refactor(de-sudo): rework generic file/folder helpers to path-aware ownership

The old copy/move helpers ran 'sudo cp/mv X Y; sudo chown $user_name Y' (root +
arbitrary chown). Rework them to write AS the destination's owner — no root, no
chown — classifying by dest path like createTouch: /docker/containers/<app> ->
runFileOp (docker install user), manager-owned control plane -> runInstallOp.
The $user_name arg is now advisory (the path decides). Covers copyFile/copyFiles/
copyFolder/copyFolders/moveFile; copyResource is always containers -> runFileOp;
createFolders' non-container branch -> runInstallOp; updateFileOwnership (an
arbitrary user1:user2 chown) -> runSystem. Confirmed by callers (containers vs
$docker_dir/backup_install_dir/configs dests). Removes a class of root data ops
+ arbitrary-chown from the runtime.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: librelad <librelad@digitalangels.vip>

scripts/function/file/copy_file.sh

@@ -7,25 +7,22 @@ copyFile()
     local file_name=$(basename "$file")
     local save_dir="$3"
     local save_dir_file=$(basename "$save_dir")
-    local clean_dir=$(echo "$save_dir" | sed 's#//*#/#g')
-    local user_name="$4" 
+    local user_name="$4"   # advisory — the destination path determines the owner
     local flags="$5"
+    local flags_full=""
+    [[ "$flags" == "overwrite" ]] && flags_full="-f"
 
-    if [[ $flags == "overwrite" ]]; then
-        flags_full="-f"
-    fi
+    # Write as the destination's owner — no root, no chown. Under
+    # /docker/containers/<app> that's the docker install user (runFileOp);
+    # the manager-owned control plane (configs/logs/etc.) is runInstallOp.
+    # Mirrors createTouch's path-based ownership; $user_name is now advisory.
+    local op="runInstallOp"
+    [[ "$save_dir" == "$containers_dir"* || "$save_dir" == /docker/containers/* ]] && op="runFileOp"
 
     if [ "$silent_flag" == "loud" ]; then
-        local result=$(sudo cp $flags_full "$file" "$save_dir")
-        checkSuccess "Copying $file_name to $(basename "$save_dir")"
-    elif [ "$silent_flag" == "silent" ]; then
-        local result=$(sudo cp $flags_full "$file" "$save_dir")
-    fi
-
-    if [ "$silent_flag" == "loud" ]; then
-        local result=$(sudo chown $user_name:$user_name "$save_dir")
-        checkSuccess "Updating $save_dir_file with $user_name ownership"
-    elif [ "$silent_flag" == "silent" ]; then
-        local result=$(sudo chown $user_name:$user_name "$save_dir")
+        local result=$($op cp $flags_full "$file" "$save_dir")
+        checkSuccess "Copying $file_name to $save_dir_file"
+    else
+        $op cp $flags_full "$file" "$save_dir" >/dev/null 2>&1
     fi
 }

scripts/function/file/copy_files.sh

@@ -5,31 +5,24 @@ copyFiles()
     local silent_flag="$1"
     local source="$2"
     local save_dir="$3"
-    local user_name="$4"
-    local clean_dir=$(echo "$save_dir" | sed 's#//*#/#g')
+    local user_name="$4"   # advisory — the destination path determines the owner
 
-    # Ensure the source path is expanded to a list of files
-    local files=($(sudo find "$source" -type f))
+    # Write as the destination's owner (see copyFile).
+    local op="runInstallOp"
+    [[ "$save_dir" == "$containers_dir"* || "$save_dir" == /docker/containers/* ]] && op="runFileOp"
 
+    local files=($($op find "$source" -type f))
     if [ ${#files[@]} -eq 0 ]; then
         echo "No files found in the source directory: $source"
     fi
 
     for file in "${files[@]}"; do
         local file_name=$(basename "$file")
-
         if [ "$silent_flag" == "loud" ]; then
-            local result=$(sudo cp -f "$file" "$save_dir")
+            local result=$($op cp -f "$file" "$save_dir")
             checkSuccess "Copying $file_name to $save_dir"
-        elif [ "$silent_flag" == "silent" ]; then
-            local result=$(sudo cp -f "$file" "$save_dir")
-        fi
-
-        if [ "$silent_flag" == "loud" ]; then
-            local result=$(sudo chown $user_name:$user_name "$save_dir/$file_name")
-            checkSuccess "Updating $file_name with $user_name ownership"
-        elif [ "$silent_flag" == "silent" ]; then
-            local result=$(sudo chown $user_name:$user_name "$save_dir/$file_name")
+        else
+            $op cp -f "$file" "$save_dir" >/dev/null 2>&1
         fi
     done
 }

scripts/function/file/copy_resource.sh

@@ -23,11 +23,8 @@ copyResource()
         fi
     fi
 
-    local result=$(sudo cp "$app_dir/resources/$file_name" "$destination_dir/")
+    # Destination is always /docker/containers/<app> -> write as the docker
+    # install user (runFileOp); no root, no chown.
+    local result=$(runFileOp cp "$app_dir/resources/$file_name" "$destination_dir/")
     checkSuccess "Copying $file_name to $destination_dir"
-
-    local destination_path="$destination_dir/$file_name"
-
-    local result=$(sudo chown $docker_install_user:$docker_install_user "$destination_path")
-    checkSuccess "Updating $file_name with $docker_install_user ownership"
 }

