From e966a71180b83937d14ca7d8be4fb2be464bd1a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Padez?= <andre.padez@gmail.com>
Date: Thu, 5 Mar 2026 02:44:44 +0000
Subject: [PATCH] isolate user data with personal group ownership

- chown user dirs to pastilhas:<username> instead of pastilhas:officerdev
  so users cannot access each other's data
- chmod 2770 (setgid) gives only the owning user terminal access
- setup.sh: ensure home dir is traversable (o+x) for provisioned users

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 scripts/setup.sh                   | 8 ++++++++
 src/servers/api/users/provision.ts | 6 +++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/scripts/setup.sh b/scripts/setup.sh
index 8775ef1b..c52ed6a1 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -63,6 +63,14 @@ else
   ok "added $USER to officerdev group"
 fi
 
+# Ensure provisioned users can traverse to data directories
+if [ "$(stat -c '%A' "$HOME" | cut -c10)" = "x" ]; then
+  skip "home dir traversable"
+else
+  chmod o+x "$HOME"
+  ok "made home dir traversable (o+x)"
+fi
+
 # ─── 1. core system packages ───────────────────────────────────────────────────
 echo ""
 echo "── Core system packages ──"
diff --git a/src/servers/api/users/provision.ts b/src/servers/api/users/provision.ts
index 135351cc..19ee64ce 100644
--- a/src/servers/api/users/provision.ts
+++ b/src/servers/api/users/provision.ts
@@ -84,10 +84,10 @@ export async function provisionLinuxUser(email: string, username: string): Promi
   await Bun.write(join(claudeDir, 'settings.json'), settingsContent);
 
   // Service user (pastilhas) owns everything — server can always read/write.
-  // Linux user gets group access via officerdev for terminal sessions only.
+  // User's personal group gives only that user terminal access. Others get nothing.
   const serviceUser = process.env.USER ?? 'pastilhas';
-  run(['sudo', 'chown', '-R', `${serviceUser}:${SHARED_GROUP}`, userRoot]);
-  run(['sudo', 'chmod', '-R', '2775', userRoot]);
+  run(['sudo', 'chown', '-R', `${serviceUser}:${shellUsername}`, userRoot]);
+  run(['sudo', 'chmod', '-R', '2770', userRoot]);
 
   console.log(`[provision] provisioning complete for ${shellUsername}`);
   return true;