[APP-3801] implement remote environments auth (#9331)

app/src/remote_server/unix/proxy.rs

@@ -10,6 +10,8 @@
 //! 4. Connect to `server.sock` and bridge stdin/stdout to the socket using
 //!    the existing 4-byte length-prefixed frame format.
 
+use std::fs::Permissions;
+use std::os::unix::fs::PermissionsExt;
 use std::os::unix::io::AsRawFd;
 use std::path::PathBuf;
 use std::process::Stdio;
@@ -18,30 +20,37 @@ use std::time::Duration;
 use super::super::setup;
 
 /// Path to the daemon's Unix domain socket.
-pub(super) fn socket_path() -> PathBuf {
-    let dir = setup::remote_server_dir();
+pub(super) fn socket_path(identity_key: &str) -> PathBuf {
+    let dir = setup::remote_server_daemon_dir(identity_key);
     let expanded = shellexpand::tilde(&dir).into_owned();
     PathBuf::from(expanded).join("server.sock")
 }
 
 /// Path to the daemon's PID file (also used as the flock target).
-pub(super) fn pid_path() -> PathBuf {
-    let dir = setup::remote_server_dir();
+pub(super) fn pid_path(identity_key: &str) -> PathBuf {
+    let dir = setup::remote_server_daemon_dir(identity_key);
     let expanded = shellexpand::tilde(&dir).into_owned();
     PathBuf::from(expanded).join("server.pid")
 }
 
+/// Ensures the daemon directory exists with owner-only permissions.
+pub(super) fn ensure_private_daemon_dir(path: &std::path::Path) -> anyhow::Result<()> {
+    std::fs::create_dir_all(path)?;
+    std::fs::set_permissions(path, Permissions::from_mode(0o700))?;
+    Ok(())
+}
+
 /// Entry point for `remote-server-proxy`.
 ///
 /// Ensures the daemon is running, then bridges stdin/stdout to the daemon's
 /// Unix socket for the lifetime of this SSH session.
-pub fn run() -> anyhow::Result<()> {
-    let socket_path = socket_path();
-    let pid_path = pid_path();
+pub fn run(identity_key: &str) -> anyhow::Result<()> {
+    let socket_path = socket_path(identity_key);
+    let pid_path = pid_path(identity_key);
 
     // Ensure the parent directory exists.
     if let Some(parent) = socket_path.parent() {
-        std::fs::create_dir_all(parent)?;
+        ensure_private_daemon_dir(parent)?;
     }
 
     // ---- Acquire exclusive flock on the PID file --------------------------------
@@ -83,6 +92,8 @@ pub fn run() -> anyhow::Result<()> {
         let exe = std::env::current_exe()?;
         let mut cmd = command::blocking::Command::new(&exe);
         cmd.arg("remote-server-daemon")
+            .arg("--identity-key")
+            .arg(identity_key)
             .stdin(Stdio::null())
             .stdout(Stdio::null())
             .stderr(Stdio::null());