From 689235f1da34dc23e3e5a020c1c202a92ba6fa4f Mon Sep 17 00:00:00 2001
From: viettranx <viettranx@gmail.com>
Date: Tue, 3 Mar 2026 14:23:48 +0700
Subject: [PATCH] fix(zalo_personal): data races in policy, directory perms,
 Makefile --no-cache
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Fix 2 data races in policy.go: sendPairingReply and checkGroupPolicy
  accessed c.sess without the read lock — use c.session() accessor
- Fix credentials directory permissions: 0755 → 0700 to prevent other
  users from listing contents
- Revert Makefile --no-cache (debugging leftover that disables Docker
  layer caching)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 Makefile                                  |  3 +--
 internal/channels/zalo/personal/auth.go   |  2 +-
 internal/channels/zalo/personal/policy.go | 12 +++++++++---
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/Makefile b/Makefile
index e94688a3..82d4925b 100644
--- a/Makefile
+++ b/Makefile
@@ -19,8 +19,7 @@ version:
 COMPOSE = docker compose -f docker-compose.yml -f docker-compose.managed.yml -f docker-compose.selfservice.yml
 
 up:
-	$(COMPOSE) build --no-cache
-	$(COMPOSE) up -d
+	$(COMPOSE) up -d --build
 
 down:
 	$(COMPOSE) down
diff --git a/internal/channels/zalo/personal/auth.go b/internal/channels/zalo/personal/auth.go
index 5eb76084..460517ef 100644
--- a/internal/channels/zalo/personal/auth.go
+++ b/internal/channels/zalo/personal/auth.go
@@ -92,7 +92,7 @@ func saveCredentials(path string, cred *protocol.Credentials) error {
 	if cred == nil {
 		return nil
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
 		return err
 	}
 	data, err := json.MarshalIndent(cred, "", "  ")
diff --git a/internal/channels/zalo/personal/policy.go b/internal/channels/zalo/personal/policy.go
index 636b61ea..b5c2a320 100644
--- a/internal/channels/zalo/personal/policy.go
+++ b/internal/channels/zalo/personal/policy.go
@@ -50,7 +50,8 @@ func (c *Channel) checkDMPolicy(senderID, chatID string) bool {
 }
 
 func (c *Channel) sendPairingReply(senderID, chatID string) {
-	if c.pairingService == nil || c.sess == nil {
+	sess := c.session()
+	if c.pairingService == nil || sess == nil {
 		return
 	}
 
@@ -74,7 +75,7 @@ func (c *Channel) sendPairingReply(senderID, chatID string) {
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
-	if _, err := protocol.SendMessage(ctx, c.sess, chatID, protocol.ThreadTypeUser, replyText); err != nil {
+	if _, err := protocol.SendMessage(ctx, sess, chatID, protocol.ThreadTypeUser, replyText); err != nil {
 		slog.Warn("zalo_personal: failed to send pairing reply", "error", err)
 	} else {
 		c.pairingDebounce.Store(senderID, time.Now())
@@ -103,7 +104,12 @@ func (c *Channel) checkGroupPolicy(senderID, groupID string, mentions []*protoco
 
 	// @mention gating: only process group messages that @mention the bot.
 	if c.requireMention {
-		if !isBotMentioned(c.sess.UID, mentions) {
+		sess := c.session()
+		botUID := ""
+		if sess != nil {
+			botUID = sess.UID
+		}
+		if !isBotMentioned(botUID, mentions) {
 			slog.Debug("zalo_personal group message skipped: not mentioned",
 				"group_id", groupID,
 				"sender_id", senderID,