Restrict Secrets File Permissions with the chmod Script in Python

import os
import sys
import stat
from pathlib import Path

def restrict_secrets_file(filepath: str) -> None:
    """Set restrictive permissions (0600) on a secrets file."""
    path = Path(filepath).expanduser()
    
    if not path.is_file():
        raise FileNotFoundError(f"Secrets file not found: {path}")
    
    # Set owner read/write only (0600)
    path.chmod(stat.S_IRUSR | stat.S_IWUSR)
    
    # Verify the change
    mode = stat.S_IMODE(path.stat().st_mode)
    print(f"Permissions set for {path}: {oct(mode)} ({mode:04o}")

def rotate_secrets(filepath: str) -> None:
    """Rotate secrets file to a dated backup and create a fresh protected file."""
    path = Path(filepath).expanduser()
    
    # Create timestamped backup
    timestamp = path.stat().st_mtime
    backup = path.with_suffix(path.suffix + f".bak-{int(timestamp)}")
    path.rename(backup)
    print(f"Backup created: {backup}")
    
    # Create new empty file with restrictive permissions
    path.touch(mode=0o600)
    path.chmod(stat.S_IRUSR | stat.S_IWUSR)
    print(f"New secrets file created: {path} (permissions: 0600)")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python rotation_script.py /path/to/secrets.txt")
        sys.exit(1)
    
    target = sys.argv[1]
    try:
        restrict_secrets_file(target)
        rotate_secrets(target)
        print("Secrets file rotation complete.")
    except (FileNotFoundError, PermissionError, OSError) as e:
        print(f"Error: {e}", file=sys.stderr)
        sys.exit(1)