diff options
Diffstat (limited to 'docs/superpowers/plans/2026-09-17-weather-widget.md')
| -rw-r--r-- | docs/superpowers/plans/2026-09-17-weather-widget.md | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/docs/superpowers/plans/2026-09-17-weather-widget.md b/docs/superpowers/plans/2026-09-17-weather-widget.md index 0b78b83..36e2dc1 100644 --- a/docs/superpowers/plans/2026-09-17-weather-widget.md +++ b/docs/superpowers/plans/2026-09-17-weather-widget.md @@ -778,6 +778,12 @@ mkdir -p "$CACHE_DIR" TMP="$CACHE.tmp.$$" trap 'rm -f "$TMP"' EXIT +# The response carries the configured city and its coordinates. That is not a +# secret, but it is location data and it shares a directory with UDT's other +# generated state, all of which is 600. Set the mode before the body lands in +# the file rather than after, so it is never briefly world-readable. +umask 077 + URL="https://api.openweathermap.org/data/2.5/weather" if ! curl -fsS --max-time 15 --get "$URL" \ --data-urlencode "appid=$KEY" \ @@ -789,9 +795,13 @@ if ! curl -fsS --max-time 15 --get "$URL" \ exit 1 fi -# A bad key returns HTTP 200 with a JSON error body, so the status code alone -# proves nothing. This check is carried over from the polybar script, which -# learned it the same way. +# Belt and braces behind `curl -f`. Measured against the live API: a bad key +# returns 401 and an unknown city 404, so curl -f already rejects both and this +# branch is not what catches them. It stays for the case -f cannot see: a 200 +# whose body is not usable weather, which is what the polybar script this was +# ported from actually hit, since it ran curl WITHOUT -f and so received error +# bodies with a success exit. Without this, such a body would reach the parser +# and replace a good cache. if [ "$(jq -r '.cod // empty' "$TMP" 2>/dev/null)" != "200" ]; then echo "weather-fetch: API error: $(jq -r '.message // "unknown"' "$TMP" 2>/dev/null)" >&2 exit 1 |