{"record":{"id":"5e8a2eacb72bb6ce","repo":"astrid-runtime/astrid","slug":"private-host-file-permissions-are-unavailable-on-t","errorCode":null,"errorMessage":"private host-file permissions are unavailable on this target","messagePattern":"private host-file permissions are unavailable on this target","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"crates/astrid-core/src/platform_fs.rs","lineNumber":261,"sourceCode":"/// # Errors\n///\n/// Returns an error if the file is missing, not regular, redirected, or cannot\n/// be secured and validated.\npub fn restrict_private_file(path: &Path) -> io::Result<()> {\n    #[cfg(windows)]\n    {\n        windows::restrict_private_file(path)\n    }\n\n    #[cfg(unix)]\n    {\n        restrict_private_file_unix(path)\n    }\n\n    #[cfg(not(any(unix, windows)))]\n    {\n        let _ = path;\n        Err(io::Error::new(\n            io::ErrorKind::Unsupported,\n            \"private host-file permissions are unavailable on this target\",\n        ))\n    }\n}\n\n/// Validate that an existing private file still has the platform's required\n/// access policy.\n///\n/// On Unix the existing mode checks remain with their current callers.\n///\n/// # Errors\n///\n/// Returns an error on Windows for an unexpected owner, permissive or inherited\n/// ACL, reparse point, or non-regular file.\npub fn validate_private_file(path: &Path) -> io::Result<()> {\n    #[cfg(windows)]\n    {","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/platform_fs.rs#L243-L279","documentation":"restrict_private_file() tightens a file's permissions so only the owner can read/write it. On targets that are neither Unix nor Windows the platform permission APIs are unavailable, so it returns io::ErrorKind::Unsupported with this message instead of silently leaving the file permissive.","triggerScenarios":"Calling restrict_private_file(path) (directly or via read_private_file_to_string) on a non-unix/non-windows target.","commonSituations":"Compiling for wasm or an embedded/other OS target and attempting the private-file workflow; CI matrix running the library on an unsupported host.","solutions":["Restrict file permissions only on unix/windows targets; on other targets skip the restriction or implement a platform backend.","Guard the call site with cfg!(any(unix, windows)) and handle the else branch explicitly.","If security is required on this target, the platform backend must be added in platform_fs.rs; there is no caller-side fix."],"exampleFix":"// before\nrestrict_private_file(&path)?;\n// after\n#[cfg(any(unix, windows))]\nrestrict_private_file(&path)?;\n#[cfg(not(any(unix, windows)))]\nlet _ = &path; // permissions unsupported on this target","handlingStrategy":"fallback","validationCode":"let supported = cfg!(any(unix, windows));\nif supported { restrict_private_file(&path)?; }","typeGuard":"fn supports_file_permissions() -> bool { cfg!(any(unix, windows)) }","tryCatchPattern":"match restrict_private_file(&path) {\n    Err(e) if e.kind() == io::ErrorKind::Unsupported => log::warn!(\"permission restriction unavailable here\"),\n    other => other?,\n}","preventionTips":["Gate permission-sensitive code with cfg(any(unix, windows))","Skip private-file workflows on unsupported targets by design, not at runtime","Add CI coverage for every target OS in your build matrix"],"tags":["io","filesystem","permissions","platform-specific"],"backgroundTag":"unsupported-platform","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}