style: format remaining runtime ES module files

server/standalone/key-setup-hardening.mjs

@@ -51,11 +51,13 @@ function resolveWindowsNativeTools(environment, fileSystem, architecture) {
   if (configured.length === 0) return null;
 
   const roots = configured.map((value) => {
-    if (value !== value.trim() || !/^[A-Za-z]:\\Windows\\?$/i.test(value)) return null;
+    if (value !== value.trim() || !/^[A-Za-z]:\\Windows\\?$/i.test(value))
+      return null;
     return value.endsWith('\\') ? value.slice(0, -1) : value;
   });
   if (roots.some((root) => !root)) return null;
-  if (roots.some((root) => root.toLowerCase() !== roots[0].toLowerCase())) return null;
+  if (roots.some((root) => root.toLowerCase() !== roots[0].toLowerCase()))
+    return null;
 
   const systemRoot = roots[0];
   const systemDirectory = architecture === 'ia32' ? 'Sysnative' : 'System32';
@@ -80,14 +82,23 @@ function resolveWindowsNativeTools(environment, fileSystem, architecture) {
     for (const executable of Object.values(expected)) {
       const entry = fileSystem.lstatSync(executable);
       if (!entry.isFile() || entry.isSymbolicLink()) return null;
-      const canonicalExecutable = realpath.call(fileSystem.realpathSync, executable);
+      const canonicalExecutable = realpath.call(
+        fileSystem.realpathSync,
+        executable,
+      );
       const canonicalCandidates = [executable];
       if (architecture === 'ia32') {
-        canonicalCandidates.push(executable.replace('\\Sysnative\\', '\\System32\\'));
+        canonicalCandidates.push(
+          executable.replace('\\Sysnative\\', '\\System32\\'),
+        );
       }
-      if (!canonicalCandidates.some(
-        (candidate) => candidate.toLowerCase() === canonicalExecutable.toLowerCase(),
-      )) return null;
+      if (
+        !canonicalCandidates.some(
+          (candidate) =>
+            candidate.toLowerCase() === canonicalExecutable.toLowerCase(),
+        )
+      )
+        return null;
     }
   } catch {
     return null;
@@ -99,17 +110,22 @@ function resolveWindowsNativeTools(environment, fileSystem, architecture) {
  * Restrict a credential file before any secret is written to it.
  * Dependencies are injectable so every fail-closed branch is unit-testable.
  */
-export function hardenCredentialFile(filepath, {
-  platform = process.platform,
-  architecture = process.arch,
-  spawn = spawnSync,
-  fileSystem = fs,
-  environment = process.env,
-} = {}) {
+export function hardenCredentialFile(
+  filepath,
+  {
+    platform = process.platform,
+    architecture = process.arch,
+    spawn = spawnSync,
+    fileSystem = fs,
+    environment = process.env,
+  } = {},
+) {
   if (platform !== 'win32') {
     try {
       if (platform === 'darwin') {
-        const aclRemoval = spawn('chmod', ['-N', filepath], { stdio: 'ignore' });
+        const aclRemoval = spawn('chmod', ['-N', filepath], {
+          stdio: 'ignore',
+        });
         if (!commandCompletedSuccessfully(aclRemoval)) return false;
       }
       fileSystem.chmodSync(filepath, 0o600);
@@ -119,7 +135,11 @@ export function hardenCredentialFile(filepath, {
     }
   }
 
-  const tools = resolveWindowsNativeTools(environment, fileSystem, architecture);
+  const tools = resolveWindowsNativeTools(
+    environment,
+    fileSystem,
+    architecture,
+  );
   if (!tools) return false;
 
   try {
@@ -135,14 +155,18 @@ export function hardenCredentialFile(filepath, {
       : null;
     if (!sid) return false;
 
-    const applied = spawn(tools.icacls, [
-      filepath,
-      '/inheritance:r',
-      '/grant:r',
-      `*${sid}:F`,
-      '*S-1-5-18:F',
-      '*S-1-5-32-544:F',
-    ], { stdio: 'ignore', windowsHide: true });
+    const applied = spawn(
+      tools.icacls,
+      [
+        filepath,
+        '/inheritance:r',
+        '/grant:r',
+        `*${sid}:F`,
+        '*S-1-5-18:F',
+        '*S-1-5-32-544:F',
+      ],
+      { stdio: 'ignore', windowsHide: true },
+    );
     if (!commandCompletedSuccessfully(applied)) return false;
 
     // Command success is not proof of the resulting DACL. Query it back and
@@ -173,20 +197,20 @@ export function hardenCredentialFile(filepath, {
         ([name]) => name.toLowerCase() !== 'psmodulepath',
       ),
     );
-    const verified = spawn(tools.powershell, [
-      '-NoProfile',
-      '-NonInteractive',
-      '-Command', WINDOWS_ACL_VERIFY_SCRIPT,
-    ], {
-      env: {
-        ...verifyEnvironment,
-        GEV_ACL_FILE: filepath,
-        GEV_ACL_USER_SID: sid,
-        PSModulePath: powershellModuleDirectory,
+    const verified = spawn(
+      tools.powershell,
+      ['-NoProfile', '-NonInteractive', '-Command', WINDOWS_ACL_VERIFY_SCRIPT],
+      {
+        env: {
+          ...verifyEnvironment,
+          GEV_ACL_FILE: filepath,
+          GEV_ACL_USER_SID: sid,
+          PSModulePath: powershellModuleDirectory,
+        },
+        stdio: 'ignore',
+        windowsHide: true,
       },
-      stdio: 'ignore',
-      windowsHide: true,
-    });
+    );
     return commandCompletedSuccessfully(verified);
   } catch {
     return false;