[PM-26318] Limit data.json to current user read/write (#16647)

* Limit data.json to current user read/write

* Keep existing permissions for portable

apps/desktop/src/platform/services/electron-storage.service.ts

@@ -3,6 +3,7 @@
 import * as fs from "fs";
 
 import { ipcMain } from "electron";
+import ElectronStore from "electron-store";
 import { Subject } from "rxjs";
 
 import {
@@ -11,22 +12,7 @@ import {
 } from "@bitwarden/common/platform/abstractions/storage.service";
 import { NodeUtils } from "@bitwarden/node/node-utils";
 
-// See: https://github.com/sindresorhus/electron-store/blob/main/index.d.ts
+import { isWindowsPortable } from "../../utils";
-interface ElectronStoreOptions {
-  defaults: unknown;
-  name: string;
-}
-
-type ElectronStoreConstructor = new (options: ElectronStoreOptions) => ElectronStore;
-
-// eslint-disable-next-line
-const Store: ElectronStoreConstructor = require("electron-store");
-
-interface ElectronStore {
-  get: (key: string) => unknown;
-  set: (key: string, obj: unknown) => void;
-  delete: (key: string) => void;
-}
 
 interface BaseOptions<T extends string> {
   action: T;
@@ -48,11 +34,13 @@ export class ElectronStorageService implements AbstractStorageService {
     if (!fs.existsSync(dir)) {
       NodeUtils.mkdirpSync(dir, "700");
     }
-    const storeConfig: ElectronStoreOptions = {
+    const fileMode = isWindowsPortable() ? 0o666 : 0o600;
+    const storeConfig: ElectronStore.Options<Record<string, unknown>> = {
       defaults: defaults,
       name: "data",
+      configFileMode: fileMode,
     };
-    this.store = new Store(storeConfig);
+    this.store = new ElectronStore(storeConfig);
     this.updates$ = this.updatesSubject.asObservable();
 
     ipcMain.handle("storageService", (event, options: Options) => {