An archive NDJSON carries whole audit rows: actor uids, client IP addresses, request URIs and full before/after entity snapshots. `ArchiveEnvelope::FILE_MODE` is `0640` for exactly that reason, and its docblock spells the harm out: *"`fopen()` creates a file under the ambient umask, which is 0644 on a default install: every local account on the host could read an archive."* There are two ways past it, and a third surface promises a download the module is designed to refuse. ## 1. Disaster-recovery import copies the archive in at the ambient umask `SegmentRestorer::importFromFile()` copies the operator's file into the canonical archive directory with `@copy($path, $final_path)` and never narrows the mode. Every archive the module writes itself is chmod'd to `0640` before a byte of payload lands; an imported one takes whatever the umask gives it, and then stays there for the life of the retention window. This is the disaster-recovery path, so it is exactly the moment an operator is pulling a file off WORM storage onto a host they may not have chosen. ## 2. The chmod that narrows a fresh archive is not checked ```php $this->fileSystem->chmod($temp_path, self::FILE_MODE); ``` `FileSystemInterface::chmod()` returns `FALSE` and logs when it cannot set the mode, which a network mount or a stream wrapper without `stream_metadata` will do. The return is ignored, so the write continues: the archive is hashed, signed into `archive_hmac`, and accepted by live-purge as the copy that replaces the rows it is about to delete — world-readable. Same defect class as the unchecked `fwrite()` that #3620326 fixed, one line after the open. ## 3. The segments page offers a download nothing serves `AuditTrailSegmentsController::buildArchiveFileCell()` sees a stream scheme and renders a link through `FileUrlGenerator::generate()`. The shipped default is `archive_directory: 'private://audit_trail'`, so every archived segment gets a link to `/system/files/audit_trail/<chain>/<year>/...`. Core's `FileDownloadController::download()` collects `hook_file_download()` results and throws `AccessDeniedHttpException` when none returns any. Nothing claims the archive directory: `audit_trail_file`'s implementation returns NULL by design ("read-only so it doesn't compete with whichever module is actually granting access"), and core's own implementation only serves rows in `file_managed`, which an archive is not. **So the link 403s on a default install, on every archived segment.** The missing piece is the claim, not the link. `private://` is access-mediated by design, and the file belongs to this module, so this module is what should be granting it and saying under which permission. ## Proposed resolution - `importFromFile()` narrows the copied file to `ArchiveEnvelope::FILE_MODE` and refuses the import if it cannot, rather than recording a segment against a file it could not protect. - `writeNdjson()` reads the chmod return and refuses the archive on failure, the way `writeLine()` and `closeWritten()` already refuse a short write and a failed close. - A `hook_file_download()` implementation claims the archive directory under `administer audit trail`, the permission the segments page already requires, so the link on that page resolves. It answers for nothing outside that directory, refuses with `-1` rather than silence inside it, and decides membership on resolved paths so a symlink pointing out of the directory is not served. An archive directory configured as an absolute host path has no URL and stays inert on the page. Each gets a test. --- AI-Generated: Yes (Claude Code was used to read the module and to draft this issue and the merge request against it. I reviewed both, and each finding has a test that fails without the change.)