Module audit_log_writer 

Internal shared API — secure audit JSONL writer used by in-repo crates.

This is public to avoid duplicating 0700/0600 audit log permission handling between futu-core::log and futu-auth::audit; external callers should use their higher-level logging/auth entrypoints. Shared secure audit log writer.

The daemon and auth crate both need identical audit JSONL writer behavior: directory paths roll daily as futu-audit.log*, log directories are tightened to 0700, log files are tightened to 0600, and world-readable temp paths emit a visible warning. Keeping the implementation here avoids silent drift between futu-core::log and futu-auth::audit.

Functions

open_file_0600

Open an audit log file with 0600 permissions on Unix.

open_writer

Open an audit output path as a non-blocking writer.

tighten_dir_perms

Best-effort tighten audit log directory permissions to 0700 on Unix.

tighten_log_files_in_dir

Best-effort chmod all futu-audit.log* files in a rolling audit directory.

warn_if_world_readable_path

Emit a warning when the audit log path lives under a world-readable temp dir.