fix(config): safe config file path resolution and isolation

src/Server.py

@@ -832,6 +832,7 @@ def load_or_init_config(config_path: str = CONFIG_FILE_NAME) -> Dict[str, Any]:
         # Resolve relative db_path and cert_dir to writable paths
         config["db_path"] = resolve_writable_path(config["db_path"], "LOGAR-Server", DEFAULT_DB_FILE)
         config["cert_dir"] = resolve_writable_path(config["cert_dir"], "LOGAR-Server", "certs")
+        config["config_file_path"] = os.path.abspath(actual_config_path)
 
         global SESSION_SECRET, _CACHED_SESSION_SECRET
         if not os.environ.get("LOGAR_SESSION_SECRET") and "session_secret" in config:
@@ -873,7 +874,8 @@ def load_or_init_config(config_path: str = CONFIG_FILE_NAME) -> Dict[str, Any]:
         "min_persistence_runs": RUN_THRESHOLD,
         "server_fingerprint": fingerprint,
         "public_key": public_key,
-        "private_key": private_key
+        "private_key": private_key,
+        "config_file_path": os.path.abspath(config_path)
     }
     if not os.environ.get("LOGAR_SESSION_SECRET"):
         SESSION_SECRET = session_sec
@@ -3115,8 +3117,8 @@ def api_db_switch_backend(req: DbSwitchBackendRequest):
         if req.db_path:
             config["db_path"] = req.db_path
 
-    cfg_path = config.get("config_file_path", CONFIG_FILE_NAME)
-    if os.path.exists(cfg_path):
+    cfg_path = config.get("config_file_path")
+    if cfg_path and os.path.exists(cfg_path):
         try:
             with open(cfg_path, "w", encoding="utf-8") as f:
                 json.dump(config, f, indent=2)
@@ -3177,8 +3179,8 @@ def api_db_update_config(req: DbFullConfigRequest):
             if not ok:
                 raise HTTPException(status_code=400, detail=f"PostgreSQL connection/init failed: {msg}")
 
-    cfg_path = config.get("config_file_path", CONFIG_FILE_NAME)
-    if os.path.exists(cfg_path):
+    cfg_path = config.get("config_file_path")
+    if cfg_path and os.path.exists(cfg_path):
         try:
             with open(cfg_path, "w", encoding="utf-8") as f:
                 json.dump(config, f, indent=2)