",
  "finding": {
    "confidence": "high",
    "finding_class": "security_surface",
    "impact": "If `~<redacted-path>` or the token file was created with permissive permissions by backup/restore, manual edits, or older versions, the bearer token can remain readable by other local users while still being accepted for runtime auth.",
    "line": 14,
    "owner_decision": "Validate existing token file permissions before returning it, or refuse/repair insecure token files.",
    "path": "src/flowstate_runtime/auth.py",
    "summary": "`ensure_token()` returns an existing token file immediately without checking or correcting its mode; chmod is only applied after creating or rotating a token.",
    "title": "Existing token file permissions are never validated"
  },
  "line": 14,
  "path": "src/flowstate_runtime/auth.py",
  "semantic_topic": "auth-backup-permission-release-validation"
}

Suggested Resolution

Validate existing token file permissions before returning it, or refuse/repair insecure token files.

Report

• Report generated: 2026-06-21T12:20:30Z
• Candidate key: code-review:flowstate:auth-backup-permission-release-validation

[ajbeaver]

Fixed in 8810329. Existing runtime token files are now chmodded to 0600 before use, with test coverage.