5 files changed, 46 insertions, 2 deletions
diff --git a/internal/sym/dec.go b/internal/sym/dec.go
index a54d5e5..f2801b9 100644
--- a/internal/sym/dec.go
+++ b/internal/sym/dec.go
@@ -104,6 +104,9 @@ func (o *DecryptOptions) decryptFile(fileName string, password string) (err erro
 	}
 	fOut, err := os.OpenFile(outFileName, fileOpts, 0644)
 	if err != nil {
+		if errors.Is(err, os.ErrExist) {
+			return fmt.Errorf("output file %q exists (use -f to overwrite)", outFileName)
+		}
 		return err
 	}
 	defer func() {
diff --git a/internal/sym/dec_test.go b/internal/sym/dec_test.go
index cbe0829..6ee5900 100644
--- a/internal/sym/dec_test.go
+++ b/internal/sym/dec_test.go
@@ -107,7 +107,22 @@ func TestDecryptFile_NotFound(t *testing.T) {
 
 	err := DefaultDecryptOptions.decryptFile("my-nonexistent-file.txt", "asdf")
 	if err == nil {
-		t.Fatal("DecryptFile succeeded for nonexistent file, want error")
+		t.Fatal("decryptFile succeeded for nonexistent file, want error")
+	}
+}
+
+func TestDecryptFile_NoPermission(t *testing.T) {
+	t.Parallel()
+
+	fileName := filepath.Join(t.TempDir(), "file.enc")
+	mustWriteFile(t, fileName, []byte("test file content"))
+	mustWriteFile(t, strings.TrimSuffix(fileName, ".enc"), nil)
+	mustChmod(t, strings.TrimSuffix(fileName, ".enc"), 0400)
+	opts := DefaultDecryptOptions
+	opts.force = true
+	err := opts.decryptFile(fileName, "asdf")
+	if err == nil {
+		t.Fatal("decryptFile succeeded for unwritable file, want error")
 	}
 }
 
diff --git a/internal/sym/enc.go b/internal/sym/enc.go
index 87e1954..06ba000 100644
--- a/internal/sym/enc.go
+++ b/internal/sym/enc.go
@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"encoding/binary"
+	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -117,6 +118,9 @@ func (o *EncryptOptions) encryptFile(fileName string, password string) (err erro
 	}
 	fOut, err := os.OpenFile(fileName+ext, fileOpts, 0644)
 	if err != nil {
+		if errors.Is(err, os.ErrExist) {
+			return fmt.Errorf("output file %q exists (use -f to overwrite)", fileName+ext)
+		}
 		return err
 	}
 	defer func() {
diff --git a/internal/sym/enc_test.go b/internal/sym/enc_test.go
index c726dea..e9450e5 100644
--- a/internal/sym/enc_test.go
+++ b/internal/sym/enc_test.go
@@ -45,7 +45,22 @@ func TestEncryptFile_NotFound(t *testing.T) {
 
 	err := DefaultEncryptOptions.encryptFile("my-nonexistent-file.txt", "asdf")
 	if err == nil {
-		t.Fatal("EncryptFile succeeded for nonexistent file, want error")
+		t.Fatal("encryptFile succeeded for nonexistent file, want error")
+	}
+}
+
+func TestEncryptFile_NoPermission(t *testing.T) {
+	t.Parallel()
+
+	fileName := filepath.Join(t.TempDir(), "file")
+	mustWriteFile(t, fileName, []byte("test file content"))
+	mustWriteFile(t, fileName+".enc", nil)
+	mustChmod(t, fileName+".enc", 0400)
+	opts := DefaultEncryptOptions
+	opts.force = true
+	err := opts.encryptFile(fileName, "asdf")
+	if err == nil {
+		t.Fatal("encryptFile succeeded for unwritable file, want error")
 	}
 }
 
diff --git a/internal/sym/sym_test.go b/internal/sym/sym_test.go
index 1eef363..a277ae6 100644
--- a/internal/sym/sym_test.go
+++ b/internal/sym/sym_test.go
@@ -37,6 +37,13 @@ func mustRemove(t *testing.T, path string) {
 	}
 }
 
+func mustChmod(t *testing.T, path string, mod os.FileMode) {
+	t.Helper()
+	if err := os.Chmod(path, mod); err != nil {
+		t.Fatalf("Failed to chmod: %s", err)
+	}
+}
+
 func TestEncryptDecrypt(t *testing.T) {
 	t.Parallel()