chore(storage): restrict the cache file to its owner, drop dead tests

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+- **Cache file permissions** - The local SQLite cache stores the Todoist API token, and is now created with `0600` so only its owner can read it. Existing cache files are tightened on the next launch.
+
 ## [0.5.0] - 2026-03-25
 
 ### Added

src/storage.rs

@@ -62,6 +62,16 @@ impl LocalStorage {
 
         let conn = Database::connect(opt).await?;
 
+        // backends.credentials holds the API token in plaintext, so the cache is a credential
+        // file. Best-effort: a filesystem without Unix modes must not block startup.
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            if let Err(e) = std::fs::set_permissions(&db_path, std::fs::Permissions::from_mode(0o600)) {
+                log::warn!("Failed to restrict permissions on {}: {e}", db_path.display());
+            }
+        }
+
         let storage = LocalStorage { conn };
         storage.discard_stale_schema().await?;
         storage.init_schema().await?;

tests/storage/db.rs

@@ -100,3 +100,28 @@ async fn test_stale_schema_version_rebuilds_cache() {
     reopened.conn.close().await.expect("connection should close");
     std::fs::remove_file(db_path).expect("test database should be removed");
 }
+
+#[cfg(unix)]
+#[tokio::test]
+async fn test_database_file_is_owner_only() {
+    use std::os::unix::fs::PermissionsExt;
+
+    let db_path = std::env::temp_dir().join(format!("terminalist-perms-{}.db", uuid::Uuid::new_v4()));
+
+    let storage = LocalStorage::new_at(db_path.clone())
+        .await
+        .expect("LocalStorage should be created successfully");
+    storage.conn.close().await.expect("connection should close");
+
+    let mode = std::fs::metadata(&db_path)
+        .expect("database file should exist")
+        .permissions()
+        .mode();
+    assert_eq!(
+        mode & 0o777,
+        0o600,
+        "the cache holds the API token, it must not be readable by others"
+    );
+
+    std::fs::remove_file(db_path).expect("test database should be removed");
+}