scripts/function/file/move_file.sh

@@ -6,16 +6,13 @@ moveFile()
     local file_name=$(basename "$file")
     local save_dir="$2"
     local save_dir_file=$(basename "$save_dir")
-    local clean_dir=$(echo "$save_dir" | sed 's#//*#/#g')
 
     if [ -e "$file" ]; then
-        local result=$(sudo mv "$file" "$save_dir")
+        # Move as the destination's owner — no root, no chown (see copyFile).
+        local op="runInstallOp"
+        [[ "$save_dir" == "$containers_dir"* || "$save_dir" == /docker/containers/* ]] && op="runFileOp"
+        local result=$($op mv "$file" "$save_dir")
         checkSuccess "Moving $file_name to $save_dir"
-
-        if [[ $clean_dir != *"$containers_dir"* ]]; then
-            local result=$(sudo chown $sudo_user_name:$sudo_user_name "$save_dir")
-            checkSuccess "Updating $save_dir_file with $sudo_user_name ownership"
-        fi
     else
         isNotice "Source file does not exist: $file"
     fi

scripts/function/folder/copy_folder.sh

@@ -5,12 +5,12 @@ copyFolder()
     local folder="$1"
     local folder_name=$(basename "$folder")
     local save_dir="$2"
-    local user_name="$3"
-    local clean_dir=$(echo "$save_dir" | sed 's#//*#/#g')
+    local user_name="$3"   # advisory — the destination path determines the owner
 
-    local result=$(sudo cp -rf "$folder" "$save_dir")
-    checkSuccess "Coping $folder_name to $save_dir"
+    # Write as the destination's owner — no root, no chown (see copyFile).
+    local op="runInstallOp"
+    [[ "$save_dir" == "$containers_dir"* || "$save_dir" == /docker/containers/* ]] && op="runFileOp"
 
-    local result=$(sudo chown $user_name:$user_name "$save_dir/$folder_name")
-    checkSuccess "Updating $folder_name with $user_name ownership"
+    local result=$($op cp -rf "$folder" "$save_dir")
+    checkSuccess "Copying $folder_name to $save_dir"
 }

scripts/function/folder/copy_folders.sh

@@ -4,23 +4,20 @@ copyFolders()
 {
     local source="$1"
     local save_dir="$2"
-    local user_name="$3"
-    local clean_dir=$(echo "$save_dir" | sed 's#//*#/#g')
+    local user_name="$3"   # advisory — the destination path determines the owner
+
+    # Write as the destination's owner — no root, no chown (see copyFile).
+    local op="runInstallOp"
+    [[ "$save_dir" == "$containers_dir"* || "$save_dir" == /docker/containers/* ]] && op="runFileOp"
 
-    # Ensure the source path is expanded to a list of subdirectories
     local subdirs=($(find "$source" -mindepth 1 -maxdepth 1 -type d))
-
     if [ ${#subdirs[@]} -eq 0 ]; then
         echo "No subdirectories found in the source directory: $source"
     fi
 
     for subdir in "${subdirs[@]}"; do
         local subdir_name=$(basename "$subdir")
-
-        local result=$(sudo cp -rf "$subdir" "$save_dir")
+        local result=$($op cp -rf "$subdir" "$save_dir")
         checkSuccess "Copying $subdir_name to $save_dir"
-
-        local result=$(sudo chown -R $user_name:$user_name "$save_dir/$subdir_name")
-        checkSuccess "Updating $subdir_name with $user_name ownership"
     done
 }

scripts/function/folder/create_folder.sh

@@ -24,20 +24,13 @@ createFolders()
             continue
         fi
 
+        # Non-container path = manager-owned control plane -> create AS the
+        # manager (runInstallOp); no root, no chown.
         if [ ! -d "$dir_path" ]; then
-            local result=$(sudo mkdir -p "$dir_path")
-            if [ "$silent_flag" == "loud" ]; then
-                checkSuccess "Creating $folder_name directory"
-            fi
-        else
-            if [ "$silent_flag" == "loud" ]; then
+            local result=$(runInstallOp mkdir -p "$dir_path")
+            [ "$silent_flag" == "loud" ] && checkSuccess "Creating $folder_name directory"
+        elif [ "$silent_flag" == "loud" ]; then
             isNotice "$folder_name directory already exists"
         fi
-        fi
-
-        local result=$(sudo chown $user_name:$user_name "$dir_path")
-        if [ "$silent_flag" == "loud" ]; then
-            checkSuccess "Updating $folder_name with $user_name ownership"
-        fi
     done
 }

scripts/function/permission/ownership/file.sh

@@ -8,6 +8,6 @@ updateFileOwnership()
     local user_name_1="$2"
     local user_name_2="$3"
 
-    local result=$(sudo chown $user_name_1:$user_name_2 "$file")
+    local result=$(runSystem chown $user_name_1:$user_name_2 "$file")
     checkSuccess "Updating $file_name with $user_name ownership"
 }