fix: close consolidated quality review findings

bot_bottle/orchestrator/api.py

@@ -7,6 +7,7 @@ import asyncio
 import math
 import sys
 from fastapi import FastAPI, HTTPException
+from fastapi.exceptions import RequestValidationError
 from fastapi.responses import JSONResponse
 from pydantic import BaseModel, ConfigDict, StrictStr
 from starlette.types import ASGIApp, Message, Receive, Scope, Send
@@ -208,6 +209,19 @@ def create_app(orch: OrchestratorCore, *, signing_key: str) -> FastAPI:
     )
     app.add_middleware(ControlPlaneBoundary, signing_key=key)
 
+    @app.exception_handler(RequestValidationError)
+    async def invalid_request(
+        _request: object, exc: RequestValidationError,
+    ) -> JSONResponse:
+        errors = exc.errors()
+        location = errors[0].get("loc", ()) if errors else ()
+        field = str(location[1]) if len(location) > 1 else ""
+        suffix = f": {field}" if field else ""
+        return JSONResponse(
+            {"error": f"invalid request body{suffix}"},
+            status_code=400,
+        )
+
     @app.get("/health")
     def health() -> dict[str, str]:
         return {"status": "ok"}

bot_bottle/store/db_store.py

@@ -29,8 +29,13 @@ class DbStore:
         """Create and verify the private parent directory."""
         parent = self.db_path.parent
         parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+        if parent.is_symlink():
+            raise PermissionError(f"database directory must not be a symlink: {parent}")
         parent.chmod(0o700)
-        if stat.S_IMODE(parent.stat().st_mode) != 0o700:
+        parent_stat = parent.lstat()
+        if not stat.S_ISDIR(parent_stat.st_mode):
+            raise PermissionError(f"database parent is not a directory: {parent}")
+        if stat.S_IMODE(parent_stat.st_mode) != 0o700:
             raise PermissionError(f"database directory is not mode 0700: {parent}")
 
     def _secure_db_file(self) -> None:
@@ -40,22 +45,34 @@ class DbStore:
         This store contains control-plane identity tokens, so both creation and
         repair are fail-closed rather than best-effort.
         """
+        flags = os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW
+        fd = os.open(
+            self.db_path,
+            flags,
+            stat.S_IRUSR | stat.S_IWUSR,
+        )
         try:
-            fd = os.open(
-                self.db_path,
-                os.O_WRONLY | os.O_CREAT | os.O_EXCL,
-                stat.S_IRUSR | stat.S_IWUSR,
-            )
-        except FileExistsError:
-            pass
-        else:
+            self._secure_open_file(fd)
+        finally:
             os.close(fd)
-        self._chmod()
 
     def _chmod(self) -> None:
         """Enforce and verify the private database mode after every write."""
-        self.db_path.chmod(0o600)
-        if stat.S_IMODE(self.db_path.stat().st_mode) != 0o600:
+        fd = os.open(self.db_path, os.O_RDWR | os.O_NOFOLLOW)
+        try:
+            self._secure_open_file(fd)
+        finally:
+            os.close(fd)
+
+    def _secure_open_file(self, fd: int) -> None:
+        """Pin, validate, and secure an opened database filesystem object."""
+        file_stat = os.fstat(fd)
+        if not stat.S_ISREG(file_stat.st_mode):
+            raise PermissionError(
+                f"database must be a regular file: {self.db_path}"
+            )
+        os.fchmod(fd, stat.S_IRUSR | stat.S_IWUSR)
+        if stat.S_IMODE(os.fstat(fd).st_mode) != 0o600:
             raise PermissionError(f"database is not mode 0600: {self.db_path}")
 
     def _connect(self) -> sqlite3.Connection: