fix: close consolidated quality review findings

bot_bottle/store/db_store.py

@@ -29,8 +29,13 @@ class DbStore:
         """Create and verify the private parent directory."""
         parent = self.db_path.parent
         parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+        if parent.is_symlink():
+            raise PermissionError(f"database directory must not be a symlink: {parent}")
         parent.chmod(0o700)
-        if stat.S_IMODE(parent.stat().st_mode) != 0o700:
+        parent_stat = parent.lstat()
+        if not stat.S_ISDIR(parent_stat.st_mode):
+            raise PermissionError(f"database parent is not a directory: {parent}")
+        if stat.S_IMODE(parent_stat.st_mode) != 0o700:
             raise PermissionError(f"database directory is not mode 0700: {parent}")
 
     def _secure_db_file(self) -> None:
@@ -40,22 +45,34 @@ class DbStore:
         This store contains control-plane identity tokens, so both creation and
         repair are fail-closed rather than best-effort.
         """
+        flags = os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW
+        fd = os.open(
+            self.db_path,
+            flags,
+            stat.S_IRUSR | stat.S_IWUSR,
+        )
         try:
-            fd = os.open(
-                self.db_path,
-                os.O_WRONLY | os.O_CREAT | os.O_EXCL,
-                stat.S_IRUSR | stat.S_IWUSR,
-            )
-        except FileExistsError:
-            pass
-        else:
+            self._secure_open_file(fd)
+        finally:
             os.close(fd)
-        self._chmod()
 
     def _chmod(self) -> None:
         """Enforce and verify the private database mode after every write."""
-        self.db_path.chmod(0o600)
-        if stat.S_IMODE(self.db_path.stat().st_mode) != 0o600:
+        fd = os.open(self.db_path, os.O_RDWR | os.O_NOFOLLOW)
+        try:
+            self._secure_open_file(fd)
+        finally:
+            os.close(fd)
+
+    def _secure_open_file(self, fd: int) -> None:
+        """Pin, validate, and secure an opened database filesystem object."""
+        file_stat = os.fstat(fd)
+        if not stat.S_ISREG(file_stat.st_mode):
+            raise PermissionError(
+                f"database must be a regular file: {self.db_path}"
+            )
+        os.fchmod(fd, stat.S_IRUSR | stat.S_IWUSR)
+        if stat.S_IMODE(os.fstat(fd).st_mode) != 0o600:
             raise PermissionError(f"database is not mode 0600: {self.db_path}")
 
     def _connect(self) -> sqlite3.Connection: