Module secure_io 

User-only file helpers for secrets at rest.

On Unix, the helpers explicitly chmod the file/dir to 0o600 / 0o700 so other local users on the same machine cannot read them.

On Windows there is no chmod equivalent — the file inherits the ACL of its containing directory. We rely on Tauri placing our state inside %LOCALAPPDATA%\<identifier>\, which the OS already locks to the user’s SID via NTFS inheritance. The #[cfg(unix)] blocks below are therefore intentionally Windows no-ops, not missing coverage.

Functions

ensure_user_only_dir

spawn_periodic_dir_tighten

Spawn a detached background thread that re-runs tighten_existing_files_in_dir(&dir) every interval.

tighten_existing_file

tighten_existing_files_in_dir

tighten_once

One iteration of the periodic tighten sweep. Extracted from the spawn_periodic_dir_tighten loop so tests can drive a single tick synchronously instead of polling against a thread::sleep timer.

write_user_only