1// @effect-diagnostics nodeBuiltinImport:off
2import * as NodeFSP from "node:fs/promises";
3import * as NodeModule from "node:module";
4import * as NodePath from "node:path";
5
6const prepareServerCompileCache: (context: AfterPackContext) => Promise<void> =
7 NodeModule.createRequire(import.meta.url)("./prepare-server-compile-cache.cjs");
8
9interface AfterPackContext {
10 readonly appOutDir: string;
11}
12
13// Electron's Linux zips can ship world-writable files (44.10.0 has 0777 binaries), and
14// electron-builder copies zip modes verbatim into the .deb and AppImage.
15export default async function afterPack(context: AfterPackContext): Promise<void> {
16 await prepareServerCompileCache(context);
17 await removeSharedWriteAccess(context.appOutDir);
18}
19
20// Walks by hand: recursive readdir follows directory symlinks out of the app folder.
21export async function removeSharedWriteAccess(path: string): Promise<void> {
22 const stats = await NodeFSP.lstat(path);
23 if (stats.isSymbolicLink()) return;
24 if (stats.mode & 0o022) await NodeFSP.chmod(path, stats.mode & 0o7755);
25 if (!stats.isDirectory()) return;
26 for (const entry of await NodeFSP.readdir(path)) {
27 await removeSharedWriteAccess(NodePath.join(path, entry));
28 }
29}