Impl win permissions

nym-vpn-core/crates/nym-vpn-account-controller/Cargo.toml

@@ -42,6 +42,8 @@ tracing.workspace = true
 url.workspace = true
 uuid.workspace = true
 zeroize.workspace = true
+windows-sys = { version = "0.59.0", features = ["Win32_System_Threading", "Win32_System_SystemServices"] }
+widestring.workspace = true
 
 [build-dependencies]
 sqlx = { workspace = true, features = ["runtime-tokio-rustls", "sqlite"] }

nym-vpn-core/crates/nym-vpn-account-controller/src/storage/credentials/pending_credential_requests/mod.rs

@@ -6,18 +6,22 @@ pub mod models;
 
 mod sqlite;
 
+use error::PendingCredentialRequestsStorageError;
+use models::{PendingCredentialRequest, PendingCredentialRequestStored};
+use sqlite::SqliteZkNymRequestsStorageManager;
+use sqlx::ConnectOptions;
+#[cfg(windows)]
+use std::os::raw::c_void;
 use std::{
     path::{Path, PathBuf},
     time::Duration,
 };
-
-use sqlite::SqliteZkNymRequestsStorageManager;
-use sqlx::ConnectOptions;
 use time::OffsetDateTime;
 use tracing::log::LevelFilter;
-
-use error::PendingCredentialRequestsStorageError;
-use models::{PendingCredentialRequest, PendingCredentialRequestStored};
+#[cfg(windows)]
+use windows_sys::Win32::Foundation::{FALSE, TRUE};
+#[cfg(windows)]
+use windows_sys::Win32::System::SystemServices::SECURITY_DESCRIPTOR_REVISION;
 
 // Consider requests older than 60 days as stale
 const DEFAULT_STALE_REQUESTS_MAX_AGE: Duration = Duration::from_secs(60 * 60 * 24 * 60);
@@ -197,7 +201,94 @@ fn set_file_permission_owner_rw_unix<P: AsRef<Path>>(path: P) -> Result<(), std:
 }
 
 #[cfg(windows)]
-fn set_file_permission_owner_rw_windows<P: AsRef<Path>>(_path: P) -> Result<(), std::io::Error> {
-    tracing::info!("Setting file permissions on Windows is not yet implemented!");
+fn set_file_permission_owner_rw_windows<P: AsRef<Path>>(path: P) -> Result<(), std::io::Error> {
+    use std::mem;
+    use std::ptr;
+    use widestring::U16CString;
+    use windows_sys::Win32::Security::*;
+    use windows_sys::Win32::Storage::FileSystem::*;
+
+    let file_path = path.as_ref();
+    let wide_path = U16CString::from_os_str(file_path.as_os_str()).map_err(|e| {
+        std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!("Invalid UTF-16 conversion: {e}"),
+        )
+    })?;
+
+    let mut sid_size = SECURITY_MAX_SID_SIZE;
+    let mut system_sid = vec![0u8; sid_size as usize];
+
+    unsafe {
+        if CreateWellKnownSid(
+            WinLocalSystemSid,
+            ptr::null_mut(),
+            system_sid.as_mut_ptr().cast(),
+            &mut sid_size,
+        ) == 0
+        {
+            return Err(std::io::Error::last_os_error());
+        }
+    }
+
+    let sid_ptr = system_sid.as_mut_ptr().cast();
+
+    let acl_size = mem::size_of::<ACL>() as u32
+        + mem::size_of::<ACCESS_ALLOWED_ACE>() as u32
+        + unsafe { GetLengthSid(sid_ptr) };
+
+    let mut acl_buffer = vec![0u8; acl_size as usize];
+    let acl = acl_buffer.as_mut_ptr() as *mut ACL;
+
+    unsafe {
+        if InitializeAcl(acl, acl_size, ACL_REVISION) == 0 {
+            return Err(std::io::Error::last_os_error());
+        }
+
+        if AddAccessAllowedAce(
+            acl,
+            ACL_REVISION,
+            FILE_GENERIC_READ | FILE_GENERIC_WRITE,
+            sid_ptr.cast(),
+        ) == 0
+        {
+            return Err(std::io::Error::last_os_error());
+        }
+    }
+
+    let mut security_desc: SECURITY_DESCRIPTOR = unsafe { mem::zeroed() };
+
+    unsafe {
+        if InitializeSecurityDescriptor(
+            &mut security_desc as *mut _ as *mut _,
+            SECURITY_DESCRIPTOR_REVISION,
+        ) == 0
+        {
+            return Err(std::io::Error::last_os_error());
+        }
+
+        if SetSecurityDescriptorDacl(
+            &mut security_desc as *mut _ as *mut c_void,
+            TRUE,
+            acl,
+            FALSE,
+        ) == 0
+        {
+            return Err(std::io::Error::last_os_error());
+        }
+    }
+
+    unsafe {
+        if SetFileSecurityW(
+            wide_path.as_ptr(),
+            DACL_SECURITY_INFORMATION,
+            &mut security_desc as *mut _ as *mut _,
+        ) == 0
+        {
+            return Err(std::io::Error::last_os_error());
+        }
+    }
+
+    tracing::info!("Successfully set file permissions for {:?}", file_path);
     Ok(())
 }