fix: publish the directory page readable by the web server

tests/test_service.py

@@ -344,6 +344,20 @@ def test_a_hostile_title_is_escaped_and_stripped(connection, tmp_path):
     assert validate_bytes(target.read_bytes()).conforms
 
 
+def test_the_directory_page_is_readable_by_the_web_server(connection, tmp_path):
+    """It is served off disk by another user, whatever umask the service has."""
+    import os
+    import stat
+
+    target = tmp_path / "directory.html"
+    old_umask = os.umask(0o077)
+    try:
+        pages.write_directory(str(target), db.listed(connection))
+    finally:
+        os.umask(old_umask)
+    assert stat.S_IMODE(target.stat().st_mode) == 0o644
+
+
 def test_an_empty_directory_still_conforms(connection, tmp_path):
     from mews.lint import validate_bytes