Fix file and directory permission security issues

Security fixes for gosec G301 and G306:
- Change directory permissions from 0755 to 0750 (remove world-readable)
- Change file permissions from 0644 to 0600 (owner-only access)

Affected files:
- pkg/storage/local/local.go: backup directory creation
- pkg/metadata/metadata.go: metadata file and directory
- pkg/backup/backup.go: log and backup directories
- cmd/metadata-recovery/main_test.go: test directory

These changes ensure sensitive backup data and metadata are not
accessible to unauthorized users, following security best practices.

Author: mattmattox

cmd/metadata-recovery/main_test.go

@@ -136,7 +136,7 @@ func TestScanLocalStorage(t *testing.T) {
 
 	for _, tf := range testFiles {
 		fullPath := filepath.Join(tempDir, tf.path)
-		err := os.MkdirAll(filepath.Dir(fullPath), 0755)
+		err := os.MkdirAll(filepath.Dir(fullPath), 0750)
 		require.NoError(t, err)
 
 		err = os.WriteFile(fullPath, []byte(tf.content), 0644)

pkg/backup/backup.go

@@ -369,7 +369,7 @@ func (m *Manager) createLogFile(id string) (string, *os.File, error) {
 	}
 
 	// Ensure log directory exists
-	if err := os.MkdirAll(logDir, 0755); err != nil {
+	if err := os.MkdirAll(logDir, 0750); err != nil {
 		return "", nil, fmt.Errorf("failed to create log directory: %w", err)
 	}
 
@@ -431,7 +431,7 @@ func (m *Manager) backupDatabase(serverName, serverType, database, backupType st
 		primaryBackupPath = localPaths["by-server"]
 
 		// Ensure the directory exists
-		err := os.MkdirAll(filepath.Dir(primaryBackupPath), 0755)
+		err := os.MkdirAll(filepath.Dir(primaryBackupPath), 0750)
 		if err != nil {
 			errMsg := fmt.Sprintf("failed to create backup directory: %v", err)
 			if logFile != nil {
@@ -677,7 +677,7 @@ func (m *Manager) backupDatabase(serverName, serverType, database, backupType st
 		// We already created the primary file (by-server), now copy to by-type
 		if byTypePath, ok := localPaths["by-type"]; ok {
 			// Create parent directory
-			if err := os.MkdirAll(filepath.Dir(byTypePath), 0755); err != nil {
+			if err := os.MkdirAll(filepath.Dir(byTypePath), 0750); err != nil {
 				log.Printf("Warning: Failed to create directory for by-type backup: %v", err)
 			} else {
 				// Copy the file

pkg/metadata/metadata.go

@@ -174,12 +174,12 @@ func (s *Store) save() error {
 
 	// Ensure directory exists
 	dir := filepath.Dir(s.filepath)
-	if err := os.MkdirAll(dir, 0755); err != nil {
+	if err := os.MkdirAll(dir, 0750); err != nil {
 		return fmt.Errorf("failed to create directory for metadata: %w", err)
 	}
 
 	// Write to file
-	if err := os.WriteFile(s.filepath, data, 0644); err != nil {
+	if err := os.WriteFile(s.filepath, data, 0600); err != nil {
 		return fmt.Errorf("failed to write metadata file: %w", err)
 	}
 

pkg/storage/local/local.go

@@ -34,7 +34,7 @@ func (c *Client) EnsureBackupPath(backupType string) (string, error) {
 	backupDir := filepath.Join(c.cfg.Local.BackupDirectory, backupType)
 
 	// Ensure the directory exists
-	if err := os.MkdirAll(backupDir, 0755); err != nil {
+	if err := os.MkdirAll(backupDir, 0750); err != nil {
 		return "", fmt.Errorf("failed to create backup directory %s: %w", backupDir, err)
 	}