Fix dist root permissions so --sync publishes a readable directory

The dist directory is the swapped-in staging dir, which mktemp -d creates mode
0700. The published album root therefore stayed 0700, so the first `shuriken
--sync` created the remote album directory 0700 and the web server (daemon) could
not read it -- requiring a manual chmod 755 on each mirror.

Relax the staging dir to the umask-default directory mode right after mktemp -d
(what mkdir would have produced), so the dist root matches its subdirectories and
is served/synced with sane permissions. Add a regression test asserting the dist
root mode equals its photos/ subdirectory mode.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

3 files changed, 29 insertions, 2 deletions

diff --git a/bin/shuriken b/bin/shuriken
index 3f210b9..2e021d0 100755
--- a/bin/shuriken
+++ b/bin/shuriken
@@ -4182,11 +4182,21 @@ generation_staging_dir() {
     local -r final_dist="$1"; shift
     local final_base
     local staging_parent
+    local staging_dir
 
     final_base=$(basename "$final_dist")
     staging_parent=$(existing_parent_dir "$final_dist")
 
-    mktemp -d "$staging_parent/.shuriken.$final_base.staging.XXXXXX"
+    staging_dir=$(mktemp -d "$staging_parent/.shuriken.$final_base.staging.XXXXXX") \
+        || return 1
+    # mktemp -d forces mode 0700; relax it to the umask-default directory mode
+    # (what mkdir would have used) so this directory -- which becomes DIST_DIR
+    # after the swap -- matches its mkdir-created subdirectories and is served and
+    # synced with sane permissions. Otherwise the published album root stays 0700,
+    # so the first `shuriken --sync` creates the remote directory 0700 and the web
+    # server cannot read it.
+    chmod "$(printf '%o' "$(( 0777 & ~0$(umask) ))")" "$staging_dir" || return 1
+    printf '%s\n' "$staging_dir"
 }
 
 prepare_generation_staging_dir() {
diff --git a/src/lib/config.staging.source.sh b/src/lib/config.staging.source.sh
index ebb2694..b76da58 100644
--- a/src/lib/config.staging.source.sh
+++ b/src/lib/config.staging.source.sh
@@ -2,11 +2,21 @@ generation_staging_dir() {
     local -r final_dist="$1"; shift
     local final_base
     local staging_parent
+    local staging_dir
 
     final_base=$(basename "$final_dist")
     staging_parent=$(existing_parent_dir "$final_dist")
 
-    mktemp -d "$staging_parent/.shuriken.$final_base.staging.XXXXXX"
+    staging_dir=$(mktemp -d "$staging_parent/.shuriken.$final_base.staging.XXXXXX") \
+        || return 1
+    # mktemp -d forces mode 0700; relax it to the umask-default directory mode
+    # (what mkdir would have used) so this directory -- which becomes DIST_DIR
+    # after the swap -- matches its mkdir-created subdirectories and is served and
+    # synced with sane permissions. Otherwise the published album root stays 0700,
+    # so the first `shuriken --sync` creates the remote directory 0700 and the web
+    # server cannot read it.
+    chmod "$(printf '%o' "$(( 0777 & ~0$(umask) ))")" "$staging_dir" || return 1
+    printf '%s\n' "$staging_dir"
 }
 
 prepare_generation_staging_dir() {
diff --git a/tests/cli.sh b/tests/cli.sh
index a435e58..aa869cc 100755
--- a/tests/cli.sh
+++ b/tests/cli.sh
@@ -2776,6 +2776,13 @@ test_integration_generates_album_outputs_and_cleans() {
     test::assert_file_exists "$TEST_TMPDIR/dist/shuriken.json"
     test::assert_no_html_subdir_output "$TEST_TMPDIR/dist"
 
+    # The published dist root must carry the same (umask-default) permissions as
+    # its mkdir-created subdirectories, not the 0700 the mktemp staging dir starts
+    # with -- otherwise `--sync` creates the remote album dir 0700 and the web
+    # server cannot read it.
+    test "$(stat -c '%a' "$TEST_TMPDIR/dist")" \
+        = "$(stat -c '%a' "$TEST_TMPDIR/dist/photos")"
+
     page_html=$(<"$TEST_TMPDIR/dist/page-1.html")
     details_html=$(<"$TEST_TMPDIR/dist/1-1-details.html")
     top_index_html=$(<"$TEST_TMPDIR/dist/index.html")