"""Atomic mode-0600 secrets; filenames supplied by application code, never callers."""

import os
import tempfile
from pathlib import Path


def save_secret(path, value):
    with tempfile.NamedTemporaryFile(mode="w", dir=path.parent, delete=False) as file:
        temporary = Path(file.name)
        try:
            file.write(value)
            file.flush()
            os.fsync(file.fileno())
            temporary.chmod(0o600)
            os.replace(temporary, path)
        finally:
            temporary.unlink(missing_ok=True)